A branch office's routed-mode Secure Firewall Threat Defense has two WAN interfaces, each connected to a different ISP, and the engineer wants one default route per interface with the same metric so traffic spreads across both paths. The inside user network sits on a VLAN interface that must stay untouched. Which ECMP configuration makes the two default routes load-balance?
Select an answer to reveal the explanation.
Short Explanation
Put both WAN interfaces in one ECMP zone in the same virtual router, then add a default route through each with the same metric and a different gateway. It’s like giving traffic two lanes that merge onto the same road, while leaving your inside VLAN interface untouched.
Full Explanation
The correct configuration groups both WAN interfaces in one ECMP zone and installs a default route through each ISP gateway with the same metric. The shared zone identifies the interfaces whose routes can participate in ECMP, while equal metrics allow the firewall to use both eligible paths for load balancing. The inside VLAN is not added to the zone, so it remains untouched. Equal-metric routes with distinct gateways but no ECMP zone do not meet the zone-membership requirement; without the shared ECMP configuration, the firewall will not treat the paths as the requested ECMP pair. A single zone containing both WAN interfaces is not enough if one default route has a lower metric: the routes are no longer equal-cost, so the intended equal-cost distribution is not achieved. Separate zones, each containing just one WAN interface, also fail: neither zone contains both paths, so the routes cannot form one ECMP set, even if their metrics match. Exam caveat: equal metrics alone do not guarantee load balancing; the relevant interfaces must also belong to the same ECMP zone, and route eligibility and platform behavior still apply. Practical check: inspect the deployed ECMP zone membership and routing table to confirm both default routes are installed with equal metrics and distinct ISP next hops, then verify traffic counters or path tests on both WAN links.