A clinic runs routed-mode Secure Firewall Threat Defense (FTD) with two ISP uplinks. The primary uplink keeps its static default route even when the ISP's first hop stops answering, so traffic blackholes until an operator shuts the interface. The backup static route must stay ready but unused while the primary path is healthy. Which static route tracking design with an SLA monitor should the engineer configure for link failover?
Select an answer to reveal the explanation.
Short Explanation
Static routes are blind by default, so your FTD keeps aiming at a next hop that may already be silent. The route tracking field ties the route's life to an SLA probe, like a smoke alarm that tests for trouble. Raising the backup metric alone never tests the path, so you'd still be waiting for someone to notice the break.
Full Explanation
A static route with no health check can stay in the FTD routing table while its interface is up, even when the ISP first hop has stopped answering. Attaching an SLA monitor through the route tracking field gives that route a test: the probe sends ICMP echo requests to a target you choose, and while the monitor considers the target reachable the route remains installed. When the monitor declares the target unreachable, the tracked route is withdrawn and the backup static route, which carries a higher metric, becomes the best path; when the target is reachable again, the primary returns and the backup drops back. Giving the backup a higher metric by itself never triggers failover, because nothing withdraws the primary route while its interface stays up. Equal-cost static routes toward both uplinks can send traffic over both paths, so the backup is not standing by. An HA pair protects against appliance failure, but the box is still fine when the ISP path dies, so the standby does not take over. Exam caveat: pick a probe target that answers reliably while the primary path works, or the tracked route may be withdrawn even though the path is usable. Practical check: stop the target or unplug the circuit and watch the primary route leave the table before you trust this in production.