A colocation Edge hosts a firewall for VPN 30 service chaining, with a 10.30.50.0/24 subnet behind it. Remote sites in VPN 30 must reach the subnet through the firewall, but traffic bypasses the firewall even though the firewall is deployed. Which service-route advertisement requirement enables reachable service chaining?
Select an answer to reveal the explanation.
Short Explanation
You've got the firewall ready, but your remote sites don't know it exists yet. Define it as a service route in VPN 30 with an address the Edge can actually reach, then point traffic at it.
Full Explanation
A firewall is inserted into the path by defining it as a service (for example FW) in the correct service VPN on the Edge that hosts it, using an address the Edge can reach. The Edge then originates an OMP service route for VPN 30 that carries its TLOC, and a centralized policy with a service-chain action steers matching VPN 30 traffic to that TLOC for inspection. Advertising the prefix only as an ordinary OMP network route restores unicast reachability but contains no service attribute, so remote traffic bypasses the firewall and the service chain never forms. Defining the service in VPN 10 fails because service routes are VPN-specific, so VPN 30 never learns the service and the chain cannot be built. Using an unreachable service address fails because the Edge cannot verify the firewall, so the service is not advertised or is treated as down. Exam caveat: distinguish OMP network routes from OMP service routes, and remember a service chain also needs a policy that references the service. Practical check: verify show sdwan omp services on the colocation Edge and a remote site for VPN 30 and the firewall TLOC, then test pings through the firewall.