A financial customer deploys controllers on-premises across two data centers, requires survival of a full site loss, and needs deterministic WAN Edge behavior when controllers become unreachable. Which redundancy design correctly uses multiple Validators and Controllers and WAN Edge connectivity?
Select an answer to reveal the explanation.
Short Explanation
You're planning for the worst-case outage, which is exactly right. Spreading Validators and Controllers with dual-homing is like having banks on both sides of town. Edges stay orchestrated even if one site goes dark.
Full Explanation
The design must keep working when an entire data center is lost, so Validators and Controllers are deployed in both sites and each WAN Edge is configured with a controller list that reaches into both sites. Connecting every WAN Edge to all Controllers gives each edge a complete, uniform set of OMP peers, so after a site failure the survivors are already connected and the edge needs no re-discovery; the behavior is explicit configuration rather than something resolved at failure time. Limiting each edge to two controllers is a legitimate scaling technique, but here both are in the primary site, so a primary-site loss removes every control session at once and the survival requirement is missed. Relying on DNS-based discovery makes failover depend on name resolution, caching and TTLs, which is less deterministic than preconfigured controller connectivity. Centralizing management controllers in the primary site fails because the Manager and its role in configuration and monitoring would be lost with that site, and the stem asks for full site-loss survival. Note that at large scale Cisco allows capping the number of control connections per edge, provided the chosen controllers span both sites. In practice, test by isolating one data center and confirming show sdwan control connections on edges still lists the remaining Controllers and OMP stays up.