Cisco AVC Capability: Bandwidth Enforcement on IOS
What is a capability of Cisco AVC?
Community Insight
The question tests the distinction between visibility tools and enforcement mechanisms, with the trap being the assumption that deep packet inspection applies to encrypted traffic.
This question assesses knowledge of Cisco Application Visibility and Control (AVC) capabilities, specifically its ability to enforce application bandwidth policies on Cisco IOS platforms.
Candidates often select Option D because they associate AVC with deep packet inspection (DPI), failing to realize that DPI cannot effectively inspect IPsec-encrypted traffic without decryption.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is correct because Cisco AVC is fundamentally built upon Network-Based Application Recognition version 2 (NBAR2). NBAR2 provides stateful deep packet inspection for unencrypted traffic, allowing administrators to classify applications and apply Quality of Service (QoS) policies, such as bandwidth limits or prioritization, directly on Cisco IOS platforms. This enables granular control over network resources based on specific application types.Why the Other Options Are Wrong
Option B is incorrect because GET VPN is a site-to-site encryption technology used for mass key distribution and tunneling; it does not serve as an interoperability mechanism for AVC's policy enforcement. Option C is incorrect because traffic filtering via Security Intelligence (SI) relies on reputation-based blacklists/whitelists provided by Cisco Talos, which is distinct from the classification and policing functions of AVC. Option D is incorrect because AVC/NBAR2 performs deep packet inspection on clear-text traffic; it cannot inspect the payload of IPsec-encapsulated traffic unless the traffic is decrypted at the firewall/router edge first.Community Comment Notes
Community consensus strongly supports Option A. Commenters highlight that AVC involves components like NBAR2 and Flexible NetFlow (FNF) to provide "powerful application visibility and control." One user noted that AVC helps deliver "business-intent policies across the entire network" without additional appliances. Another commenter emphasized its role in providing "deep visibility into network traffic, enabling administrators to identify and classify applications." These points align with the official capability of enforcing bandwidth and visibility on IOS devices.Official Reference
Exam Strategy
When studying Cisco AVC, focus on its reliance on NBAR2 for application classification and how this classification feeds into QoS policies for bandwidth enforcement. Remember that "Control" implies action (like policing), while "Visibility" implies monitoring, and both are core to AVC.
Frequently Asked Questions
Why can't Cisco AVC perform deep packet inspection on IPsec traffic?
AVC uses NBAR2 for stateful DPI, which requires clear-text payloads. IPsec encapsulates and encrypts traffic, preventing NBAR2 from seeing the application headers unless the traffic is decrypted at the device.
Is Security Intelligence part of Cisco AVC?
No, Security Intelligence is a separate feature set on Cisco Firewalls that uses threat intelligence feeds for filtering. AVC focuses on application recognition and QoS bandwidth management.