A regional hospital is deploying SD-Access across two buildings with an on-site data center hosting known EHR subnets and a separate internet and merger partner link with unknown routes. The design must keep internal subnet handoff separate from default-route internet handoff for policy control. Which border node design supports this internal and external separation requirement?

SD-Access borders advertise fabric VN routes to the outside and inject outside routes into the fabric, with internal borders used for known subnets such as a data center or private WAN and external borders for unknown or default routes such as internet, and anywhere borders combining both roles on the same nodes for smaller sites. The dedicated internal plus external approach is correct because it preserves distinct control points for EHR reachability versus internet and merger routes, allowing different VRF leaking, SGT policy and route control without fate-sharing. An anywhere border fails by concept because combining all handoffs on the same nodes merges policy and failure domains, which violates the stated separation need even though it saves hardware. An internal-only design fails by concept because internal borders are optimized for known prefixes and do not cleanly handle default and full unknown routes with appropriate border behavior. An external-only design fails by concept because carrying known internal subnets through external borders blurs route handling and policy intent for trusted data center traffic. For the exam, remember internal equals known, external equals unknown or default, anywhere equals both on same box. In practice, verify VRF to VRF handoff, fusion router adjacency, and redundancy so loss of one border role does not isolate the fabric.