Which config will apply: centralized policy or template-based approach

[**Hamid**]

Hi,

I have applied a centralized policy for DIA and also created a template, which I applied to a specific location. My question is: Which configuration will ultimately apply to the location?

In general, my question is: When we apply a configuration through a centralized policy and also apply the same configuration via a template, which one takes precedence and will be applied on a cEdge router?

[MHM Cisco World]

DIA need local policy  not central policy 

MHM

[**Hamid**]

We can also configure DIA via Centralzied policy 

https://www.cisco.com/c/en/us/support/docs/routers/xe-sd-wan-routers/220613-implement-direct-internet-access-dia-f.html

[MHM Cisco World]

""Direct traffic from service VPN with either a static route or a centralized data policy."" <<- I prefer first op.

MHM

[**Hamid**]

Regarding your message, the question is: When we direct traffic from the service VPN using either a template or a centralized policy, which configuration will ultimately take precedence and apply?

[Jeongjun Park]

It depends on the functions.

In case of DIA, I think there is no priority.

As you know, You can achieve DIA in 2 ways.

1. Feature Template > Service VPN > Static route 

2. Centralized Policy > NAT VPN 0

The only difference is whether It is deployed by vSmart or Local Configuration.

* When It comes to Service Side NAT, It needs Centralized policy not only local configuration.

[Kanan Huseynli · Accepted solution]

Hi,

when both are implemented, centralized data policy takes precedence for forwarding. Because in order of operations, it happens first before forwarding decision. It means, traffic on service-side will be put to VPN0 due to nat in centralized policy and router will not check service-side routing table anymore.

Picture is from SDWAN CVD: