Question

A network engineer is configuring a Cisco Catalyst SD-WAN branch WAN edge to connect to a Secure Internet Gateway (SIG) for cloud-delivered security. The branch has two internet transport interfaces, and the requirement is to distribute internet-bound user traffic across two active SIG tunnels going to two data centers of the same cloud security provider, sending roughly twice as much traffic through the primary tunnel as the secondary. Which SIG tunnel configuration approach meets this requirement?

Accepted Answer

Create two SIG tunnels in an active/active high-availability pair and assign tunnel weights (e.g., 2 and 1) within the SIG feature template so traffic is load-shared proportionally

Answer

Create two SIG tunnels in an active/backup high-availability pair so the backup only forwards when the active tunnel fails

Answer

Configure a single SIG tunnel and rely on ECMP across the two internet transports to split traffic to the provider

Answer

Create two independent centralized data policies, each matching half of the source subnets, and steer them to separate SIG tunnels