A retail chain links two campus blocks via dual Layer 3 core switches with equal fiber paths. Requirements demand subsecond failover if a core link drops, active use of both uplinks for throughput, and no STP dependency between blocks. Which multicampus Layer 3 convergence and load-sharing design best meets resilience goals?

Layer 3 peering between blocks with equal-cost multipath allows both fiber paths to forward simultaneously while the IGP maintains topology, and tuning hello and dead intervals combined with BFD provides millisecond link and neighbor failure detection that drives subsecond reconvergence without any Layer 2 loop control between sites. The ECMP design with default timers lacks fast detection because standard OSPF, IS-IS, or EIGRP hellos and dead timers converge in seconds, so although it load-shares and avoids extended bridging it cannot meet the subsecond loss target when a core link drops. The preferred-path design with tuned timers and BFD converges quickly and remains fully routed, but pinning traffic to a single best path leaves the second uplink idle except during failure, which wastes provisioned throughput and violates the active-active requirement. The centralized firewall cluster design can forward with ECMP and detect failures quickly with BFD, yet funneling interblock traffic through one logical transit reintroduces a fate-sharing chokepoint and underutilizes the dual-core mesh, weakening the stated resilience goal. On exams, distinguish control-plane speed from data-plane sharing, since a fast protocol alone does not imply load sharing and ECMP alone does not imply fast failure detection without BFD or aggressive timers. In practice, verify two equal-cost next hops in the routing table, confirm BFD sessions are Up on each interblock link, measure failover with continuous pings and traffic load during a fiber pull, and monitor CPU and flapping so aggressive timers do not destabilize the cores.