https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.2/05Sec urity/01Security_Overview/Data_Plane_Security_Overview

 vEdge is the Cisco SD WAN component that provides a secure data plane with remote vEdge routers. vEdge routers are the devices that sit at the edge of the SD WAN fabric and connect to the WAN transports, such as MPLS, Internet, or LTE. vEdge routers establish secure IPsec tunnels with other vEdge routers in the fabric and exchange routing and policy information with the vSmart controller. vEdge routers also perform application-aware routing, QoS, and security functions on the data plane traffic. vEdge routers can be physical or virtual devices and can be deployed in branch, campus, data center, or cloud environments1.

The other options, vBond, vSmart, and vManage, are not the components that provide a secure data plane with remote vEdge routers. vBond is the orchestrator that performs the initial authentication and authorization of vEdge routers and assigns them to a vSmart controller. vSmart is the controller that distributes the control and data policies and the network topology information to the vEdge routers. vManage is the management platform that provides centralized configuration, monitoring, and troubleshooting of the SD WAN fabric1. References := : 1: Cisco SD-WAN Getting Started Guide - Cisco SD-WAN Overview [Cisco SD-WAN] - Cisco

https://www.arista.com/assets/data/pdf/Whitepapers/Arista_Networks_VXLAN_White_Paper.pdf

A VxLAN header adds 50 bytes to an original Ethernet frame. This is because a VxLAN header consists of the following components:

• 8-byte outer UDP header for VxLAN: The default VxLAN destination UDP port number is 47891
• 20-byte outer IP header: Valid addresses of VTEPs or VxLAN multicast groups on the transport network. Devices in the transport network forward VxLAN packets based on the outer IP header1
• 8-byte VxLAN header: VxLAN information for the frame. It includes a 24-bit VxLAN Network Identifier (VNI) that identifies the VxLAN of the frame, and an 8-bit flags field that indicates the validity of the VNI1
• 14-byte inner Ethernet header: The original Ethernet header of the encapsulated frame. It includes the source and destination MAC addresses, the EtherType, and optionally a 4-byte VLAN tag2

The total size of these components is 8 + 20 + 8 + 14 = 50 bytes. Therefore, a VxLAN header adds 50 bytes to an original Ethernet frame.

References :=

• VXLAN packet format - Aruba
• MTU Considerations for VXLAN | Matt Oswalt

The maximum number of concurrent endpoints with a distributed deployment depends on the type of deployment and the hardware used. According to the Cisco documentation1, there are two types of distributed deployments: hybrid and dedicated.

• A hybrid deployment is where the Policy Administration Node (PAN) and the Monitoring Node (MnT) personas are co-located on the same node, and the Policy Service Node (PSN) persona is distributed across multiple nodes. A hybrid deployment can support up to 20,000 concurrent endpoints with a maximum of 5 PSNs on SNS-36xx or SNS-35xx hardware.
• A dedicated deployment is where the PAN, MnT, and PSN personas are separated on different nodes. A dedicated deployment can support up to 500,000 concurrent endpoints with a maximum of 50 PSNs on SNS-36xx or SNS-35xx hardware.

The main difference between the hybrid and dedicated deployments is the scalability and redundancy of the MnT persona, which collects and stores the logs and sessions from the PSNs. By breaking the PAN and MnT roles out on to their own servers, the dedicated deployment can handle more concurrent endpoints and PSNs, as well as provide failover and load balancing for the MnT persona2

References :=

• Performance and Scalability Guide for Cisco Identity Services Engine
• Solved: ISE concurrent connections query - Cisco Community

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Design-Guide-2019SEP.pdf

References :=

Some possible references are:

• Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers (ENSDENG) Study Guide
• Cisco Identity Services Engine Administrator Guide, Release 2.7 - Configure Network Access Devices [Cisco Identity Services Engine]

Device Sensor is a feature that enables Cisco devices to collect and report information about the endpoints connected to them. This information can be used by ISE to identify and classify the endpoints, and apply appropriate policies based on their attributes. Device Sensor can collect information from various sources, such as DHCP, CDP, LLDP, and HTTP User-Agent. Among the options given, only DHCP and CDP are valid sources of information for Device Sensor. References := : Cisco Identity Services Engine Administrator Guide, Release 2.7 - Device Sensor [Cisco Identity Services Engine]- Cisco (https://learningnetworkstore.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_010100.html)

2of30

 ISE automation BYOD flow is a process that allows users to self-enroll their devices to the network without requiring IT intervention. The process consists of three main functions: certificate enrollment, device registration, and supplicant provisioning.

• Certificate enrollment is the function that allows users to obtain a digital certificate from a certificate authority (CA) for their devices. This certificate is used to authenticate the device to the network and provide secure communication. ISE supports different CA options, such as Microsoft CA, Cisco ISE CA, or third-party CA .
• Device registration is the function that allows users to register their devices to the network and associate them with their identity. This enables ISE to apply policies based on the device type, ownership, and posture. ISE supports different device registration methods, such as portal-based, API-based, or bulk import .
• Supplicant provisioning is the function that allows users to install and configure a network access client (supplicant) on their devices. This client is used to connect to the network using the appropriate protocols and settings. ISE supports different supplicant provisioning methods, such as native supplicant, Cisco Network Setup Assistant (NSA), or Cisco AnyConnect Secure Mobility Client (AnyConnect) .

References:

[Cisco Identity Services Engine Administrator Guide, Release 2.7 - BYOD [Cisco Identity Services Engine]] : [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Certificate Provisioning [Cisco Identity Services Engine]] : [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Device Registration [Cisco Identity Services Engine]] : [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Supplicant Provisioning [Cisco Identity Services Engine]]

A Digital Network is a network that is based on the Cisco Digital Network Architecture (Cisco DNA), which is an open and extensible, software-driven network architecture designed to rapidly deliver services that enable IT to innovate faster, reduce costs and complexity, lower risk, and comply with regulatory requirements1. A key function of a Digital Network is centralized provisioning, which allows IT to automate the deployment and configuration of network devices and services using a single platform, such as the Cisco DNA Center2. Centralized provisioning simplifies network management, reduces human errors, and accelerates network changes.

References:

 2: [Cisco DNA Software - Digital Network Architecture - Cisco] : 1: [Cisco Digital Network Architecture]