A retail chain adds a firewall service at its data center WAN Edge in VPN 10 serving stores in VPN 20. Stores must reach the firewall via OMP, and the firewall must return traffic to store prefixes. The service node is only reachable inside VPN 10. Which service-route advertisement approach satisfies the reachability requirement?
Select an answer to reveal the explanation.
Short Explanation
You nailed the tricky part — both directions matter here. Advertising the service keeps stores pointed at the firewall, while feeding their prefixes back keeps return traffic alive, like posting round-trip signs.
Full Explanation
Service insertion works by originating a service route for the firewall from the service-side VPN where the appliance lives, so remote sites learn the service TLOC and next hop over OMP and steer matching traffic toward it, and the service site must also inject the remote user prefixes back into that same service VPN so the appliance has a return path after inspection rather than dropping or misrouting. Advertising the firewall service from VPN 0 fails by concept because VPN 0 is transport, not the service LAN where the firewall is reachable, so the next hop would be unresolvable for service traffic, and leaking only between store VPNs fails because it never gives the firewall site the return routes it needs. Attaching the service only to VPN 0 and advertising only store prefixes fails because branches never learn a service route pointing to the firewall and traffic bypasses inspection. For the exam, remember that a service route does not fix reachability by itself; the service must be reachable in its VPN and both forward and reverse routes must exist, and in practice verify the service route in OMP and test ping from a branch and from the firewall host to a branch host.