A financial campus must inspect all branch-to-data-center traffic in VPN 20 through a firewall service attached to a hub Edge before delivery. The firewall advertises a service TLOC and OMP carries the service route. Which control policy design chains traffic through the firewall correctly?
Select an answer to reveal the explanation.
Short Explanation
You've got the right steering spot — like sending all your mail through one security checkpoint. With an outbound control policy on your controller, you'll set the service TLOC for your VPN 20 prefixes so everything flows through inspection.
Full Explanation
Service chaining to a firewall uses OMP service routes that associate VPN prefixes with a service TLOC, and the scalable way to enforce the chain is a centralized control policy on the SD-WAN Controller, formerly vSmart, that matches the target VPN 20 prefixes and sets the service TLOC so all spokes resolve the next hop through the firewall; a spoke data policy with a service action confuses forwarding policy with route distribution and does not program OMP next hops consistently, a hub-only data policy misses centralized orchestration and fails to steer spoke-originated best paths before they are installed, and an inbound control policy that sets the TLOC to the data-center prefix bypasses the service and defeats inspection. The mechanism works because control policy mutates OMP TLOC attributes before advertisement. For the exam remember service insertion is a control-policy TLOC action, and operationally check show omp services and show omp routes with service detail on spokes.