SD-WAN service chaining how are packets redirected to service device?

[njccnp]

Suppose Site 4 has a service device (firewall, etc.) to share, and it advertises it as netsvc1 for service insertion. The edge router at this site receives a packet marked for this service. How does this edge device direct the packet to the service device? Presumably it cannot change the destination IP field, because then the packet will not continue to its intended destination. If it uses MPLS-like labels, then other routers in the path between the WAN edge router and the service device would have to also support said labels. If it uses the MAC address, then the service device would have to be directly connected to the WAN edge router. 

[Kanan Huseynli]

Hi,

indeed, service device (i.e firewall) should be at the same L2 domain with router who inserts that firewall as service.

There should be option with GRE also, but it is not supported on IOS XE.

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/service-chaining.html

There is new approach named as "service insertion" which has more features and native support for several things:

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/m-service-Insertion-in-cisco-catalyst-sd-wan-manager-20-13-and-later.html

Tunnel connected services are natively supported, now.

[ekhabaro]

You can also configure data policy "from-tunnel" and set next-hop in it I believe, it was not supported in some very old versions before, but should work now. 

[wajidhassan]

Packets are redirected using service insertion via data policy or localized forwarding, but the service device must be in the same L2 segment as the WAN edge. You can also use from-tunnel data policies with next-hop to steer traffic without touching the destination IP.