Question

A network engineer is deploying Cisco Catalyst SD-WAN integration with a Secure Internet Gateway (SIG) at a branch that has two independent DIA transport interfaces. The security team mandates that all internet-bound traffic be inspected by the SIG. Business requirements state that during normal operation, branch internet traffic should be load-balanced across both SIG tunnels to maximize throughput, but if one tunnel fails, all traffic must continue through the surviving tunnel. Which SIG tunnel configuration in the SIG feature template meets these requirements?

Accepted Answer

Configure both SIG tunnels in active/active mode with equal weights so traffic is distributed across both, with automatic failover to the remaining tunnel

Answer

Configure both SIG tunnels as high-availability pairs in active/backup mode so the backup tunnel only carries traffic after a failover event

Answer

Configure a single SIG tunnel bound to a loopback that is reachable over both transports via ECMP so the underlay handles balancing

Answer

Configure both tunnels as active/backup and apply a data policy that manually splits application traffic between the primary and backup tunnels