A retail branch runs a single Secure Firewall Threat Defense appliance with two static default routes, one per ISP handoff, because both providers supply static routes only. When one ISP fails, its router stays powered and the handoff interface stays up, so traffic blackholes until an operator intervenes. Which route-tracking design should move branch traffic onto the surviving ISP?
Select an answer to reveal the explanation.
Short Explanation
You can keep traffic moving by probing beyond the ISP router, so an outage is detected even while the handoff stays up. Tie an SLA probe to the primary default route; when the probe fails, that route is withdrawn and the higher-metric backup takes over.
Full Explanation
The SLA-probe design is correct because it tests reachability through the primary ISP and withdraws the primary default route when that path fails, even if the ISP router remains powered and the handoff interface stays up. The higher-metric static default through the other provider can then carry traffic. Probing only the ISP gateway may fail to detect an upstream outage: the gateway could still answer while traffic beyond it is blackholed, leaving the primary route installed. A floating static default tied to interface state detects loss of carrier, not an ISP failure that leaves the handoff up, so it would not respond to the failure described. A separate SD-WAN edge can probe both paths and steer traffic, but it adds another edge appliance rather than using route tracking on the branch’s single Secure Firewall Threat Defense appliance. Exam caveat: choose an SLA target beyond the next hop and suitable failure thresholds; a reachable gateway does not prove the provider path is healthy. Practical check: simulate an upstream ISP outage while keeping its router powered and the handoff up, then confirm the primary default is removed and traffic uses the backup.