On which device is a service FW address configured to insert firewall service at the hub?

vSmart controllers are responsible for policy orchestration, not for forwarding user data plane traffic or hosting service appliances at the branch.

The question specifies inserting the firewall service 'at the hub,' making a branch vEdge router an incorrect device for this configuration.

The hub vEdge router acts as the service insertion point, where configurations are applied to direct relevant traffic to an external or integrated firewall service. The vEdge then receives processed traffic back from the firewall for continued forwarding.

vSmart controllers define and distribute policies but do not participate in the data plane forwarding or host data plane services like firewalls.