Which Control Policy Routes Site 2 Through the Site 1 Firewall?
[sampleXML/xmlfile-106_1.png] Refer to the exhibit. Which configuration routes Site 2 through the firewall in Site 1?
Community Insight
The exam tests whether you can write a control policy that matches routes from Site 2 and accepts them with 'set service FW', with the common trap being confusion over whether 'set service FW' sits on its own indented line or inline after 'action accept'.
This SD-WAN service-chaining question asks which vSmart control-policy configuration steers Site 2 traffic through the firewall located in Site 1. The page establishes that a route control policy with an accept action and a "set service FW" clause—applied to the Site 2 site-list—is the required configuration, and clarifies the formatting debate between the two nearly identical options.
Most learners pick C (or argue A and C are interchangeable), because both render the same functional policy; the trap is forgetting that the Cisco configuration guide and Cisco Digital Learning course present the canonical form with 'set service FW' indented on its own line under 'action accept', which is the graded answer.
Community Discussion (12 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A expresses the canonical Cisco control-policy structure for service chaining: a sequence that matches the routes of the spoke sites (here, Site 2) and then appliesaction accept with the nested set service FW clause, which tells the vSmart controller to rewrite the next hop toward the service node (the firewall in Site 1) instead of the natural OMP path. As soltani summarized the working config, "A is correct sequence 21 match route site-list SPOKES" followed by action accept / set service FW, exactly the shape the SD-WAN configuration guide uses for firewall service chaining. Because the firewall resides in Site 1, steering Site 2's accepted routes to the FW service makes Site 1 the transit point, satisfying the requirement. The optional vpn 10 scoping simply restricts the service to the service VPN where the firewall is attached.Why the Other Options Are Wrong
Options B and D fail to pair the route match with a service-node assignment in the correct control-policy syntax, so they either apply a data-plane/policy action that never invokes service chaining or they reference the wrong match scope, leaving Site 2 traffic on its default OMP path past the firewall. Option C is functionally equivalent to A—several commenters, including timtgh, noted "A and C are identical, except that A has the word 'set' on its own line"—but the Cisco documentation and Cisco Digital Learning material present the indented, two-line form, so A is the graded response; choosing C risks a mismatch with the answer key even though the syntax is accepted by the CLI. The remaining options never demonstrate theset service clause at all, which is the only mechanism that creates the service chain.Community Comment Notes
The thread is dominated by the A-versus-C formatting debate. Almanac observed that "from cisco digital learning it is A" while dCloud previews show the inline variant, and Jimmy3848 pointed out that "The SD-WAN book literally teaches that 'set' and 'service' are on 2 separate lines." RafaJohnston76 linked the official service-chaining page and favored C, and msstanick posted a real vSmart config whoseaction accept block places set service FW on its own line, matching A. The consensus is that both parse, but the guide-faithful answer is A. Official Reference
Exam Strategy
Memorize the service-chaining control-policy template exactly as printed in the Cisco configuration guide: sequence, match route site-list, action accept, then set service FW indented on its own line. When two options differ only in whitespace, pick the one that mirrors the vendor documentation layout.
Frequently Asked Questions
Why are options A and C both valid Cisco SD-WAN syntax for this policy?
Both forms parse on the vSmart controller: 'set service FW' may sit on its own indented line under 'action accept' or inline after it. Cisco documentation and Digital Learning use the indented form, so A matches the answer key.
Does 'set service FW vpn 10' change how Site 2 is routed through the firewall?
The vpn 10 qualifier only scopes the service chain to the service VPN where the firewall is attached. Without it the service is still applied, but scoping to the service VPN is recommended in production designs.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →