Two WAN Edges serve a hospital access LAN from the same service VPN and subnet. Nurses require one stable gateway IP during a router reload, with fast failover and consistent service-VPN routing. Which VRRP template design provides LAN redundancy for this service-side requirement?
Select an answer to reveal the explanation.
Short Explanation
You need one gateway that survives a router outage, and you'll get it with a shared virtual IP. Configure matching VRRP group settings on the service-side interfaces so hosts keep one gateway.
Full Explanation
The correct design places VRRP with an identical group ID and virtual IP under the service-side VPN Interface Ethernet configuration on both WAN Edges, so the hospital LAN keeps a single persistent gateway that survives a reload while both devices share the same service VPN, subnet, and routing policy. The VRRP advertisement timer is configurable (in milliseconds) and priorities control which router is primary, but Cisco recommends timers of about one second or more on IOS XE Catalyst SD-WAN devices because very short timers can cause VRRP instability under heavy LAN load. The Transport VPN variant protects WAN uplinks rather than the user LAN, leaving the service-side gateway as a single point of failure. The separate-virtual-IP variant gives each router a different gateway address, so hosts lack one stable IP and clients would need to change gateways after a failure. The different-group variant fails because routers in different VRRP groups never exchange advertisements or elect a primary, so each would act as primary for the same virtual IP and cause address conflicts. As an exam caveat, distinguish template attachment carefully because only the service-side interface delivers LAN gateway redundancy. Practical check: verify the identical virtual IP and group on both peers, confirm primary-backup state and priority, then sustain a ping to the virtual IP during a reload test.