Which AES Mode for Cisco SD-WAN Multicast Traffic?
Which AES mode should be used in a Cisco SD-WAN environment that includes multicast applications?
Community Insight
The question tests the OCG rule that a secondary AES mode is required for multicast, and the trap is picking GCM because it is the default preferred mode for ordinary unicast SD-WAN traffic.
Cisco SD-WAN vEdge routers encrypt data-plane traffic with AES-256, and this page establishes that AES-256-GCM is the preferred mode while AES-256-CBC is the mode used when multicast applications are present in the overlay.
Option D (GCM) is chosen by many learners because the OCG names AES-256-GCM as the preferred operation and newer releases appear to support it for multicast; but the exam text explicitly carves out multicast as the case where the secondary CBC mode applies.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The 300-420 Official Cert Guide states that vEdge routers use AES with a 256-bit key length with the preferred operation Galois/Counter Mode (GCM), and that a secondary mode, cipher block chaining (CBC), can be used when required, such as in multicast applications. Because the question asks specifically about an environment that includes multicast applications, it is targeting exactly that carve-out. The wording of the question is a paraphrase of the OCG sentence, so the intended exam answer is AES-256-CBC. Exam blueprints test the published study text, and the multicast clause is the distinguishing detail being assessed.Why the Other Options Are Wrong
Option D (GCM) is the preferred mode for regular SD-WAN data-plane traffic, so it is the strongest distractor, but the guide names it as the default rather than the multicast-specific mode. Options A (ECB) and B (CFB) never appear in Cisco SD-WAN documentation for the data plane: ECB leaks patterns and is unsuitable for network traffic, while CFB is a stream-like mode not used in the IPsec implementations on vEdge/vSmart platforms. Neither ECB nor CFB provides the authenticated combination associated with the CBC-plus-HMAC legacy construction described for multicast deployments, so they cannot be the intended answer.Community Comment Notes
NoHombre quoted the OCG directly, noting "A secondary mode, cipher block chaining (CBC), can be used when required, such as in multicast applications," which is the decisive evidence for C. 34da117 likewise pointed to the Bruno and Jordan design book stating the CBC case "such as in multicast app." On the other side, 26d13e9 cited a Cisco page saying release 20.1.x and later uses AES-256-GCM for multicast, and mohdx argued newer releases support GCM for multicast too. tossaway25 resolved that tension by concluding "C (CBC) is the definitive answer," and e14efdb voted C on the same OCG basis; the release-version argument reflects current product behavior rather than the exam's published source text.Exam Strategy
Read for the qualifier: when a question names a special traffic type such as multicast, multicast in SD-WAN design, it is usually pointing at the exception clause in the OCG rather than the general default. Match the option to the exact scenario wording instead of the mode you see most often in production.
Frequently Asked Questions
Why not choose GCM if the OCG calls it the preferred SD-WAN mode?
GCM is preferred for ordinary unicast data-plane traffic. The OCG carves out multicast applications as the case where the secondary CBC mode is used, which is what this question targets.
Do newer Cisco SD-WAN releases use GCM for multicast too?
Some community notes cite release 20.1.x and later using AES-256-GCM for multicast, but the exam follows the OCG text, which specifies CBC for multicast applications.
Related Analysis
Practice All 300-420 Questions
Access 150 questions with complete answers and detailed explanations.
View Full 300-420 Practice Test →