Question

A network engineer is configuring a Cisco Catalyst SD-WAN branch router to connect to a Zscaler Secure Internet Gateway (SIG). The requirement is that all internet-bound traffic must be forwarded to Zscaler for inspection, using two GRE or IPsec tunnels terminated on two different Zscaler data center nodes. Under normal conditions only the primary tunnel should carry traffic, and the secondary tunnel must take over automatically only if the primary fails. Which SIG tunnel design meets these requirements?

Accepted Answer

Configure the primary tunnel as active and the secondary tunnel as backup within a single SIG tunnel-set (high-availability pair)

Answer

Configure both tunnels as active with equal weights so traffic is load-balanced across both Zscaler nodes

Answer

Configure the primary tunnel as active and the secondary tunnel as active with a higher weight value to prefer the primary

Answer

Configure two independent SIG feature templates with no tracker so BGP reconvergence handles the failover