500-470 Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers Questions and Answers

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-2/user_guide/b_dnac_ug_1_2/b_dnac_ug_1_2_chapter_010010.pdf

The workflow that is necessary for setting up a network hierarchy is Design. The Design area is where you create the structure and framework of your network, including the physical topology, network settings, and device type profiles that you can apply to devices throughout your network. You can create a network hierarchy that represents your network’s geographical locations, such as sites, buildings, and floors. You can also define global network settings, such as device credentials, IP address pools, service provider profiles, and network servers. You can also create network profiles, which are collections of design settings that you can assign to devices based on their roles and functions1.

References:

 1: [Cisco DNA Center User Guide, Release 2.2.3 - Design Network Hierarchy and Settings [Cisco DNA Center] - Cisco]

The Cisco V-Edge Router performs QoS traffic classification on the ingress interface, before the traffic enters the VPN. The classification is based on the match criteria specified in the access lists, which can include the source and destination IP addresses, ports, protocols, DSCP values, and application-aware NBAR attributes. The classification results in assigning a forwarding class and a QoS group to each packet. The forwarding class determines the output queue and the scheduling policy for the packet on the egress interface. The QoS group is an internal label that can be used to remark the DSCP value of the packet or to match the packet in another access list for further processing. References:

• : Forwarding and QoS Configuration Guide for vEdge Routers, Cisco SD-WAN Release 20, Chapter 2: Configuring Localized Data Policy, https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/qos/vEdge-20-x/qos-book/localized-data-policy.html#id_1050591
• : Cisco SD-WAN Design Guide, Release 20, Chapter 6: Quality of Service, https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/2020/b_SD-WAN_Design_Guide_Aug_2020/b_SD-WAN_Design_Guide_Aug_2020_chapter_0110.html2

According to the Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers document1, the three Cisco recommendations on “How to Win” are:

• Explain support for 3rd party network devices: Cisco ISE can integrate with more than 60 third-party solutions that span across security and network portfolios. This enablesCisco ISE to leverage the information and capabilities of these solutions to enhance the identity and access management, network visibility and segmentation, threat detection and response, and policy enforcement of the network. By explaining this support, the customer can see the value and flexibility of Cisco ISE in their existing or heterogeneous network environment2.
• Explain architectural advantage of holistic Cisco solution: Cisco ISE is part of the Cisco Digital Network Architecture (DNA), which is a comprehensive and open platform that provides end-to-end network automation, assurance, security, and analytics. By explaining the architectural advantage of the holistic Cisco solution, the customer can see how Cisco ISE works seamlessly with other Cisco DNA components, such as Cisco DNA Center, Cisco SD-Access, Cisco SD-WAN, Cisco TrustSec, and Cisco Stealthwatch, to deliver a unified and consistent network experience across wired, wireless, and cloud domains3.
• Talk about Cisco’s focus on Security and integration with StealthWatch, Sourcefire, WSA, vulnerability scanner to make smarter policy decisions: Cisco ISE is a core component of the Cisco security portfolio, which provides comprehensive and integrated security solutions for the network. By talking about Cisco’s focus on security and integration with other security products, such as StealthWatch, Sourcefire, WSA, and vulnerability scanner, the customer can see how Cisco ISE can provide enhanced visibility, threat detection, and policy enforcement for the network. For example, Cisco ISE can use the data from StealthWatch to identify anomalous or malicious behavior of the endpoints and apply appropriate network access policies based on the threat level4.

The other options, show case Cisco portfolio or ISE feature set during PoC and demonstrate complex policy flows, rather show case Wizards and enhanced context visibility, are not Cisco recommendations on “How to Win”. Showing case Cisco portfolio or ISE feature set during PoC is a general best practice, but not a specific recommendation for winning the customer. Demonstrating complex policy flows, rather than showing case Wizards and enhanced context visibility, is a counterproductive approach, as it can confuse or overwhelm the customer with technical details, rather than highlighting the benefits and simplicity of Cisco ISE. References := : 2: Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Security Ecosystem Integration Guides [Cisco Identity Services Engine] - Cisco2, 1: Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers1, 3: Cisco Identity Services Engine - Cisco3, 4: Cisco Identity Services Engine Administrator Guide, Release 2.7 - Stealthwatch Integration [Cisco Identity Services Engine] - Cisco4

https://www.cisco.com/en/US/technologies/tk648/tk365/tk207/technologies_white_paper0900 aecd80243fe7.html

 The default interval for BFD packets is 1 second. BFD uses Hello packets to detect the liveness and faults on a connection. BFD Hello Interval packet is sent at the default interval of 1000 milliseconds on all connections1. This command can be used to change the hello interval for a transport color. The interval for transmitting and receiving BFD packets can also be configured on the interface level or the BFD session level, depending on the device and the protocol234. The BFD detection time is calculated as the product of the local detection multiplier and the agreed remote transmission interval. The lower the BFD detection time, the faster the BFD session can detect a fault. However, a lower BFD detection time also consumes more system resources and bandwidth. Therefore, the BFD detection time should be configured according to the network situation and performance requirements. References:

• : Bidirectional Forwarding Detection - Cisco
• : Configuring the BFD Detection Time - CloudEngine 16800 … - Huawei
• : Cisco IOS XE Catalyst SD-WAN Qualified Command Reference
• : bfd min-echo-receive-interval - Aruba

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/software-defined-access/guide-c07-739242.pdf

A centralized SD-Access design is where a single fabric domain spans across the main site and all branch sites over the WAN. This design has some challenges, such as:

• Since the traffic is encapsulated in VXLAN headers, SD-WAN features such as application-aware routing, QoS, and security policies cannot be applied to the traffic based on the original IP headers. This means that the SD-WAN controller cannot optimize or route the traffic based on the application or user identity. The traffic is treated as a single class of service across the WAN.
• The centralized design also introduces a single point of failure and a potential bottleneck at the main site, where the border nodes and the control plane nodes are located. If the main site goes down or the WAN link fails, the branch sites will lose connectivity to the fabric domain and the external networks.
• The centralized design also requires a high bandwidth and low latency WAN connection between the main site and the branch sites, which may not be feasible or cost-effective for some scenarios.

References :=

Some possible references are:

• Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers (ENSDENG) Study Guide
• Cisco SD-Access and SD-WAN Integration Design Guide

Syslog, FNF (Flexible NetFlow), and SNMP (Simple Network Management Protocol) are three technologies that can be deployed to gather data and provide insight into the network performance, health, and behavior. Syslog is a standard protocol for logging messages from network devices, such as routers, switches, firewalls, and servers. Syslog messages can be sent to a centralized server for analysis, correlation, and alerting. FNF is a Cisco technology that captures and exports information about network flows, such as source and destination IP addresses, ports, protocols, bytes, packets, and timestamps. FNF can be used to monitor network traffic patterns, identify anomalies, and optimize network resources. SNMP is a protocol that allows network devices to communicate with management systems, such as Cisco DNA Center. SNMP can be used to collect statistics, configuration, and status information from network devices, as well as to send commands and notifications. SNMP can help network administrators to troubleshoot, configure, and manage their network devices remotely. References: Cisco DNA Center User Guide, Release 1.3.1.0 - Monitor the Network 1, Cisco DNA Center User Guide, Release 1.3.1.0 - Configure Flexible NetFlow 2, Cisco DNA Center User Guide, Release 1.3.1.0 - Configure SNMP 3