A branch office has a primary L3VPN MPLS connection back to the main office and...

Static routes tied to IP SLA with a floating static backup route provide the cleanest active/standby design for this requirement. The MPLS L3VPN path is the primary connection and should carry traffic while it is available. IP SLA can actively test reachability across the primary path, and object tracking can remove the primary static route if the test fails. The backup IPsec VPN route is configured with a higher administrative distance, so it remains inactive until the primary route is withdrawn. This design is deterministic and prevents traffic from using the backup tunnel during normal operation. Running EIGRP across both paths could allow dynamic path selection, but it would require careful metric manipulation and could still introduce unintended failover behavior. BGP multipath is the opposite of the requirement because it is designed to install multiple paths simultaneously for load sharing. OSPF passive-interface on the backup connection would prevent neighbor formation rather than provide reliable backup routing. For a branch with one primary MPLS path and one backup IPsec path, tracked static routing with IP SLA is the appropriate design.