A branch must allow only marketing VLAN 30 in VPN 10 to break out locally to the internet for HubSpot, while finance VLAN 40 in the same VPN must stay on the overlay to the data center. Both VLANs share one internet transport and need source NAT only for breakout traffic. Which selective DIA forwarding approach meets this per-application isolation requirement?
Select an answer to reveal the explanation.
Short Explanation
You've got one shared ride to the internet, but you can still give marketing its own off-ramp while finance stays on the main highway. A targeted rule lets only your marketing traffic break out with source NAT while finance stays safe on the overlay.
Full Explanation
A centralized data policy, defined on the SD-WAN Controller and applied to the branch site list, can match the marketing VLAN 30 source prefix (or the HubSpot application) and apply a NAT action that sends the flow out the local VPN 0 internet transport with source NAT. This provides selective direct internet access for marketing while unmatched finance traffic keeps its default overlay forwarding to the data center. A static 0.0.0.0/0 NAT route in the service VPN fails by concept because it diverts the entire VPN to local internet, breaking the requirement to keep finance on the overlay. Advertising a data-center default over OMP with NAT at the data center fails because it centralizes egress for all traffic rather than enabling local selective breakout at the branch. Enabling NAT on the LAN interface with a control policy fails because control policy influences OMP route and TLOC advertisement, not per-flow forwarding, and NAT belongs on the transport exit interface. Exam caveat: use a centralized data policy with a NAT action for selective, match-based DIA, and use the VPN 0 NAT interface with a service-side NAT route only for whole-VPN DIA. Practical check: confirm the policy is applied in the right direction for the branch site list, then verify with show sdwan policy from-vsmart and NAT translations for the marketing source.