What are common causes of SD-WAN tunnel failure?

• A. Lack of color-coded cables.
• B. Using too many proxies.
• C. Misconfigurations, certificate/authentication errors, underlay outages, MTU mismatches, NAT issues, firewall rules, or policy conflicts.
• D. High CPU in endpoints.

Answer: (C)

SD-WAN tunnel failure happens when the overlay can’t be created or kept healthy because something in the control or data plane, or the underlay, isn’t aligning correctly. The strongest set of causes covers misconfigurations, certificate or authentication problems, underlay outages, MTU mismatches, NAT issues, firewall rules, and policy conflicts. Each of these hinders the tunnel in a fundamental way: misconfigurations mean the peers, keys, or encryption domains don’t match; certificate or auth errors stop the devices from authenticating each other; underlay outages cut the transport path; MTU mismatches cause encapsulated packets to be dropped or fragmented; NAT issues can break address translation needed for the tunnel; firewall rules can block the required control and data plane traffic; and policy conflicts can cause incorrect routing or tunnel handling.

Other options aren’t typical root causes: color-coded cables aren’t a factor in SD-WAN; using too many proxies doesn’t directly prevent tunnel establishment; high CPU can affect performance or stability but isn’t as common a root cause as the items above.