When a customer delegate the installation and management of its SD-WAN infrastructure to an MSSP, the MSSP usually keeps the hub within its…

The placement of the SD-WAN hub is determined by the network's traffic "center of gravity." When an MSSP manages the infrastructure, the decision to place the hub at the customer premises rather than the MSSP's data center is driven by traffic efficiency and performance. If the majority of traffic is internal to the customer's network—either between branches (spoke-to-spoke) or from branches to a central corporate data center—placing the hub at the customer's data center is the most logical design. This co-locates the hub with the destination resources, minimizing latency and avoiding the inefficient routing of internal traffic through the MSSP's external infrastructure.

A. This scenario, requiring Secure Internet Access (SIA) with a centralized breakout, is a primary reason to host the hub within the MSSP infrastructure, not the customer's.

C. This option is too general. The optimal path for VoIP traffic depends on its destination (e.g., another branch, a corporate PBX, or a cloud service), which is better addressed by options B and D.

1. Fortinet SD-WAN Design and Deployment for MSSPs Guide:

In the section on "Hub deployment models," the guide explicitly contrasts the two main scenarios. It states, "Hub in customer data center: This model is suitable for customers who have a large amount of traffic between their branches and their data center, or between the branches themselves. Placing the hub in the customer's data center reduces latency and improves performance for this traffic." This directly validates options B and D.

Conversely, it notes, "Hub in MSSP PoP: This model is suitable for customers who require centralized internet breakout with security services provided by the MSSP," which invalidates option A.

2. Fortinet SD-WAN Architecture Guide 7.6:

Chapter: "Deployment Topologies," Section: "Hub-and-Spoke." The guide describes the hub as the central point where services and applications are hosted. It states, "The hub is typically a FortiGate located in a data center that provides spokes with access to corporate resources." This supports the principle that if the corporate resources (data center) are the main traffic destination, the hub should be located there (Option D). It also explains that spoke-to-spoke traffic traverses the hub, making its location critical for performance when that traffic volume is high (Option B).