A cloud gateway advertises a default route into OMP, and branch stores start sending their local internet breakout traffic toward the gateway. The stores should keep local breakout. Which policy fixes it?
Select an answer to reveal the explanation.
Short Explanation
Do not let a default route from the cloud talk the stores out of a breakout you meant to keep. You reject that default in centralized control policy before the stores install it. A firewall after the fact still leaves the bad route in the table.
Full Explanation
Centralized control policy can reject the default route advertised by the cloud gateway so store edges never install it. Local breakout then remains the path for internet traffic that is supposed to leave locally. A zone-based firewall that denies traffic after the default is installed does not remove the route. The requirement is that stores keep local breakout, not that they blackhole the packets after choosing the gateway. An application-aware routing SLA that drops all traffic when the default exists punishes every application instead of filtering one route. Cloud OnRamp for SaaS does not suppress default routes for VPC prefixes. It steers enabled SaaS applications and is not the filter for this OMP default. Exam caveat: reject the default only toward the stores that must break out locally. A site with no local internet still needs some default, often the gateway or a data center. Operational check: show sdwan omp routes for 0.0.0.0/0 on a store should be empty or should point at the intended local exit, not at the cloud gateway.