300-415 · Question #122
Given the following configuration context for Site 1 on vpn10 with a firewall service, which of the following vSmart control-policy firewall-service definitions correctly redirects data traffic…
The correct answer is D. On vSmart control-policy firewall-service sequence 10 match route site-id 2 action accept set service FW vpn 10 default-action accept. To redirect data traffic from Site 1 to Site 2 through a configured firewall service, the vSmart control policy must match routes destined for Site 2 and set the appropriate service.
Question
control-policy firewall-service definitions correctly redirects data traffic traveling from Site 1 to Site 2 through the configured firewall?
Site 1:
vpn10
service FW address 1.1.1.1
On vSmart
policy
lists
site-list firewall-sites
site-id 1
apply-policy
site-list firewall-sites control-policy firewall-service out
Exhibit
Options
- Acontrol-policy firewall-service sequence 10 match route site-id 2 action accept set service local default-action accept
- BOn vSmart control-policy firewall-service sequence 10 match route site-id 2 action accept set service FW vpn 10 default-action accept
- COn vSmart control-policy firewall-service sequence 10 match route site-id 2 action accept set service FW vpn 10 set service local default-action accept
- DOn vSmart control-policy firewall-service sequence 10 match route site-id 2 action accept set service FW vpn 10 default-action accept
How the community answered
(46 responses)- A13% (6)
- B7% (3)
- C2% (1)
- D78% (36)
Why each option
To redirect data traffic from Site 1 to Site 2 through a configured firewall service, the vSmart control policy must match routes destined for Site 2 and set the appropriate service.
`set service local` redirects traffic to a local service on the WAN Edge router itself, not to the named firewall service `FW` in VPN 10.
The syntax for `set service` is incorrect; `service FW vpn 10` should follow `set` directly within the action block.
This configuration attempts to set two services, `FW vpn 10` and `local`, simultaneously, which is not how service chaining is configured for a single traffic flow.
This control policy correctly matches routes destined for `site-id 2` and, upon acceptance, uses `set service FW vpn 10` to redirect the data traffic through the firewall service named `FW` configured within VPN 10. This ensures traffic from Site 1 to Site 2 traverses the designated firewall as required for service chaining.
Concept tested: vSmart control policy service chaining
Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/m-policy-chapter.html#_Toc2227184
Topics
Community Discussion
No community discussion yet for this question.