A co-op wants every branch edge on Catalyst SD-WAN to reach a new Azure virtual network with one centralized policy. The underlay will be the public internet. Which model fits?
Select an answer to reveal the explanation.
Short Explanation
The branches are already one overlay, and you want one policy. You extend Catalyst SD-WAN over the internet into the virtual network. A native IPsec tunnel per branch has no controllers, and private addresses are not a public website the PCs can open on their own.
Full Explanation
Catalyst SD-WAN internet-based cloud connectivity keeps the branch edges in the overlay and applies one centralized policy toward Azure, with the public internet as the underlay. That is the model the co-op described. Standalone native IPsec from each branch to the Azure VPN gateway can pass packets and sits outside the controllers. An MPLS handoff is private connectivity and does not use the public internet they named. Direct internet access from PCs cannot reach private virtual-network addresses. Those addresses are not published on the internet. Exam caveat: the service VPN that holds the users has to be attached to the cloud gateway or the policy has an overlay with no prefix. Operational check: a branch should show an OMP route for the virtual network via the cloud TLOC, under the centralized policy the other branches use.