Cisco 300-420 - Designing Cisco Enterprise Networks (ENSLD) v1.1

A fabric edge node in Cisco SD-Access is the access-layer fabric device that connects endpoints to the fabric, applies policy, and registers endpoint reachability with the control plane. Cisco SD-Access design material describes edge nodes as devices that identify and authenticate endpoints, place them into the correct virtual network, and update the fabric control plane with endpoint information. The edge node is also where the anycast Layer 3 gateway commonly resides, allowing consistent gateway behavior across the fabric. Option B describes the control-plane node function, because the control plane maintains endpoint-to-location mappings in the host tracking database. Option C describes a border node, which connects the fabric to external Layer 3 networks. Option D also describes the map-resolver behavior associated with the control plane, not the fabric edge. The purpose of the edge node is therefore endpoint attachment, endpoint detection, policy association, and registration of endpoint information with the control plane so the fabric can forward traffic through the correct overlay path.

OSPF with the hub in area 0 and branch routers in stub areas with ECMP is the best fit because the customer has multivendor branch routers with limited memory and CPU. EIGRP is not suitable in this case because the branch environment is multivendor and EIGRP is not the safest open-standard design choice for broad interoperability. IS-IS can be efficient, but it is less common for small DMVPN branch deployments and the option does not address the requirement for resource-constrained branch routing. eBGP route reflection is not technically correct, because route reflectors are an iBGP scaling mechanism. OSPF provides an open-standard dynamic routing solution, and placing branches in stub areas limits the amount of external routing information that low-resource branch routers must process. ECMP allows both equal 10-Mbps DMVPN paths to be used when equal-cost paths exist. This design reduces operational overhead compared with static routing while respecting the platform constraints at the spokes. Reference topics: OSPF branch design, stub areas, ECMP, DMVPN routing, multivendor interoperability, branch resource optimization.

The YANG module mapping follows the distinction between standards-based, vendor-neutral, and vendor-native data models. IETF YANG models are standards-driven and are appropriate when the design goal is protocol-level interoperability across vendors for common network functions. OpenConfig models are also vendor-neutral, but they are developed by the OpenConfig community and commonly use a structured separation between intended configuration and operational state. Cisco native models expose platform-specific Cisco IOS XE, IOS XR, or NX-OS capabilities and are often the most complete option when a feature is unique to a Cisco operating system. The selected drag-and-drop answer aligns each characteristic with the model family that owns that behavior. In a professional automation design, the engineer should not choose a model only because it is familiar. The correct choice depends on feature coverage, device support, platform release, schema stability, and whether the workflow must operate consistently across vendors. For multivendor intent, choose IETF or OpenConfig first; for Cisco-specific feature depth, use Cisco native models. Reference topics: YANG, IETF models, OpenConfig, Cisco native models, NETCONF and RESTCONF automation.

Policing is the correct mechanism for managing traffic that exceeds the configured threshold. The application is UDP-based, inelastic, and sensitive to delay and jitter, so excess traffic should not be buffered and transmitted later. Cisco defines traffic policing as measuring traffic against a configured rate and applying an action such as transmit, drop, or remark when traffic conforms, exceeds, or violates the policy. In contrast, shaping buffers excess traffic and releases it later to smooth the output rate. That behavior is useful for TCP or provider handoff control, but it can add delay and jitter, which is harmful for inelastic real-time UDP flows. Scheduling has already been addressed by allocating bandwidth and assigning queues; it decides how queues are serviced, not how excess flows are constrained. Remarking changes packet markings but does not by itself enforce a traffic threshold. Therefore, policing is the appropriate QoS conditioning action for traffic above the configured limit. Reference topics: traffic policing, QoS conditioning, shaping versus policing, UDP real-time applications, delay and jitter control.

The required resource is the organization name. During manual WAN Edge onboarding, the device needs local system identity information and transport reachability so it can authenticate into the Cisco Catalyst SD-WAN overlay. Cisco onboarding workflows identify system parameters such as system IP, site ID, organization name, and vBond information as required configuration elements. The organization name must match the value configured across the SD-WAN controllers; otherwise, certificate validation and control connection establishment fail. After the WAN Edge authenticates with vBond, vBond helps it discover the vSmart controllers and vManage. That is why the vSmart hostname is not the first required onboarding resource in this question. NAT may exist in the path and vBond can assist traversal, but NAT itself is not the configuration identity item. A generic domain name is not the same as the SD-WAN organization name. Reference topics: Cisco SD-WAN onboarding, vBond orchestrator, organization-name, control connections, WAN Edge manual configuration.

