A retail bank is adding SD-WAN routers in parallel to existing branch routers at 80 sites. Tellers need sub-second failover between LAN gateways, and branch prefixes must fail over without redistribution loops. Which LAN-side design at SD-WAN sites meets these routing needs?
Select an answer to reveal the explanation.
Short Explanation
You're keeping tellers online when a box blinks. A shared virtual gateway plus clean route handoffs delivers that resilience without looping.
Full Explanation
The correct design succeeds because it covers both stated needs together: a shared virtual gateway for sub-second host failover and loop-safe exchange of branch prefixes between parallel domains. VRRP with aggressive timers lets SD-WAN and legacy routers present one gateway IP and move forwarding transparently when the master fails, so teller devices do not reconfigure or wait for ARP to age out. Tagged redistribution with filtering marks prefixes at the redistribution point and denies those tags on reimport, preventing feedback when the same prefix appears in both the legacy protocol and the overlay. VRRP with untagged redistribution keeps fast gateway failover but breaks loop prevention because mutual redistribution without markers lets each domain prefer the other advertisement and re-advertise it back during outages. HSRP with fast timers over isolated static routes keeps gateway redundancy but breaks dynamic prefix mobility because static entries cannot track WAN health, leaving hosts sent to a live gateway without a working outbound path. OSPF with BFD and tagged redistribution keeps rapid convergence and loop control but breaks first-hop redundancy because without a virtual address hosts stay tied to one physical router. A common exam trap is equating BFD convergence with gateway failover, although clients need the virtual IP to move. In practice force a VRRP mastership change while confirming tagged prefixes stay stable without duplication.