A logistics company is extending its SD-WAN fabric to AWS and Azure with VPCs and VNets in three regions. It needs scalable private connectivity from branches without per-branch IPsec sprawl and with centralized routing control. Which Cloud OnRamp for IaaS design should the engineer describe to provide transit cloud access?
Select an answer to reveal the explanation.
Short Explanation
You need a shared transit point in each cloud region, not a separate road from every branch. Cloud gateways establish the overlay and share transit routes centrally, giving you scalable private access.
Full Explanation
Cloud OnRamp for IaaS, now part of Cloud OnRamp for Multicloud, instantiates virtual Catalyst 8000V gateways in a transit VPC or VNet in each region, with host VPCs or VNets mapped to them. The gateways join the SD-WAN overlay through IPsec, exchange OMP routes with the SD-WAN Controller (formerly vSmart), and provide transit between branches and cloud workloads without meshing every branch to the cloud. Validator nodes in VPCs or VNets do not provide this data-plane transit or cloud routing: the SD-WAN Validator (formerly vBond) handles orchestration and NAT traversal. Direct internet breakout at every branch sends traffic over the internet, not through private transit, and does not provide centralized policy or consistent routing for multi-region VPC access. SD-WAN Manager nodes perform management and monitoring, not data-plane forwarding into workloads. Exam caveat: distinguish IaaS gateways, which are virtual routers with overlay membership, from SaaS gateways used for application probing. Practical check: verify gateway tunnel status, OMP routes, and VPC or VNet route-table propagation in SD-WAN Manager.