Question

A network architect manages a Cisco Catalyst SD-WAN fabric with two data center sites connected over the overlay. Regulatory requirements dictate that all traffic between the Finance VPN (VPN 20) and the HR VPN (VPN 30) — which are inter-VPN east/west flows — must be inspected by a centralized firewall appliance hosted at the primary data center. Which control policy construct should the architect configure on vSmart to force this inter-VPN traffic through the firewall?

Accepted Answer

A centralized control policy with a service-chaining action referencing the firewall (FW) service advertised by the data center edge router via OMP

Answer

A localized data policy applied per-interface at each branch that sets a DSCP marking so the firewall recognizes the flow

Answer

An application-aware routing policy that matches the SLA class of Finance and HR applications and steers them to the MPLS transport

Answer

A VPN membership policy on vSmart that removes VPN 20 and VPN 30 from all sites except the data center