Which mechanism forwards branch traffic from an SD‑WAN domain to the Cisco Umbrella SIG cloud?

A local Umbrella agent, typically deployed on a router or firewall at the branch, intercepts DNS requests and forwards them to the Cisco Umbrella cloud for security inspection and policy enforcement. This allows for granular control and protection of branch traffic before it accesses the internet. IPsec tunnels are used for secure site-to-site connectivity between SD-WAN devices and the Umbrella cloud, but the initial forwarding of traffic from the branch for inspection is handled by the agent. L2TPv3 tunnels are generally used for Layer 2 extension over an IP network and are not the primary mechanism for forwarding branch traffic to Umbrella. Source NAT is a network address translation technique, not a forwarding mechanism to a security cloud.