Versa Networks VNX100 - Versa Certified SD-WAN Associate

The Versa Stateful Firewall feature encompasses a range of security capabilities, including Unified Threat Management (UTM), which may comprise antivirus, IPS, and web filtering services. It also provides Zone Protection, which enforces security policies based on the zones defined in the network to protect network segments. DDoS protection and DUP are also vital security functions, but they are not specified as capabilities within the Stateful Firewall feature set in the documents provided.

When a speed test fails, it could be due to the speed test module not being activated or the speed test server not being enabled at the remote site. If the speed test module has not been activated, the required functionality to conduct the test will not be operational. Similarly, if the remote site does not have the speed test server enabled, it won't respond to speed test requests. Issues with the SLA path status or client configuration might be relevant to the performance and reachability but are not cited as direct reasons for a speed test failure within the documentation provided.

To monitor a Versa CPE interface's live data, you would use the Versa Director. The Versa Director provides a comprehensive interface for real-time monitoring and management of SD-WAN infrastructure, including the visualization of traffic flows and performance metrics. Through Versa Director, network operators can gain insights into transmission data for all traffic or SD-WAN-specific traffic, updated every few seconds, and detailed information about interface statistics​​.

The policy shown in the exhibit appears to match traffic flows based on multiple conditions involving the source zone and the application. Given the information in the screenshot:

The policy is configured with multiple zones as source zones:Intf-LAN1-ZoneandIntf-WLAN-Zone.

An application is specified:SHAREPOINT.

The policy is likely to be applied to traffic originating from either of the specified zones and specifically related to the SharePoint application. This implies that both conditions related to the source zones are not mutually exclusive but rather a union; the same goes for the application condition.

Given this interpretation, the correct set of conditions that match the policy shown would be:

B.Traffic flows that meet any of the following two conditions:

Source Zone - Intf-LAN1 Zone

Source Zone - Intf-WLAN-Zone

In addition, the below condition must also match:

Application - SharePoint

This means that traffic will match the policy if it comes from either theIntf-LAN1-Zoneor theIntf-WLAN-Zoneandis SharePoint application traffic.

However, to be more precise in the context of Versa SD-WAN configurations, it's important to note that policies are usually applied when all conditions within a single rule are met. If the configuration in the screenshot intends to express that traffic is matched if it comes from either of the two zones and is for the SharePoint application, then the correct answer should reflect this logic. If the configuration system is set up to require all conditions in a rule to be met, then the answer could potentially be different. Since the user interface design can sometimes vary, it’s important to understand the specific logic of the system in question.

The roles of a Versa Controller include onboarding SD-WAN VOS branches into the network and maintaining a secure control channel with each node. The Versa Controller authenticates branch VOS instances, handles management activities between the remote and headend nodes, and distributes control plane information. It does not provide Internet breakout, which is a function typically performed by edge devices at the branches themselves, nor does it provide clock synchronization to the branches, which is generally a function of network protocols like NTP that operate independently of SD-WAN control.​

In the exhibit shown, the gear icon next to the VLAN setting in a template workflow indicates a place where you can input variable data for each device that shares this template. The gear icon typically represents settings that are customizable for each individual deployment. Therefore, you would select the gear icon for a VLAN in a template workflow when each device requires a unique VLAN configuration on the vni-0/1 interface. This allows for the VLAN ID to be specified per device when the template is applied, accommodating the requirement that each device may be connected to a different VLAN in its respective location.

Top of Form

When a CPE device appears in the unknown device list in Versa Director Inventory during Zero Touch Provisioning (ZTP), it typically indicates a discrepancy in device identification details. Specifically,the device workflow configuration not having the correct serial number of the CPE defined (Answer C)can lead to this issue. The workflow configuration must accurately include the serial number so that Versa Director can recognize and authenticate the device as part of the organization’s network infrastructure. If the serial number in the workflow configuration does not match the serial number of the actual device, the Director will not be able to properly identify and classify the device, thus placing it in the unknown device list.

References:Versa’s official documentation on ZTP outlines the importance of accurate device identifiers in the workflow configuration to ensure successful device onboarding and recognition by the Versa Director.

The Direct Internet Access (DIA) option in the configuration of split tunnels for an SD-WAN device, as shown in the exhibit, is a feature that allows traffic destined for the internet to bypass the SD-WAN overlay network and be sent directly out of the local branch’s internet connection. This can significantly improve access to cloud services andinternet performance by reducing latency and avoiding backhauling traffic through the corporate data center or another central location.

When DIA is enabled, traffic that is destined for the internet does not traverse the SD-WAN overlay network; instead, it is routed directly from the branch to the internet. The SD-WAN appliance can still enforce security policies on this traffic, and it can also be programmed to dynamically decide whether to use the DIA path based on real-time performance metrics and other criteria.

By implementing the BGP default route advertisement into the local LAN Virtual Routing and Forwarding (VRF) of the tenant, the SD-WAN appliance advertises a default route to the local site. This allows the site to route internet-bound traffic directly to the internet without having to send it across the SD-WAN network. This eases the internal network traffic load and can potentially reduce costs associated with data transmission over the corporate WAN.

References:The explanation provided above aligns with standard SD-WAN architecture and practices for configuring split tunnels and the use of Direct Internet Access in SD-WAN environments.