A bank has two data centers advertising 10.0.0.0/8 to 60 branches over OMP. Operations requires the hub routes to be filtered before they enter the Controller topology, but branch prefixes must still reach the hubs unchanged. Which control-policy design should the engineer apply to change only the intended routes?
Select an answer to reveal the explanation.
Short Explanation
Direction is measured from the Controller, so you want to touch what it receives from the hubs. An inbound policy on the hub site list filters their routes before they enter the Controller route table.
Full Explanation
Control policy direction is relative to the SD-WAN Controller: inbound analyzes routes and TLOCs received from the sites in the site list before they are placed in the Controller route table, while outbound analyzes routes after they leave the route table toward those sites. Filtering hub prefixes before they enter the topology therefore requires an inbound policy on the hub site list, which leaves branch prefixes untouched as they reach the hubs. An inbound policy on the branch list fails by concept because it changes what branches advertise, not the hub routes. An outbound policy on the branch list fails because the hub routes would already be in the Controller topology and only the branches' view would change. An outbound policy on the hub list fails because it changes what the hubs receive, which would alter branch prefixes reaching them rather than filtering the hub advertisement. Exam caveat is to always read direction from the Controller's perspective and map site list plus direction to the receive-versus-send role. Practical check is to compare OMP routes on the Controller and on a branch before and after the commit.