Cisco 350-401: WAN, VPN and SD-WAN Connectivity — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Enterprise WAN design balances reachability, performance, cost, and security across heterogeneous underlays and overlays. Modern architectures blend private transports (MPLS, Metro Ethernet) with public broadband and cellular, using encrypted overlays (IPsec, DMVPN, Cisco SD-WAN) to achieve transport independence, segmentation, and application-aware path selection. Robust operations require continuous measurement (loss, latency, jitter), brownout detection, and fast failover, while preserving QoS and security end to end.

WAN Transport and Provider Connectivity

Enterprises commonly combine multiple WAN transports to mitigate risk and optimize costs:

• MPLS L3VPN: Predictable latency/jitter with carrier QoS and defined SLAs. Native any-to-any connectivity. Trade-offs include higher recurring cost, longer provisioning, carrier-managed routing, and dependence on a single provider domain. Verify last-mile diversity; dual-home to diverse PEs or POPs to avoid shared failure domains.
• Metro Ethernet (E-LAN/E-LINE): High bandwidth, low latency within metropolitan or regional footprints; useful for data center interconnect and regional hubs. Consider MTU support for overlay encapsulation and QoS marking behavior across the provider handoff.
• Internet DIA/broadband: Economical, ubiquitous, and scalable. No QoS guarantees; performance variance and potential DSCP stripping. Requires overlay encryption and brownout detection. Validate CGN and NAT compatibility for VPNs; prefer public/static IPs for simpler onboarding.
• LTE/5G: Rapid deployment and out-of-band or tertiary WAN. Variable latency and jitter; data caps and RF congestion are common constraints. Place as backup or for critical out-of-band management.
• Private lines (DWDM, leased TDM/Ethernet circuits): Deterministic and secure by isolation. Limited flexibility, higher cost per bit, and lack of inherent any-to-any connectivity.

Design for transport diversity at multiple layers:

• Physical: Separate conduits, power, and demarc locations.
• Provider: Distinct carriers and upstream ASes.
• Technology: Mix MPLS, DIA, broadband, and cellular.
• Routing: Independent control planes (eBGP to different PEs, overlay control independent of underlay).

Key failure modes and mitigations:

• Last-mile cut or provider maintenance: Dual last-mile and rapid reroute with overlays.
• MTU/fragmentation blackholes from encapsulation overhead: Set path MTU discovery and MSS clamping.
• DSCP remarking by ISPs: Re-mark at WAN edge; rely on per-tunnel QoS in the overlay.
• CGNAT breaking inbound tunnels: Use controller-assisted onboarding or outbound-initiated tunnels.

VPN and Tunneling Fundamentals

GRE provides simple L3/L2 encapsulation for overlay reachability but no encryption or integrity. It is often paired with IPsec for confidentiality. GRE keepalives detect one-way failures; MTU overhead requires tuning.

IPsec secures data at Layer 3. Core elements:

• IKEv2 for control-plane key exchange and SA negotiation, with Dead Peer Detection and NAT-T.
• ESP with AES-GCM or AES-CBC plus integrity; PFS to ensure forward secrecy.
• Re-key timers balanced for security and CPU overhead.

Example: GRE over IPsec on IOS XE (abbreviated)

• interface Tunnel0 ip address 10.0.0.1 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 ip mtu 1400 ip tcp adjust-mss 1360
• crypto ikev2 proposal AES-GCM
• crypto ipsec profile GRE-IPSEC set transform-set aes-gcm
• interface Tunnel0 tunnel protection ipsec profile GRE-IPSEC

DMVPN adds scale via multipoint GRE and NHRP, enabling spoke-to-spoke tunnels on-demand. Dynamic routing (EIGRP, OSPF, BGP) runs over the overlay. Trade-offs:

• Strengths: Elastic spoke meshing, reduced hub forwarding, simpler provisioning.
• Risks: NHRP database churn, hub bottlenecks, headend crypto/CPU sizing, QoS granularity limited per-tunnel unless hierarchical policies are used. Troubleshoot with show dmvpn, show ip nhrp, and crypto SA state.

Segmentation:

• Legacy: VRF-Lite and MPLS L3VPNs isolate traffic domains.
• Overlays: SD-WAN “VPNs” represent virtualized routing instances per segment; map to VRFs on the WAN edge. This provides tenant and service isolation without transport dependence.

