I85PREP
⌘ K
Cisco ENSDWI 300-415 study materials
Cisco ENSDWI 300-415 study resources

Cisco ENSDWI 300-415: SD-WAN Operations, Monitoring, and Troubleshooting

Cisco ENSDWI 300-415 · Work through your exam, one topic at a time.

All guide sections

SD-WAN Operations, Monitoring, and Troubleshooting

SD-WAN Operations, Monitoring, and Troubleshooting

This domain tests your verification workflow: which tool shows which layer, the CLI commands that prove it, and the failure signatures you must recognize.

vManage monitoring

Monitor > Network > Devices exposes control connections, BFD sessions, OMP routes and TLOCs, interfaces and tunnels per device. The Troubleshooting pane runs ping, traceroute, DNS lookups, ARP and packet capture from the device. Alarms, syslog, SNMP and cflowd/IPFIX exports are configured through feature templates; vAnalytics adds application and path quality history.

CLI evidence (cEdge)

  • show sdwan control connections - DTLS state to vBond, vSmart, vManage.
  • show sdwan omp routes / show sdwan omp tlocs - what was learned and advertised.
  • show sdwan bfd sessions - one per tunnel pair; proves the data plane.
  • show sdwan ipsec outbound-connections - SA state and rekey counters.
  • show sdwan tunnel statistics and show sdwan policy data-policy - path quality and policy counters. On vSmart the equivalents are show omp routes and show omp tlocs.

Failure signatures

  • Control down - no route to vBond/vSmart, UDP 12346 filtered, certificate or validity mismatch, clock skew, wrong organization name.
  • Control up, BFD down - IPsec blocked (ESP/UDP 4500), interface down, MTU or ACL issue.
  • BFD up, route missing - OMP control policy filtering, VPN membership, duplicate site-id.
  • AAR not switching - BFD absent on a transport, DPI disabled, SLA thresholds unrealistic.

Worked example

Two edges show MPLS BFD up and biz-internet BFD down. show sdwan control connections is up for both colors, and show sdwan omp tlocs shows the biz-internet TLOC, so OMP works. show sdwan ipsec outbound-connections shows no SA for that peer, which points to the underlay: an upstream firewall is dropping ESP and UDP 4500. Opening those protocols brings BFD up without touching the overlay.

Traps

  • Treating a green vManage reachability icon as proof the data plane works.
  • Confusing control connections with BFD sessions when isolating a fault.
  • Overlooking NTP; skew breaks certificate validation.
  • Ignoring duplicate site-id alarms, which cause asymmetric routing.