A manufacturer runs a centralized firewall service at its headquarters and needs Cambridge plant traffic to detour through that firewall before reaching the partner VPN, with failover to a second firewall. Which centralized policy design should you use to provide this service chaining?
Select an answer to reveal the explanation.
Short Explanation
You are rerouting delivery trucks through inspection first. A control policy with the service action steers the partner routes via the firewall, like adding a required weigh station.
Full Explanation
Service chaining in Catalyst SD-WAN works because the firewall site advertises its service through OMP, and a centralized control policy on the SD-WAN Controller (formerly vSmart) can match partner prefixes and apply the service action, with a TLOC list that ranks the primary firewall ahead of the second one so traffic fails over to the backup. The Cambridge routes then resolve through the headquarters firewall before reaching the partner VPN. A data policy that sets a next-hop IP address acts locally on forwarding, does not use the advertised firewall service, and gives no ordered failover. App-aware routing toward Internet colors fails because it selects transports by SLA and does not insert a service. A localized policy with a route policy affects only the local device routing and access lists, not the OMP advertisements that steer the whole site. For the exam, remember that control policy changes the control-plane advertisements while data policy changes forwarding behavior on the edge, and that the control policy uses a service action rather than a free-form next-hop action. In practice, view the OMP routes for the partner VPN and confirm the firewall service TLOC and the failover order.