A manufacturer chains branch Internet traffic through a firewall service hosted at hub Site 20 before breakout. The firewall advertises a service TLOC, but default OMP best-path sends branches directly to the NAT TLOC at Site 20. Which control-policy action enforces the required service chaining through the firewall?
Select an answer to reveal the explanation.
Short Explanation
You spotted the direct-path trap. A centralized control policy with a service action directs matching routes to the firewall service first, so traffic passes through security before Internet breakout.
Full Explanation
A centralized control policy operates on OMP route advertisements at the SD-WAN Controller. It can match prefixes and site lists, then apply the service action so matching routes resolve to TLOCs advertising the firewall service. This overrides the default best path to the direct NAT transport TLOC, making branches reach the firewall before Internet breakout. Setting the TLOC to the Site 20 NAT address instead preserves the direct exit and bypasses the firewall, contrary to the chaining requirement. Setting the local TLOC color in a data policy fails because data policy influences packet forwarding at the edge rather than the OMP route resolution used for service chaining; a color alone does not redirect traffic to a service. Setting an App-Route SLA backup to the firewall service TLOC also fails: App-Route steers among tunnels according to loss, latency, and jitter rather than inserting a service. For the exam, remember that service chaining uses a centralized control policy with the service action, applied inbound or outbound on the Controller; a control policy has no generic next-hop action. In practice, verify that the branch traffic’s OMP routes resolve to the firewall service TLOC after policy application, then trace traffic through the firewall.