Cisco 300-440 - Designing and Implementing Cloud Connectivity (ENCC)

To enable the OMP advertisement of BGP routes for a specific VRF instance on a Cisco IOS XE SD-WAN device, the engineer must first configure the global address-family ipv4 and then enable bgp advertisement under the vrf definition. This will allow the device to advertise the BGP routes learned from the cloud provider to the OMP control plane, which will then distribute them to the other SD-WAN devices in the overlay network1

References := 1: Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3: Implementing Cloud Connectivity, Lesson 3: Configuring IPsec VPN from Cisco IOS XE to AWS, Topic: Configuring BGP on the Cisco IOS XE Device, Page 3-24.

Step 1 = Navigate to Configuration, select Templates, and then select Device Templates. Step 2 = Click Create Template, select From Feature Template, and then select the device model. Step 3 = Select Device, select Service Node, and then set Template Name and Description. Step 4 = Attach the device template to the device.

The process of configuring an AppGoE service node for WAN optimization for applications that are hosted in the cloud using Cisco vManage for C8000V or C8500L-8S4X devices involves several steps12.

Navigate to Configuration, select Templates, and then select Device Templates: This is the first step where you navigate to the Templates section in the Configuration menu of Cisco vManage1.

Click Create Template, select From Feature Template, and then select the device model: In this step, you create a new template for the device model from the feature template1.

Select Device, select Service Node, and then set Template Name and Description: After setting up the template, you select the device and the service node, and then set the template name and description1.

Attach the device template to the device: Finally, you attach the created device template to the device1.

References :=

AppQoE - Step-by-Step Configuration - Cisco Community

Cisco Catalyst SD-WAN AppQoE Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x

To send traffic into an IPsec tunnel to the cloud VPN gateway, the engineer must configure two actions:

Configure access lists that match the interesting user traffic. This is the traffic that needs to be encrypted and sent over the IPsec tunnel. The access lists are applied to the crypto map that defines the IPsec parameters for the tunnel.

Configure policy-based routing (PBR). This is a technique that allows the engineer to override the routing table and forward packets based on a defined policy. PBR can be used to send specific traffic to the IPsec tunnel interface, regardless of the destination IP address. This is useful when the cloud VPN gateway has a dynamic IP address or when multiple cloud VPN gateways are available for load balancing or redundancy. References:

Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3: Implementing Cloud Connectivity, Lesson 3: Implementing IPsec VPNs to the Cloud, Topic: Configuring IPsec VPNs on Cisco IOS XE Routers

Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter: Configuring IPsec VPNs, Topic: Configuring Crypto Maps

[Cisco IOS XE Gibraltar 16.12.x Feature Guide], Chapter: Policy-Based Routing, Topic: Policy-Based Routing Overview

The correct answer is A and E because they are the IP prefixes that match the tunnel interfaces on the Cisco IOS XE router. The AWS routing options should include the local and remote IP prefixes that are used for the IPsec tunnel endpoints. The other options are either the public IP addresses of the routers or the LAN subnets that are not relevant for the IPsec tunnel configuration. References := Designing and Implementing Cloud Connectivity (ENCC) v1.0, Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services, Site-to-Site VPN with Amazon Web Services

To configure a custom application with Cisco SD-WAN centralized policy, you need to follow these steps25:

Click Configuration, select Policies, and then select Centralized Policy.

Click Custom Options, select Centralized Policy, and then select Lists.

Click Custom Applications, and then select New Custom Application.

Enter a name for the application, enter the match criteria, and then click Add.

The process of configuring a custom application with a Cisco SD-WAN centralized policy using Cisco vManage involves several steps1.

Click Configuration, select Policies, and then select Centralized Policy: This is the first step where you navigate to the Policies section in the Configuration menu of Cisco vManage1.

Click Custom Options, select Centralized Policy, and then select Lists: In this step, you select the Custom Options, then select Centralized Policy, and finally select Lists1.

Click Custom Applications, and then select New Custom Application: After setting up the Lists, you click on Custom Applications and then select New Custom Application1.

Enter a name for the application, enter the match criteria, and then click Add: Finally, you enter a name for the application, specify the match criteria, and then click Add to complete the configuration1.

