Internet customers reach a web application through a cloud load balancer. Return traffic is being forced back through the campus firewall, and the customers' sessions fail. Campus VPN users are a separate path. What should the return path do?
Select an answer to reveal the explanation.
Short Explanation
The customer knocked on the cloud door, and you sent the answer out a different building. You keep the return path at the cloud edge with the inbound publish. Forcing the response through the campus firewall breaks the session, and those customers are not on the site-to-site VPN.
Full Explanation
Inbound internet connectivity is published at the cloud edge. The response has to leave by that same edge so the client sees a consistent path. A route that backhauls the response through the campus firewall sends it somewhere the client's session is not waiting, and the session fails. Removing that forced default, and letting the load balancer own the return, restores the publish. Keeping the backhaul would preserve the failure the stem describes. Internet customers are not authenticating to the site-to-site VPN. That tunnel is the campus path and should stay separate. An east-west security group in another VPC is not on the path from the load balancer back to an internet client unless someone routed it there, which is another way to break the return. Exam caveat: campus users can still use the VPN. Do not delete the VPN route for the campus prefixes when you remove the default that was hijacking internet responses. Operational check: a flow from an internet client should show both directions at the cloud load balancer, and the campus firewall should not see that client's session.