A hotel wants guest web inspected at the SIG and staff web broken out locally. Both currently match one data policy that sends all web to the SIG. What should the policy do?
Select an answer to reveal the explanation.
Short Explanation
One rule for all web is why staff are being inspected when you wanted them local. You match guest web to the SIG and staff web to the local internet exit. Those are two actions, and VPN 512 is not where you sort the users.
Full Explanation
A data policy can match the guest VPN or the guest application and set the SIG, then match staff and set the local internet exit. The current policy matches all web and sends it to the SIG, so staff never get the local breakout. Split the matches. Sending everyone to the SIG keeps the staff requirement broken. Sending everyone to the local exit skips guest inspection. VPN 512 does not classify users or choose their exit. Guest and staff stay in their service VPNs. Exam caveat: order the sequences so the more specific guest match is not swallowed by a broader web match above it. Operational check: a guest session should appear in the SIG log, and a staff session should egress the local internet interface.