Question

A network engineer is deploying Cisco Catalyst SD-WAN Secure Internet Gateway (SIG) tunnels from branch WAN Edge routers to a cloud security provider. Management requires that traffic automatically fails over to a backup SIG tunnel only when the security service itself is unreachable, not merely when the underlying transport link is up. The engineer must configure a tracker to validate reachability. Which tracker configuration approach meets this requirement?

Accepted Answer

Configure a SIG endpoint tracker that sends HTTP/HTTPS probes to a service URL through the tunnel and marks the tunnel down on probe failure

Answer

Configure an SLA class list with loss and latency thresholds applied to the transport TLOC

Answer

Configure a static IP SLA ICMP tracker pointing to the router's own tunnel source interface

Answer

Configure a BGP peering session over the SIG tunnel and rely on BGP hold-timer expiry for failover