A city government sends branch internet traffic through Catalyst SD-WAN tunnels to a secure internet gateway. The underlay is the public internet. There is no virtual private gateway in the path. Which model is this?
Select an answer to reveal the explanation.
Short Explanation
The branches are on the SD-WAN overlay, and the internet is only the road underneath. You are looking at Catalyst SD-WAN connectivity to a secure internet gateway. A virtual private gateway is not in the path, so this is not native IPsec to AWS, and nobody ordered a cross-connect.
Full Explanation
Catalyst SD-WAN can build its internet-based cloud path to a secure internet gateway instead of to a provider VPN endpoint. The branches stay in the overlay, policy steers the internet traffic, and the underlay is the public internet. That is the SD-WAN internet model aimed at the SIG. Native IPsec to an AWS virtual private gateway would terminate on that gateway and would not use the SD-WAN controllers or the SIG. The stem says there is no virtual private gateway. A colocation cross-connect is a physical cable in a shared facility. A SIG reached over the public internet is not that cable. An MPLS handoff into a private interconnect keeps traffic off the public internet. This underlay is the public internet, so the private-provider model does not fit. Exam caveat: the same government can still have a separate SD-WAN path into a VPC. That path is a different attachment from the SIG tunnels that carry internet-bound traffic. Operational check: the branch should show SIG tunnels over the internet color, and the traffic path for a web session should be the SIG rather than a virtual private gateway endpoint.