A hospital inserts a service-side firewall cluster behind two data-center WAN Edges in VPN 20 to inspect guest traffic, but remote sites cannot reach the firewall IP and return traffic drops. The firewall is up and VRRP is healthy. Which service-route advertisement and reachability design makes the centralized security service usable?
Select an answer to reveal the explanation.
Short Explanation
You're putting the security booth on the map so guests can find it. Service route advertises the firewall into its service VPN.
Full Explanation
Service insertion requires the hosting WAN Edges to originate a service route, an OMP service prefix bound to a service TLOC with VPN-ID and service type firewall, IPS or IDS, into the same service VPN that remote sites use, plus underlying service VPN reachability so forward and return traffic can route to and from the service node. Advertising in VPN 0 fails because VPN 0 is the transport VPN for TLOCs and tunnels, not user segmentation, so remote service VPNs would never import the prefix. Advertising in VPN 512 fails because VPN 512 is out-of-band management and isolated from overlay service routing, and redistributing on the transport side fails because Internet reachability does not inject the prefix into OMP service topology for policy steering. Exam caveat: the service node must also have a return route to remote service subnets, often via static or service-side routing on the data-center edges, otherwise inspection succeeds inbound but drops outbound. Practical check: verify with show omp services and ping vpn 20 to the firewall VIP from a spoke before applying data policy.