A manufacturer wants every branch to reach an Azure prefix only through the regional Catalyst SD-WAN cloud gateway, never directly on a branch-to-branch TLOC. Routes should not be offered any other way. Which policy does that?
Select an answer to reveal the explanation.
Short Explanation
If the prefix should exist only via the regional front door, do not install the other doors and then hope a filter drops the packets. You advertise that Azure prefix only through the cloud-gateway TLOC with control policy. A firewall is too late, and an SLA still leaves the other paths in the table.
Full Explanation
Centralized control policy changes which OMP routes and TLOCs are advertised. To make the Azure prefix reachable only through the regional cloud gateway, the policy advertises that prefix with the cloud-gateway TLOC and does not offer it through branch TLOCs. Branches then have a single overlay next hop for it. A zone-based firewall can drop packets after forwarding, but the stem asks that the routes not be offered any other way. Leaving every TLOC installed and dropping later fails that requirement and still leaks the path into the table. Application-aware routing chooses among tunnels that already meet an SLA. It still installs the routes. It does not stop a direct branch TLOC from being offered. Cloud OnRamp for SaaS steers enabled SaaS applications. It does not suppress branch-to-branch TLOCs for a private Azure prefix. Exam caveat: control policy is evaluated on the controller before the route reaches the edge. A localized policy on one branch will not keep the other branches from learning the unwanted TLOC. Operational check: show sdwan omp routes for the Azure prefix on a branch should list only the cloud-gateway TLOC after the policy is activated.