Cisco SD-WAN Architecture and Operation

Cisco SD-WAN separates planes:

• vManage: Single management plane for configuration, monitoring, and lifecycle operations.
• vBond: Orchestrator that authenticates WAN Edges, provides initial reachability, and can act as a STUN server for NAT traversal.
• vSmart: Control-plane brain that establishes secure control connections, runs OMP to distribute routes, TLOC attributes, and policies, and disseminates security information for tunnel establishment.

WAN Edge (vEdge/Catalyst SD-WAN) devices build data-plane IPsec tunnels over any underlay (MPLS, Internet, LTE). Control plane uses DTLS/TLS to the controllers; data plane uses IPsec with BFD-based performance probes. Core concepts:

• TLOC: Tuple of system IP, color (underlay type/intent), and encapsulation. Colors allow policy to prefer or restrict transports.
• OMP routes: Prefix reachability; TLOC routes: transport adjacency; Service routes: service insertion.
• Segmentation: SD-WAN VPNs provide isolated routing domains across the fabric.

Onboarding and security:

• ZTP with certificate-based identity (SUDI or controller-issued), time synchronization, and reachability to vBond.
• NAT handling with vBond STUN and NAT-T. Time skew, certificate expiry, and unreachable controllers are common onboarding failure points.

Tunnel transport:

• Full-mesh or partial-mesh secure tunnels among WAN Edges per policy.
• Per-TLOC/per-VPN BFD monitors loss, latency, and jitter at configurable intervals and multipliers to detect blackouts and brownouts.

Policy, Performance, and Resilience

Policy layers:

• Centralized control policy: Influences OMP advertisements and hub/spoke topology (e.g., route filtering, TLOC preference).
• Centralized data policy: Defines forwarding behaviors per VPN and per traffic class (matching IP fields) across the fabric.
• Local policy: Interface-level QoS, ACLs, and shaping on an individual WAN Edge.

Application-aware routing (AAR) uses SLA classes and BFD-measured path characteristics to select a path per application or traffic class:

• SLA class defines acceptable thresholds for loss, one-way latency, and jitter, and probe frequency. Multiple classes can reflect app tiers (voice, transactional, best effort).
• Path selection evaluates candidate TLOCs per policy, preferring compliant paths. If none comply, fallbacks include best-available path, local breakout, or drop—driven by policy. Hysteresis and hold-down timers prevent flapping.
• Flow pinning maintains path consistency for established sessions; new flows re-evaluate path choice.

Quality of Service:

• Per-tunnel shaping to underlay CIR, hierarchical policies for queueing (LLQ for voice, AF classes), and policer awareness on provider edges.
• DSCP preservation across IPsec is supported; re-mark as needed before encryption to preserve intent.
• On Internet transports, treat QoS locally (egress shaping, prioritization) knowing that transit QoS is not guaranteed.

Security and segmentation:

• Per-VPN ZBFW, URL filtering, IDS/IPS, and TLS proxy can be inserted at the WAN edge.
• Secure internet breakout (DIA) offloads SaaS/Internet traffic locally while enforcing security policy; remaining traffic follows the overlay to hubs or DCs.

Resilience:

• Active/active use of multiple colors (e.g., mpls and biz-internet) with ECMP or policy-preferred primary/secondary.
• Backup transports such as LTE with higher TLOC cost/preference to engage only on failure.
• TLOC extension bridges transport from one device to another at a site, increasing survivability when circuits terminate on different routers.
• Regional hub pairs in different DCs ensure control/data redundancy; dual-controller clusters per role (vManage, vBond, vSmart) distributed across sites.

Brownout detection:

• BFD-derived metrics identify degradation before hard failure. Policies can steer only sensitive traffic (voice, VDI) away from a degraded link while leaving bulk flows on it, preserving bandwidth.

Operations and Troubleshooting

Operational verification focuses on underlay reachability, overlay control, and data-plane performance:

• Underlay: Validate IP addressing, NAT behavior, and MTU. Use ping with DF-bit and varying sizes, traceroute, and ip sla tracking for legacy designs. For LTE, check signal quality and carrier CGNAT.
• SD-WAN control: show control connections to verify DTLS/TLS sessions to vBond, vSmart, and vManage. Time sync and certificates must be valid.
• OMP: show omp peers and show omp routes to confirm route and TLOC exchange; analyze control-policy effects.
• Data plane: show bfd sessions and loss/latency/jitter statistics; correlate with app-route SLA compliance. Packet captures on WAN interfaces help validate DSCP and IPsec encapsulation.
• Policy: Inspect centralized/local policies for match conditions and actions; confirm app identification via DPI and fallback to port-based classification where needed.
• QoS: show policy-map interface, queue drops, and shaping rates; ensure encryption overhead is accounted for in shaping to avoid tail drops.
• Legacy VPNs: show crypto ikev2 sa, show crypto ipsec sa, show dmvpn, and NHRP tables for tunnel state. Common issues include phase-1/phase-2 mismatch, NAT-T not negotiating, and PMTUD failures.

