Q7IPsec Cloud ConnectivityMultiple answers
Refer to the exhibit. An engineer is analyzing packet flow from the Cisco Edge router named Branch1 on a Cisco vSmart controller. The engineer finds that traffic destined for the Cisco Edge router named Branch2 is routed only through the MPLS tunnel, and not through an IPsec tunnel over the Internet. What are the two causes of this issue? (Choose two.)
Select 2 answers.
← → navigate · a answer
Community votes
Discussion · 1
C, E 1
Selected Answer: CE
The correct answers are:
C. TLOC 11.0.1.1 is rejected by a policy in vSmart.
E. The control policy is applied at the inbound direction at vSmart.
Briefly why:
• TLOC 10.1.0.2 (color blue, IPsec) appears with status "Rej,R,Inv", which means it is being rejected by policy, not used for data plane—so Branch1 never uses the Internet/IPsec TLOC toward Branch2.
• The control policy on vSmart matches that TLOC in "tloc-list SITE20" and applies "action reject". It is applied inbound at vSmart for that site list. That makes the IPsec TLOC get filtered out at the control plane, so only the MPLS TLOC stays usable between Branch1 and Branch2.