A new Catalyst SD-WAN edge should reach an Azure cloud gateway over the internet. The physical internet interface was placed in service VPN 10. BFD to the gateway never forms. Where does that interface belong?
Select an answer to reveal the explanation.
Short Explanation
You want the internet underlay to reach the cloud gateway, so place that interface in VPN 0, the transport VPN. VPN 10 carries service-side routes, VPN 512 is for out-of-band management, and Cloud OnRamp does not use an unbound physical interface.
Full Explanation
Catalyst SD-WAN transport interfaces, including the internet link that must reach a public Azure cloud-gateway address, belong in VPN 0. BFD to the gateway is built from the transport VPN, so an interface left in service VPN 10 is treated as a service-side port and does not form the underlay BFD session. VPN 512 is the out-of-band management VPN, not the data-plane transport to Azure. The gateway address is a transport destination, not a service-side prefix; placing the interface in VPN 10 confuses the underlay with the overlay. Cloud OnRamp does not borrow a physical interface with no VPN binding: the interface still needs to belong to VPN 0. Exam caveat: user traffic stays in the service VPN; only the transport interface belongs in VPN 0. Moving the users’ LAN into VPN 0 would leak service traffic onto the underlay. Practical check: confirm the interface is in VPN 0, a route to the gateway’s public address exists in VPN 0, and show sdwan bfd sessions lists the cloud gateway.