Inter-VN Communication in Cisco SD-WAN Architecture

300-420 By islever Editorial Last updated

Describe Cisco SD-WAN design considerations (control plane design, overlay design, LAN design, high availability, redundancy, scalability, security design, QoS and multicast over SD-WAN fabric) Describe Cisco SD-WAN architecture (orchestration plane, management plane, control plane, data plane, on-boarding and provisioning, security)

Short answer

D Route leaking can be used on the fabric border nodes to inject routes from one VN to another.

Question

Which solution allows overlay VNs to communicate with each other in an SD-WAN Architecture?
  1. External fusion routers can be used to map VNs to VRFs and selectively route traffic between VRFs.
  2. GRE tunneling can be configured between fabric edges to connect one VN to another.
  3. SGTs can be used to permit traffic from one VN to another.
  4. Route leaking can be used on the fabric border nodes to inject routes from one VN to another. Correct Answer

Key Takeaways

The main trap is confusing SD-WAN mechanisms with SD-Access components; route leaking is the specific SD-WAN feature for inter-VN routing, whereas fusion routers belong to SD-Access.

Learn how route leaking enables communication between overlay Virtual Networks in Cisco SD-WAN. Discover why external fusion routers and GRE tunnels are incorrect choices for this specific architecture.

Common mistake: Many candidates select Option A, incorrectly applying SD-Access concepts like 'Fusion Routers' to an SD-WAN scenario. This error stems from mixing up the two distinct Cisco automation architectures.

Expert Analysis

The question asks for the mechanism that allows overlay Virtual Networks (VNs) to communicate with each other within a Cisco SD-WAN architecture. In this environment, VNs are logically isolated segments, often mapped to separate VRFs on the WAN Edge devices. To allow traffic to flow between these isolated segments, specific routing policies must be applied.

Option D is correct because route leaking is the standard method in Cisco SD-WAN for enabling inter-VN communication. This can be achieved through centralized policy-based route leaking, where vSmart controllers inject routes from one VN into another, or through local inter-VRF route leaking on IOS-XE WAN Edges when both VRFs exist on the same device. This mechanism selectively shares routes, permitting traffic flow while maintaining segmentation elsewhere.

Option A is incorrect because it describes functionality related to Cisco SD-Access (specifically Fusion Routers), not SD-WAN. While the comment section contains debate, the technical distinction is clear: Fusion Routers are part of the SD-Access fabric design, whereas SD-WAN uses Route Leaking for VN-to-VN connectivity. Option B is incorrect because GRE tunnels are used for underlay transport or site-to-site connectivity, not for inter-VN routing logic within the overlay. Option C is incorrect because SGTs (Security Group Tags) are primarily used for policy enforcement and filtering within the SD-Access context, not for enabling routing between VNs in SD-WAN.

The key insight here is distinguishing between SD-WAN and SD-Access architectural components. Misidentifying SD-Access tools (like Fusion Routers) as SD-WAN solutions is a common trap. The operational consequence of ignoring route leaking is that VNs remain strictly isolated, preventing necessary cross-segment communication.

Official Reference

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-routing-leaking-for-service-sharing.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When answering SD-WAN questions, carefully distinguish between SD-WAN and SD-Access terminology. If you see terms like 'Fabric Edge', 'Border Node', 'Fusion Router', or 'SGT', pause and consider if the question is actually about SD-Access. For SD-WAN specifically, focus on 'Route Leaking', 'vSmart', and 'Overlay VNs'. Eliminate options that describe underlay transport (GRE/IPsec) when the question asks for logical connectivity between segments.

Frequently Asked Questions

What is the difference between Route Leaking in SD-WAN and SD-Access?

In SD-WAN, route leaking is a centralized or local policy to share routes between VNs/VPNs. In SD-Access, 'leaking' often refers to connecting fabric domains via Fusion Routers to shared services, which is a different architectural component.

Can GRE tunnels connect different VNs in SD-WAN?

No. GRE tunnels are used for transport (underlay) between sites. They do not provide the logical routing mechanism required to share routes between isolated overlay Virtual Networks.

More 300-420 FAQ →

Community Votes

A
59%
D
33%
B
8%

59% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 26 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 26

