A branch office gets a primary broadband circuit plus a backup LTE link, but the ISP offers no BGP session and hands over a single routed interface. Engineers need Secure Firewall Threat Defense to drop the primary default route on its own as soon as the ISP next hop stops answering, without an operator. Which high availability design should they use for static route tracking at this site?
Select an answer to reveal the explanation.
Short Explanation
You need the route to vanish on its own, so anything that only watches the local interface leaves you blind when the ISP fails upstream. An SLA monitor probes the next hop and withdraws the route when the configured failure threshold is reached, allowing the backup route to take over. It works like a smoke alarm that calls the fire department instead of one that only beeps at the wall.
Full Explanation
The correct design uses an SLA monitor to test the primary ISP next hop and ties the result to the primary static default route. If that next hop stops answering, the tracked route is withdrawn automatically, allowing the lower-priority LTE route to carry traffic without BGP or operator action. Tracking only the primary interface’s line-protocol state is a common, simple failover technique, but it detects a physical or link-layer outage rather than an unresponsive ISP next hop; the interface can remain up while forwarding has failed. Probing a stable public DNS host is also a common way to monitor end-to-end connectivity and can withdraw the route automatically, but it tests a remote destination, not the specifically stated ISP next hop. Its result can depend on routing beyond the ISP handoff or on that host’s availability. Tracking the LTE gateway and associating the result with a floating LTE route is useful for confirming that the backup path is usable, but it does not withdraw the preferred primary default route when the primary next hop fails. An exam caveat is that route preference and tracking behavior depend on the exact FTD release and configuration method, so confirm that the tracked route is actually removed from the routing table. In practice, test by making the primary next hop unreachable while keeping the WAN interface up, then verify route withdrawal and traffic recovery over LTE.