A branch runs an FTD in routed mode with two ISP uplinks on separate outside interfaces, and the team wants outbound flows spread across both paths using static routes configured in the FMC. The inside interface must keep relaying DHCP for the user VLAN. Which ECMP setup meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
To spread outbound traffic across both ISPs, put both outside interfaces in one ECMP zone and add equal-cost default routes through their gateways. Keep your inside interface out of that zone so DHCP relay keeps working—like two checkout lanes sharing customers only when they’re part of the same store.
Full Explanation
Equal-cost multi-path on Threat Defense is implemented with ECMP traffic zones: interfaces are grouped into a zone that belongs to a virtual router, and only then can the device hold several routes to the same destination with the same metric and spread flows across the next hops. Both ISP interfaces therefore sit in one zone, and because your inside interface relays DHCP it must stay outside every ECMP zone, since DHCP relay is not supported on zone members. Putting the inside interface in the zone fails the DHCP requirement outright. Making a separate zone per outside interface with a different metric fails the load-sharing requirement, because without equal-cost paths in a single zone there is nothing to spread, and the higher metric simply makes one default route a backup. Relying on the shared security zone fails the routing requirement, since security zones group interfaces for policy while ECMP zones group them for routing, and the device will not accept equal-cost static routes unless those interfaces belong to an ECMP zone. Exam caveat: a static route may remain installed if its next hop becomes unreachable while its interface stays up. Practical check: after deployment, show the routing table and confirm both equal-cost default entries, then send traffic and confirm both gateways see flows.