Your company uses Azure Virtual WAN with several virtual hubs connecting branch offices and Azure VNets. Security policy requires all traffic to pass through a specific vendor's next-generation firewall that the vendor publishes as a managed offering in the Azure Marketplace. You must deploy this firewall directly inside the virtual hubs so it can inspect branch-to-VNet and branch-to-internet traffic without deploying and managing separate VMs in spoke VNets. Which Virtual WAN configuration meets this requirement?