Failure recovery:

• Ensure controller redundancy and device rehoming policies; test loss of a controller site.
• Validate brownout steering and reversion with controlled impairment testing.
• Implement configuration rollback checkpoints and staged deployments from vManage.

Practical Problem Scenario

Northstar Retail is replacing a single-provider MPLS WAN with a dual-transport SD-WAN using DIA broadband and MPLS at 200 branches, with LTE as tertiary backup. The goals are to maintain voice and POS transaction SLAs, enable secure internet breakout for SaaS, and minimize migration risk.

Approach:

1. Build the SD-WAN control plane

• Deploy redundant vManage, vSmart, and vBond in two data centers. Rationale: vManage provides management, vSmart supplies the control plane via OMP and policy distribution, and vBond orchestrates onboarding and NAT traversal. Geographic redundancy ensures survivability of the control plane.

2. Prepare underlays and site diversity

• Order DIA and, where feasible, a different-carrier MPLS or MetroE; add LTE at critical sites. Configure separate demarcs and power paths. Rationale: Diverse providers and last miles reduce correlated failures; LTE ensures tertiary reachability during regional outages.

3. Onboard WAN Edges with ZTP and certificates

• Use vBond-assisted onboarding; ensure accurate time via NTP and allow outbound UDP/TCP for controller discovery. Rationale: Certificate-based identity and vBond STUN overcome NAT barriers and establish secure control channels.

4. Define segmentation and services

• Create SD-WAN VPNs for Corp (VPN 10), Voice (VPN 20), Guest (VPN 30), and PCI (VPN 40). Insert ZBFW and URL filtering on Guest and DIA for Corp. Rationale: Per-VPN isolation meets compliance and security goals; service chaining enforces per-segment security.

5. Establish SLA classes and application-aware routing

• Create SLA-Voice (tight loss/latency/jitter), SLA-Transact (moderate thresholds), and SLA-BE (best effort). Match apps using DPI for voice/SIP/RTP and POS gateways. Policy prefers MPLS for Voice and POS when compliant, otherwise steers to DIA; bulk/SaaS prefers DIA. Rationale: BFD-driven SLA compliance allows brownout avoidance while optimizing cost paths.

6. Configure QoS and shaping per transport

• Apply hierarchical QoS with LLQ for voice, AF queues for POS and interactive traffic, and shaping to the provider CIR minus IPsec overhead. Preserve DSCP before encryption. Rationale: Prevent tail drops, ensure priority for latency-sensitive apps, and avoid fragmentation.

7. Enable secure internet breakout

• For SaaS and web traffic, perform local DIA with ZBFW, DNS security, and URL filtering; send unknown or sensitive destinations to DC hubs for inspection. Rationale: Reduces latency to SaaS while maintaining policy control and compliance.

8. Implement resilience and failover policy

• Use active/active ECMP across DIA and MPLS for BE; set TLOC preference so Voice/POS choose MPLS when healthy. Configure LTE with lower preference for failover only. Add hysteresis timers to prevent flapping. Rationale: Controlled preference and stability during brownouts; LTE reserved for emergencies.

9. Validate MTU and MSS, then pilot

• Set tunnel MTU/MSS on WAN Edges; verify PMTUD across both transports. Pilot 10 branches, injecting controlled loss/latency to confirm path steering and reversion. Rationale: Avoid fragmentation blackholes and confirm operational behavior before scale-out.

10. Migrate in waves with rollback

• Advertise site subnets via OMP from both legacy MPLS CPE and WAN Edge during coexistence. Cut traffic by adjusting default routes and BGP metrics. Maintain a backout by restoring legacy metrics. Rationale: Non-disruptive transition with deterministic rollback.

11. Operationalize monitoring and troubleshooting

• Dashboards in vManage monitor BFD metrics, SLA compliance, and app paths. Use show control connections, show omp routes, and show bfd sessions for deep checks. Establish alerting thresholds aligned to SLA classes. Rationale: Early detection of brownouts and rapid root cause isolation.

12. Hardening and periodic tests

• Rotate certificates, test controller failover, and run quarterly impairment tests. Rationale: Sustains security posture and verifies that failover and brownout responses remain effective as the network evolves.

← Network Virtualization · All domains · Enterprise Security and Identity Services →

Practice these questions → · Timed practice on ExamRoll.io →