Question

A network engineer configures a Cisco Catalyst SD-WAN branch router with dual Secure Internet Gateway (SIG) tunnels to a cloud-delivered security service. The primary tunnel occasionally stays up at the IPsec layer even when the SIG service itself is degraded and dropping user traffic. The engineer needs the router to detect application-layer service degradation (not just tunnel liveness) and fail traffic over to the backup SIG tunnel. Which tracker configuration approach meets this requirement?

Accepted Answer

Configure an HTTP-based SIG tracker that probes a Layer 7 service URL (e.g., the provider's health endpoint) and bind it to the SIG tunnel interface

Answer

Configure an IP SLA ICMP-echo tracker to the tunnel's remote endpoint public IP and attach it to the SIG interface

Answer

Rely on IKEv2 Dead Peer Detection (DPD) timers to trigger failover between the two SIG tunnels

Answer

Configure a static default route with a floating higher administrative distance pointing to the backup tunnel and no tracker