A retailer wants firewall and IDS inspection for branch Internet traffic at two colocation sites, sharing the same security stack across tenants and steering selected branches through it without backhauling to the data center. Which Cloud OnRamp for Colocation design meets this service chaining requirement?

The correct design succeeds because Cloud OnRamp for Colocation places SD-WAN fabric nodes in colocation facilities to host shared service-chained VNFs close to branches and cloud, so deploying clusters at both required sites with both firewall and IDS as shared virtual appliances and attaching only selected branch Internet traffic via service chaining policies satisfies redundancy, multi-tenancy, and selective steering without data-center backhaul. A design using dedicated firewall and IDS stacks per tenant fails on the sharing concept because it provides isolation at the cost of the stated shared security stack model that reduces footprint and cost through common VNFs across tenants. A design using a single centralized cluster fails on the site concept because even with correct VNFs and selective chaining it leaves the second required site without local inspection, increasing latency and removing site redundancy expected for branch Internet egress. A design substituting URL-filtering for IDS fails on the inspection concept because while firewall plus URL filtering is a common and valid branch security pattern, it does not deliver the intrusion detection visibility explicitly required for this scenario. As an exam caveat, distinguish service chaining for selective traffic steering from full-tunnel backhaul or default local breakout, since the stem specifically requires policy-based selection rather than all traffic. As a practical check, validate in SD-WAN Manager that both colo clusters show healthy VNFs, that the shared service chain is advertised to the intended branch templates, and that test traffic from a selected branch hits both firewall and IDS counters while an unselected branch does not.