A university applies a data policy to Site 10 that must filter user traffic entering the fabric toward the data center and also filter DC return traffic leaving the fabric toward users. The first draft applies only one direction and misses return flows. Which direction semantics should the engineer use to cover both paths?
Select an answer to reveal the explanation.
Short Explanation
You’re labeling which side traffic arrives from at the WAN Edge. From-service catches traffic entering the overlay from the LAN, while from-tunnel catches return traffic arriving from the overlay toward the LAN.
Full Explanation
Centralized data policy direction is evaluated on the WAN Edge relative to the overlay. From-service matches packets arriving from the service VPN and heading toward the tunnel, covering user-to-data-center traffic; from-tunnel matches packets arriving from the overlay and heading toward the service VPN, covering data-center-to-user traffic. Applying both directions to the site list creates symmetric intent and covers both paths. From-core and from-edge are not SD-WAN data-policy direction semantics, so they do not specify the required packet paths. From-BGP and from-OSPF describe routing-protocol sources for route policy, not data-policy packet direction. From-VPN used for both paths misstates the data-policy direction keywords: the relevant choices are from-service, from-tunnel, or all. For the exam, remember that the direction describes where the packet arrives from at the WAN Edge, not simply its ultimate destination. In practice, verify that policy sequence counters show matches in both directions in SD-WAN Manager.