Question

A network engineer is deploying Cisco Catalyst SD-WAN Secure Internet Gateway (SIG) tunnels to Zscaler for branch internet breakout. The requirement is that user traffic destined to the internet must be steered into the SIG tunnel, while traffic to internal corporate subnets (10.0.0.0/8) must continue to be routed across the SD-WAN overlay to the data center. Which action correctly implements this behavior?

Accepted Answer

Configure a centralized data policy with a sequence matching the internal 10.0.0.0/8 prefixes and setting the action to the overlay next hop, placed before a catch-all sequence that sets the action to the SIG service

Answer

Configure the SIG tunnel as the default route on the branch WAN edge so all traffic, including corporate subnets, is forwarded to Zscaler for inspection

Answer

Configure a localized control policy that redistributes the SIG service into OSPF so internal subnets prefer the tunnel

Answer

Configure an application-aware routing policy referencing an SLA class so that internal subnet traffic is measured for loss and latency before being sent to SIG