References :=

Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE

This command redistributes the routes learned from BGP AS100 into OSPF Area 1, which allows router R2 to advertise those routes to router R1 and connect the on-premises network to the cloud provider. The other options are incorrect because they either redistribute the wrong routes or use the wrong syntax5 .

I hope this helps you understand the question and the answer. If you have any other questions or requests, please let me know. I am always happy to help.😊

References: 1: Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300-440) Exam Prep 2: Designing and Implementing Cloud Connectivity (ENCC) v1.0 3: Cisco Multiprotocol Label Switching 4: Exploring Cisco Cloud OnRamp for Colocation 5: ENCC: Configuring IPsec VPN from Cisco IOS XE to AWS : [Deploying Cisco IOS VTI-Based Point-to-Point IPsec VPNs]

Display the time and process information of the device, as well as CPU, memory, and disk usage data. = show sdwan system status1

Validate the configured zone-based firewall. = show policy-firewall config1

Display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices. = show sdwan policy app-route-policy-filter1

View the security information that is configured for IPsec tunnel connections. = show sdwan security-info

The commands used to identify issues on a Cisco IOS XE SD-WAN device are as follows1:

show sdwan system status: This command is used to display the time and process information of the device, as well as CPU, memory, and disk usage data1.

show policy-firewall config: This command is used to validate the configured zone-based firewall1.

show sdwan policy app-route-policy-filter: This command is used to display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices1.

show sdwan security-info: This command is used to view the security information that is configured for IPsec tunnel connections1.

References :=

Cisco IOS XE Catalyst SD-WAN Qualified Command Reference

Cisco Catalyst SD-WAN Command Reference

Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE

SD-WAN Tunnel Interface Commands - Cisco

Step 1 = Create a Customer Gateway (CGW) in AWS. Step 2 = Create a Virtual Private Gateway (VGW) in AWS. Step 3 = Create a site-to-site VPN connection in AWS. Step 4 = Configure the IOS XE router with the required IPsec VPN parameters and routing settings. Step 5 = Verify and test the VPN connection.

The process of configuring a site-to-site VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS) involves several steps12.

Create a Customer Gateway (CGW) in AWS: This is the first step where you define the public IP address of your on-premises Cisco IOS XE router in AWS1.

Create a Virtual Private Gateway (VGW) in AWS: This involves creating a VGW and attaching it to the VPC in AWS1.

Create a site-to-site VPN connection in AWS: After setting up the CGW and VGW, you then create a site-to-site VPN connection in AWS. This involves specifying the CGW, VGW, and the static IP prefixes for your on-premises network1.

Configure the IOS XE router with the required IPsec VPN parameters and routing settings: After the AWS side is set up, you configure the on-premises Cisco IOS XE router with the required IPsec VPN parameters and routing settings2.

Verify and test the VPN connection: Finally, you verify and test the VPN connection to ensure that it is working correctly12.

References :=

Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community

SD-WAN Configuration Example: Site-to-site (LAN to LAN) IPSec between vEdge and Cisco IOS - Cisco Community

The role of service providers to establish private connectivity between on-premises networks and Google Cloud resources is to facilitate direct, dedicated network connections through Google Cloud Interconnect. Google Cloud Interconnect is a service that allows customers to connect their on-premises networks to Google Cloud through a service provider partner. This provides low latency, high bandwidth, and secure connectivity to Google Cloud services, such as Google Compute Engine, Google Cloud Storage, and Google BigQuery. Google Cloud Interconnect also supports hybrid cloud scenarios, such as extending on-premises networks to Google Cloud regions, or connecting multiple Google Cloud regions together. Google Cloud Interconnect offers two types of connections: Dedicated Interconnect and Partner Interconnect. Dedicated Interconnect provides physical connections between the customer’s network and Google’s network at a Google Cloud Interconnect location. Partner Interconnect provides virtual connections between the customer’s network and Google’s network through a supported service provider partner. Both types of connections use VLAN attachments to establish private connectivity to Google Cloud Virtual Private Cloud (VPC) networks. References:

Designing and Implementing Cloud Connectivity (ENCC) v1.0

[Google Cloud Interconnect Overview]

[Google Cloud Interconnect Documentation]