LTE is the most appropriate backup WAN option for remote sites that already rely on microwave links. A backup transport should use a different failure domain from the primary service; LTE provides carrier wireless connectivity that is operationally separate from the customer’s microwave infrastructure. It is widely available, fast to deploy, and suitable as an out-of-band or secondary WAN path for branch continuity. WiMAX is an older metropolitan wireless technology and is not the preferred current enterprise backup choice. A laser link is another line-of-sight technology and can suffer from similar environmental and alignment constraints as microwave, so it is a weaker diversity option. Bluetooth is a short-range personal-area technology and is not a viable WAN backup for enterprise branches. LTE also integrates well with SD-WAN, IPsec VPN, and routing-based failover designs. In a resilient WAN architecture, the architect should validate signal quality, carrier coverage, data plan, antenna placement, NAT behavior, and whether the backup link must support dynamic routing, VPN encryption, and QoS for critical traffic during failover.

Cisco SD-Access LAN automation deploys IS-IS as the underlay routing protocol to build node-to-node adjacencies automatically. The underlay must provide stable IP reachability between fabric nodes before the overlay control plane and VXLAN data plane can operate correctly. Cisco SD-Access design guidance uses an automated routed access underlay in which point-to-point links are discovered and provisioned, and IS-IS is used to advertise infrastructure reachability. This approach reduces manual configuration, accelerates brownfield or greenfield onboarding, and creates a consistent transport foundation for the fabric. LISP is used in the SD-Access control plane for endpoint mapping, not for building underlay adjacencies. VXLAN is the overlay data-plane encapsulation and does not establish routing adjacencies. OSPF can be used in some routed networks, but LAN automation for SD-Access uses IS-IS as the automated underlay protocol. Reference topics: SD-Access LAN automation, routed underlay, IS-IS underlay, fabric node discovery, Cisco Catalyst Center automation.

The correct design is to advertise a default route from the aggregation layer toward the access layer and summarize the VLAN subnets at the aggregation layer toward the core. Cisco hierarchical campus design places summarization at aggregation or distribution boundaries because that is where access-layer routes are collected before entering the core. Summarizing the VLAN ranges into 10.0.0.0/16 hides individual access VLAN instability from the core, reducing routing table entries, protocol churn, and memory consumption on core devices. Sending a default route from aggregation to access also keeps access switches simple and prevents them from carrying unnecessary campus routing detail. This design contains failures and convergence events inside the appropriate block. Summarizing at the access layer is less practical when multiple VLANs aggregate at distribution. Advertising a default toward the core is backwards, because the core must know the summarized access block. Reference topics: hierarchical campus routing, aggregation-layer summarization, default routing to access, route-table reduction, convergence containment.

The correct action is to configure EIGRP stub behavior on R4. The DUAL-3-SIA message indicates a Stuck-in-Active condition, which occurs when EIGRP sends a query and does not receive a reply within the expected time. Cisco explains that EIGRP stub routing is used to improve stability and reduce resource usage by preventing unnecessary queries from being sent to remote or edge routers. In the described topology, R4 is connected over a limited 10 Mbps inter-router link and should not be treated as a transit router for the rest of the routing domain. Making R4 an EIGRP stub limits the query scope and reduces the chance of active routes waiting on a slow or constrained neighbor. Poison reverse and split-horizon changes address loop prevention and hub-and-spoke update behavior, but they do not directly solve the SIA instability. A summary on R2 may help scaling but does not identify the edge-router query boundary as precisely as EIGRP stub. Reference topics: EIGRP DUAL, Stuck-in-Active, EIGRP stub routing, query scoping, WAN edge stability.

The OSPF design should include LSA/SPF timer tuning and summarization with appropriate stub-area design. Cisco OSPF convergence is affected by failure detection, LSA generation, flooding, SPF scheduling, and routing-table installation. Tuning LSA and SPF throttling timers helps the network react quickly to genuine failures while avoiding excessive CPU churn during repeated flaps. This is especially important when voice and video traffic are sensitive to convergence delay. Manual route summarization at area boundaries reduces the number of detailed routes advertised between areas and limits the blast radius of link failures. Configuring nonbackbone areas as stub networks where appropriate also reduces external LSA propagation and lowers router resource use. Reducing DR and BDR election frequency is not a primary design tool for convergence, and increasing hello and hold timers would slow failure detection rather than improve it. Advertising default routes can be useful, but it does not by itself contain link flap impact. Reference topics: OSPF area design, LSA throttling, SPF throttling, route summarization, stub areas, convergence optimization.