Cisco ENSDWI 300-415 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

vBond role

Authenticates devices, performs NAT traversal, and provides vManage/vSmart lists during onboarding; must be reachable on UDP 12346 by all devices.

vSmart role

Distributes OMP routes and centralized policy between routers; runs the control plane over DTLS and does not forward data traffic.

vManage role

Central management plane for configuration templates, monitoring, and policy; by default also acts as the certificate authority for the fabric.

OMP

Overlay Management Protocol; runs over DTLS between routers and vSmart, carrying routes, TLOCs, and policy with attributes like preference and origin.

TLOC

Tunnel endpoint identified by system IP, color, and encapsulation; represents a WAN transport path used to build IPsec/GRE tunnels.

VPN 0

Transport VPN carrying underlay interfaces, TLOCs, and control connections to controllers; WAN interfaces with colors are configured here.

VPN 512

Reserved management VPN used for out-of-band management access to devices; not used for user traffic or service routing.

Feature template

Reusable device-model-specific configuration block for interfaces, routing, or security; bound to devices through a device template.

Device template

Binds feature templates to a device model and applies variables per device; attachment pushes configuration and shows sync status.

CLI template

Free-form configuration template using raw CLI; cannot be combined with feature templates on the same device at the same time.

System IP

Unique per-device identifier used as the OMP router ID and TLOC component; must be configured before onboarding.

Site ID

Numeric identifier grouping devices at a location; used by topology and policy to match sites rather than individual devices.

Color

Attribute on a WAN interface identifying transport type (e.g., biz-internet, mpls, lte); required with encapsulation to form a TLOC.

Configuration groups

Hierarchical reusable configuration model in newer vManage; supports variables and is recommended for large-scale deployments.

Centralized control policy

vSmart policy that changes OMP topology, route preference, or filtering; affects control-plane route propagation, not data forwarding directly.

Centralized data policy

vSmart policy matching data traffic by VPN, prefix, DSCP, or application; actions include accept, drop, set TLOC, or service insertion.

AAR

Application-Aware Routing; probes paths against SLA classes for latency, loss, and jitter, then selects the best TLOC meeting the SLA.

SLA class

Defines latency, loss, and jitter thresholds used by AAR; traffic classes reference SLA classes to choose a compliant path.

DIA

Direct Internet Access; sends internet-bound traffic out a local internet TLOC instead of backhauling to a hub, often combined with security.

Policy order

Centralized policies evaluate top-down and first match wins; a default action at the end defines behavior for unmatched traffic.

IPsec encapsulation

Default SD-WAN tunnel encapsulation providing encryption and integrity; uses IKE on UDP 500/4500 and ESP for data.

GRE encapsulation

Alternative tunnel encapsulation without encryption; suitable only for trusted transports or when encryption is provided elsewhere.

Service insertion

Steers traffic through a service node (firewall, IPS) in a service VPN using a centralized data policy action or service chain.

Zone-based firewall

cEdge security feature grouping interfaces into zones with allow/deny rules; enabled through security feature templates and applied per VPN.

Certificate authority

Signs device and controller certificates; vManage runs it by default, and losing the CA can invalidate trust across the fabric.

SGT propagation

Carries TrustSec group tags across the SD-WAN fabric so policy can be enforced based on group membership rather than IP.

Control connection states

'up' means DTLS established; 'connect' or 'challenge' usually indicates certificate, reachability, or vBond issues.

BFD on TLOC

Bidirectional Forwarding Detection used for TLOC liveness and path quality; a down BFD session indicates tunnel or path failure.

OMP route check

Use 'show omp routes' or 'show sdwan omp routes' to verify prefixes, TLOC next hops, and attributes received from vSmart.

Upgrade order

Upgrade controllers first (vBond, vSmart, vManage), then routers; maintain redundancy and verify compatibility during the process.

vManage backup

Backs up configuration, templates, and CA data; restoring the CA is critical to preserve certificate trust across the fabric.

Underlay ACL check

Firewalls or ACLs blocking UDP 12346, 500, or 4500 prevent control connections and IPsec tunnels; verify NAT traversal too.