An MSSP prefers to host the SD-WAN hub in its own data center to leverage shared infrastructure and simplify management. However, certain customer requirements necessitate placing the hub on the customer's premises.

A large volume of branch-to-branch traffic (B) makes a remote MSSP hub inefficient due to increased latency, as all inter-spoke traffic must traverse the hub. Placing the hub at a central customer location minimizes this latency.

A requirement for Secure Internet Access (SIA) with a centralized breakout (A) can also force an on-premise hub if the customer mandates the use of their existing, on-premise security infrastructure for traffic inspection. This requires co-locating the hub with that security stack.

C. The customer expects a large amount of VoIP traffic.

This is not a primary driver. VoIP traffic is either branch-to-branch (covered by option B) or to a cloud service, where a direct branch breakout is typically preferred over a central hub.

D. The majority of the branch traffic is directed to a corporate data center.

While a valid reason for a hub, an MSSP can solve this without an on-premise hub by providing a dedicated, high-speed link from their own data center to the customer's data center.

1. Fortinet SD-WAN Architecture for Enterprise 7.4 Guide

Page 12

Section: Hub Placement: "If a large amount of traffic is exchanged between the branches

then a hub-and-spoke topology is recommended... The hub should be placed in a location that is central to all the branches to minimize latency." This directly supports option B as a key performance consideration for hub placement.

2. Fortinet SD-WAN for MSSPs Solution Guide

Page 6

Section: SD-WAN Hub/Controller: This guide notes that while the hub is typically in the MSSP PoP

it can be deployed on-premise for reasons including "Integration with existing on-premises infrastructure

such as authentication servers or security devices." This supports the rationale for option A

where SIA must integrate with the customer's on-prem security stack.

3. Fortinet SD-WAN Architecture for Enterprise 7.4 Guide

Page 12

Section: Hub Placement: "For centralized internet breakout

all internet-bound traffic from the branches is routed to the hub

where it is inspected by the security features of the FortiGate before being sent to the internet." This confirms the mechanism of option A

which

when combined with a customer's on-premise security stack

necessitates an on-premise hub.