A healthcare network adds a third-party firewall with a service TLOC at the data center and requires all guest VPN traffic from branches to traverse it before internet breakout. Spoke routes must be redirected through the service while return traffic still works. Which service-chaining design via control policy directs the guest traffic to the firewall service TLOC?
Select an answer to reveal the explanation.
Short Explanation
You're routing all visitors through security before the exit. The service tag is your VIP pass that tells OMP this TLOC does more than transport.
Full Explanation
Service insertion uses the firewall or other appliance to advertise a service TLOC with service VPN information, then a centralized control policy on the SD-WAN Controller (formerly vSmart) matches the guest VPN routes and sets the service to chain forwarding through that TLOC, preserving both forward and reverse path programming for stateful inspection. Using a standard data TLOC with app-aware routing fails by concept because without the service attribute OMP treats the path as normal transport and does not trigger service chaining logic or service-route installation. Expecting a localized data policy on the firewall to redistribute into OMP fails by concept because redistribution and chaining intent are signaled via OMP service advertisement plus controller policy, not by edge data policy alone. Relying on TLOC rewrite without a service fails by concept because hub-and-spoke rewrite changes next-hop topology but does not encode service inspection or track service availability. For the exam remember service equals control policy plus service TLOC advertisement, and in practice verify the service is listed in OMP and test bidirectional flow through the firewall.