doubt with service insertion in SD-WAN

[rafael5]

Hi community,

i got a question about firewall service insertion, this can be consider control policy or data policy in SD-WAN?

[balaji.bandi]

Most cases FW in the path for both, you can allow what required for SDWAN to establish DTLS / IPSEC with Cloud devices.

[rafael5]

Thx you balaji bandi,

the thing is yesterday i fail the sd wan 300-415 exam and there was a question about that....

so, i think it can be consider control policy because in the policy normally i  see the configuration there...

[balaji.bandi]

Since i was not sure what the question it hard to guess what you got there, if you can elaborate or post the question we may understand better to give reasonable answer.

[rafael5]

in the exam basically ask me about the firewall service insertion is considered an:

control policy

data policy

and other 2 options i dont remember but something with no sense like bgp & ospf

the thing is im not 100% sure if the service insertion is always a control policy in sd wan

[Kanan Huseynli · Accepted solution]

Hi,

both centralized control and data policy can be used for service chaining:

Service Chaining Policy

To route traffic through a service, you provision either a control policy or a data policy on the Cisco vSmart Controller. You use a control policy if the match criteria are based on a destination prefix or any of its attributes. You use a data policy if the match criteria include the source address, source port, DSCP value, or destination port of the packet or traffic flow

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/vedge-20-x/policies-book/service-chaining.html 

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/service-chaining.html 

Regards,

[rafael5]

Thx you that was what I was looking for