  1. goku2020 👍 11
    A External fusion router.
  2. aai5548 👍 3
    I think it's A. B; There is something about GRE-tunneling in SDA; two-box border node with GRE-peer, but this is not the way to do this. C; SGT's are used to filter within a VN, not VN-to-VN. D; Router leaking and VRF-leaking is for access to shared services outside the fabric. Not for VN-to-VN.
  3. andrewChan 👍 3 Answered A
    according to ENSLD cert guide Page 335 any communication between endpoints in different VNs must go through a fusion router or firewall and VNs belong to SD-Access. not SD-WAN
  4. salmarin 👍 3 Answered A
    Clearly there is a typo in the question and it's SDA not SDWAN
  5. cryptonite 👍 3
    All the answers seem to suggest SDA - Fusion, Border, Edge etc
Show 21 more comments
  1. SpicyMochi 👍 2 Answered A
    My thoughts on this one: GRE (Generic Routing Encapsulation) tunneling can also be used to enable communication between overlay VNs in some network designs. By configuring GRE tunnels between the fabric edge devices, traffic from one VN can be sent through the tunnel to another VN, enabling inter-VN communication. However, option A, which involves using external fusion routers to map VNs to VRFs and selectively route traffic between VRFs, is a more common approach in SD-WAN architectures. It offers greater flexibility and control for policy-based routing, whereas GRE tunneling may require manual configuration and maintenance of tunnels, which can be more complex and less scalable in large deployments. So, while both options A and B can be used to enable communication between overlay VNs, option A is more common and generally more suitable for SD-WAN architectures.
  2. Ranx01 👍 2
    The CCNP Enterprise Design ENSLD 300-420 Official Cert Guide mentions, "A Fusion router is used to allow endpoints in different VNs to communicate with each other", it also states "vEdge routers are responsible for establishing the network fabric and forwarding traffic; they bring up IPsec and GRE tunnels between sites...vEdge routers establish a control channel to vSmart controllers and IPsec tunnels to other vEdge devices to form the overlay network". If I understand correctly, I think "vEdge Routers" do the mapping of VN's to VRF's not "Fusion Routers". Fusion Routers acts as the next-hop to a VN. I'm swayed towards "B" as the correct answer.
  3. Blipblop 👍 2
    Is it?... A Fusion device enables Virtual routing and forwarding (VRF) leaking across SD-Access Fabric domains, and enables host connectivity to shared services, such as DHCP, DNS, NTP, ISE, Cisco DNA Center, Wireless LAN Controllers (WLC) and similar
  4. luisjuradoledesma 👍 2
    My understanding would be that initially overlay tunnels are used to establish comms between the VNs and then IPSec (GRE) VPN tunnels are set up permanently between fabric edges - then... isn't B correct? open to hear opinions
  5. luisjuradoledesma 👍 2
    I'm getting crazy with this one. Why every single supplier says GRE tunnels - it's by far more sensible A (External Fusion router) - I'm taking the test tomorrow - can anyone clarify please?
  6. python_tamer 👍 2 Answered A
    All the answers relate to SDA rather than SD-WAN so I think the wording of the question is not right here. Therefore, the answer should be A.
  7. akbntc 👍 2 Answered A
    Guys, read the questions carefully... it's about SD-WAN (not SD-Access). Options B,C,D are for SD-Access components.
  8. roganjosh 👍 2 Answered B
    Leaning towards B guys, question say SD-WAN not SD-Access, Fusion routers are used in SD-Access.
  9. BW1001 👍 2
    This question is about SD-WAN not SDA
  10. Clauster 👍 2 Answered A
    The answer is absolutely A
  11. G_Singh12 👍 1 Answered A
    Cisco best practices explicitly dictate that internal route leaking should not be performed directly on the Fabric Border nodes themselves to maintain fabric control plane database stability and predictable path forwarding. Instead, this task is handed off to the external fusion router. By default, VNs are completely isolated from one another in the data plane (represented internally as unique VRFs), and they cannot communicate directly inside the fabric overlay. • To allow controlled communication between different VNs (for example, giving a corporate user VN access to a shared services printer/DHCP VN), traffic must exit the fabric. An external Fusion Router receives these VNs via external VRF-Lite mappings at the fabric border and uses prefix route-leaking or firewall policies to selectively route traffic between them before sending it back in.
  12. Clauster 👍 1 Answered D
    CORRECT ANSWER IS D !!!!!!!! In an SD-WAN (Software-Defined Wide Area Network) architecture, route leaking is a common technique used to allow overlay Virtual Networks (VNs) to communicate with each other. Route leaking involves selectively sharing or injecting routes from one VN to another, thereby enabling traffic to flow between the isolated VNs. Key points about route leaking in an SD-WAN architecture: Fabric Border Nodes: Route leaking typically occurs at the border nodes of the SD-WAN fabric. These nodes are responsible for connecting the overlay VNs to external networks. ALSO: FABRIC ROUTERS ARE USED ON SD-ACCESS NOT SD-WAN !! BE CAREFUL
  13. NoHombre 👍 1 Answered D
    In Cisco SD-WAN, each overlay VN is implemented as a separate VPN/VRF on WAN Edge devices. If two VNs must communicate, you selectively leak routes between those VPNs. This is done with policy-based route leaking (typically a centralized control policy on vSmart that matches routes from VPN X and “sets VPN” to Y), or with local inter-VRF route leaking on IOS-XE WAN Edges when both VRFs exist there. This preserves segmentation while enabling only the intended prefixes to be reachable across VNs—exactly what “overlay VNs communicate with each other” requires.
  14. Clauster 👍 1 Answered D
    THE ANSWER IS D Fabric Routers are used in SD-Access not SD-WAN, This eliminates answer A. Fabric Edges are also used in SD-Access so that eliminates that question as well. The other answer makes no sense. The answer is D: You can do Route leaking to talk between VN https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-routing-leaking-for-service-sharing.html Lets' Gooo i was able to find it.
  15. Buffering 👍 1 Answered D
    The Vedge router configuration guide shows explicitly how to allow VPN to VPN communication - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/vEdge-20-x/routing-book/m-routing-leaking-for-service-sharing.html#Cisco_Concept.dita_037b791c-e340-491a-a74c-09c973301991 Its annoying they use VN instead of VPN to try and throw you off.
  16. Emily23 👍 1
    But the question is about SD-WAN. I think you can go with the "I don't care what they ask, I will answer what is think" approach, but don't think is very efficient.
  17. Clauster 👍 1
    This is not correct, moderator if you could please remove this comment i don't want users to get confused, the correct answer is D
  18. sonicwarrior 👍 1
    Hmm the question is wrong, that should mean SD-Access - VN virtual network, that is used within SD-Access not in SD-WAN
  19. Xavi07 👍 1
    to comunicate one VN to another VM is via internal tunel in the SD-WAN; so the correct is B.
  20. cwoolie 👍 1
    What is answer?
  21. cwoolie 👍 1
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

VPLS design for sites sharing one IP subnet

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

Hierarchical QoS Shaping to Protect Voice at a 50 Mbps CIR

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide