A community college district wants to migrate classic DMVPN spokes to SD-WAN Edges without a single cutover for every campus. Which migration approach best matches that goal?
Select an answer to reveal the explanation.
Short Explanation
Nobody upgrades every campus on the same Saturday unless they enjoy outages. Brownfield SD-WAN migrations move sites in waves so leftover DMVPN spokes keep working until their turn. Phased coexistence beats a district-wide flag day.
Full Explanation
Brownfield SD-WAN adoption for a community college district typically phases sites onto Edges while remaining DMVPN spokes continue to operate. Coexistence avoids a single flag-day failure domain, lets operators validate certificates, underlay colors, and templates per campus, and keeps instructional and administrative networks reachable until each site’s cutover window succeeds. That staged model matches how civic IT usually funds and staffs WAN modernization.
Removing all DMVPN hubs first so spokes fail closed until every Edge is online creates an unnecessary outage domain across campuses still waiting for hardware or change windows. Converting the entire district in one maintenance window with no dual-stack period maximizes blast radius and eliminates a proven rollback path. Disabling IPsec on DMVPN to run cleartext GRE during migration introduces confidentiality risk on Internet transports unrelated to reaching the SD-WAN target state.
Exam caveat: migration items often test coexistence and phased cutover—not “rip out the old WAN first” or “strip encryption to simplify.” Dual operation is expected until validation completes.
Operational check: pick a pilot campus, bring up Edge control connections beside DMVPN, migrate traffic with a documented backout, confirm application paths for registration and LMS systems, then expand wave by wave across the district while hubs still serve unmigrated spokes.