A network administrator is configuring Cisco Catalyst SD-WAN secure internet gateway (SIG) connectivity to a cloud-delivered security service from a branch WAN edge router. The design requires two SIG tunnels: a primary and a backup. The administrator must ensure that if the primary tunnel loses reachability to the security service, traffic automatically fails over to the backup tunnel, and that the failure is detected based on actual application-layer reachability to the SIG provider rather than just tunnel line state. Which configuration element must be applied to achieve this behavior?