An insurer must limit partner routes from site 200 to data-center prefixes 10.0.0.0/8, allow only Internet transport TLOCs, and drop the rest. The policy must use reusable lists and explicit actions. Which control policy match and set construction should the engineer build?
Select an answer to reveal the explanation.
Short Explanation
You're writing a guest list with an explicit door rule. Reusable site, prefix and TLOC lists select what to accept, and a default reject drops everything else.
Full Explanation
A centralized control policy is built from reusable lists and ordered sequences. To limit partner routes from site 200, the engineer matches the site list for site 200, the prefix list holding 10.0.0.0/8 and a TLOC list of Internet-colored transports, gives those sequences an accept action, and ends the policy with a default action of reject so every other route or TLOC is dropped. Ending with default accept all fails because the unmatched routes would leak to the partner, contradicting drop-the-rest. Using an MPLS TLOC list fails because the stem allows only Internet transport TLOCs, so private paths would be the ones permitted. Rejecting the matches while keeping default accept inverts the intent: it blocks exactly the routes that should pass and lets everything else through. Control policy sequences are evaluated top to bottom, so the order of sequences and the default action matter as much as the match criteria. Note that the TLOC action field applies to choices such as strict, primary, backup and ecmp, not to a permit; permitting is done with the accept action. In practice, preview the policy in SD-WAN Manager, activate it, and check show omp routes on a partner-facing site to confirm only 10.0.0.0/8 learned over Internet TLOCs is present.