A retail chain is deploying SD-WAN at 80 stores, each with two edge routers connecting to a single LAN switch stack for POS and staff VLANs. The stores need sub-second gateway failover without routing flaps, plus loop-free handoff toward the overlay. Which LAN-side design using VRRP and routing best fits these store requirements?

The correct design pairs VRRP on the LAN with OMP origination because VRRP presents one virtual gateway to the switch stack for POS and staff VLANs while only the master forwards, and OMP advertises that subnet once into the SD-WAN overlay with loop avoidance and centralized policy, allowing tuned fast timers plus uplink tracking to achieve sub-second switchover without dual withdrawals and routing flaps. The design retaining default VRRP timers with correct OMP handling is common and stable but fails the speed requirement because the standard one-second advertisement plus skew timer yields multi-second master detection, so transactions stall during outage. The design substituting OSPF redistribution for OMP is standard in legacy branches but fails the loop-free overlay handoff because redistributing at two egress points without overlay origin control invites feedback, duplicate paths, and flaps on VRRP transition. The active-active design with both peers advertising the LAN prefix offers load sharing but breaks single-owner semantics, so the overlay sees competing origins causing asymmetric return and transient loops instead of a clean master-driven move. Exam caveat is to separate first-hop liveness from overlay reachability and require conditional advertisement tied to VRRP mastership, not FHRP alone. Practical check is to verify priority, preempt and track status, confirm only the master originates the OMP route, then fail over and measure gateway convergence and overlay stability.