A manufacturing branch has one MPLS and one Internet circuit, four user VLANs, plus a need for out-of-band management if the overlay fails. The engineer drafts templates with VPN 0, VPN 10 and VPN 512. Which VPN assignment correctly maps transport, service, and management roles for end-to-end segmentation?
Select an answer to reveal the explanation.
Short Explanation
You've got three lanes with strict jobs, so keep them sorted. VPN 0 is always your highway for overlay tunnels and transport.
Full Explanation
VPN 0 is the tunnel VPN that sources all control and IPsec data connections over WAN transports, service VPNs such as VPN 1 to 511 and VPN 513 and above carry user traffic and VRF segmentation end to end, and VPN 512 is the dedicated out-of-band management VPN for the mgmt interface, remaining reachable even when the overlay is down. Assigning WAN interfaces to VPN 512 breaks transport because VPN 512 never forms DTLS/TLS or IPsec tunnels, and placing user VLANs in VPN 0 merges them into the transport table and destroys segmentation, while assigning WAN to VPN 10 or user VLANs to VPN 512 similarly misplaces tunnel versus service versus management roles. The variant using VPN 1 for WAN also fails because no service VPN can originate control connections, and VPN 10 cannot be management. Exam caveat: VPN 512 uses a separate routing table and typically a default gateway outside SD-WAN policy, so do not apply centralized data policy to it expecting segmentation. Practical check: verify with show ip route vpn 0, show ip route vpn 10, and ping via VPN 512 to confirm each table forwards correctly.