A retail chain connects its next-generation firewall to two ISPs of equal bandwidth and wants outbound sessions to share both links during normal operation. The design must use equal-cost next hops only, keep every TCP session on a single path, and avoid policy-based routing. Which ECMP routing design on Threat Defense satisfies these constraints?
Select an answer to reveal the explanation.
Short Explanation
Equal-cost multipath only spreads traffic across next hops the routing table scores the same, and a stateful firewall then pins each of your connections to one of them. Unequal-cost weighting and per-packet spreading each break one of those two rules. It's like sending each shopper to a single checkout lane instead of moving a basket between lanes mid-scan.
Full Explanation
Equal cost multipath routing on Threat Defense starts with the routing table: only next hops with an identical metric are eligible, so OSPF paths or static routes sitting at the same distance form the candidate set. The stateful engine then pins each new connection to one of those candidates, which keeps packet ordering and session tracking sane while both ISP links still share the outbound load. Unequal cost weighting fails the stated constraint because Threat Defense installs equal-cost candidates only, so a next hop with a worse metric does not join the spread. Per packet spreading fails the single path rule, because reordering and asymmetric return paths can disrupt TCP streams that a stateful box is tracking. A tracked primary and backup route fails the steady state requirement, since only one next hop is active until the tracking object changes state. Exam caveat: equal cost paths must also point at reachable next hops, and route tracking is not the same feature as ECMP. Practical check: run show route to confirm two equal cost entries, then watch both egress interfaces carry sessions under load.