Which device should be configured with the service‑chain IP to steer intersite traffic through a firewall?

The hub WAN Edge device is configured with the service-chain IP to steer intersite traffic through a firewall. In an SD-WAN fabric, intersite traffic (traffic between different sites) typically flows through a central hub. To insert a service like a firewall into this path, the hub WAN Edge is configured to redirect relevant traffic to the firewall using the service-chain IP. The vSmart controller orchestrates policies but doesn't handle data plane forwarding. A spoke WAN Edge handles traffic for its local site but isn't the central point for intersite traffic steering through a shared service. The firewall itself is the service, not the device that steers traffic to it within the SD-WAN fabric.