A bank will host a clearing application in a private AWS VPC and wants Catalyst SD-WAN branches to reach it over the internet, with the cloud side built from SD-WAN Manager. Which feature should they turn on?
Select an answer to reveal the explanation.
Short Explanation
Reaching your own VPC is not the same job as picking the fastest door to a public SaaS app. You want Cloud OnRamp for Multicloud, which builds the cloud side and stitches the overlay to that VPC. SaaS probes and a SIG exit solve a different path.
Full Explanation
Cloud OnRamp for Multicloud is the Catalyst SD-WAN workflow for IaaS. It builds the cloud gateway and the attachments so branch service VPNs reach a private VPC over the SD-WAN overlay, using the internet as underlay. The application here is a private workload in the bank's VPC, so that is the feature that matches. Cloud OnRamp for SaaS measures paths to public SaaS applications and steers those applications. It does not front a private VPC or replace the cloud gateway. A Secure Internet Gateway tunnel sends internet-bound traffic to a cloud security stack. It is an internet exit, not a path into a private VPC subnet. NAT in VPN 0 translates underlay or direct-internet flows. It does not advertise the VPC into the overlay or build the cloud gateway SD-WAN Manager is being asked to create. Exam caveat: the same bank can still use a SIG for general web traffic while Multicloud OnRamp handles the VPC. They are different policies. Operational check: in SD-WAN Manager, confirm the cloud gateway for that VPC is in service and that the branch VPN shows an OMP route for the VPC prefix via the cloud TLOC.