Question

A retail company deploys Cisco Catalyst SD-WAN with a Secure Internet Gateway (SIG) integration to Cisco Umbrella. The security team requires that all branch user traffic destined to the internet be forwarded to the SIG for DNS-layer and web content inspection, while traffic to the company's on-premises data center (10.0.0.0/8) must continue to use the SD-WAN overlay and never be sent to the SIG. Which configuration approach correctly enforces this requirement on the branch WAN Edge routers?

Accepted Answer

Configure a centralized data policy that matches internet-bound traffic and applies the action 'secure-internet-gateway', while allowing overlay-destined prefixes to fall through to normal routing

Answer

Configure a static default route pointing to the SIG tunnel interface and redistribute the 10.0.0.0/8 overlay prefix into the SIG service

Answer

Apply an application-aware routing (AAR) policy that assigns internet traffic to an SLA class referencing the SIG tunnel color

Answer

Configure a localized control policy on the branch that advertises a default route toward Umbrella and filters the data center prefix from OMP