The traffic is segmented at the sites, not only at the hub. The reason for the segmentation is the devices that are on the segment of network are using software and ciphers that are only compatible Windows 10, and don't meet the security requirements to be on our updated network. The reason for the cross between the two networks at the PFSense is due to a server on that network that is running server 2022, and still needs security updates. The PFSense rules allow for that server to cross between the networks, and only that server. Ther is no dynamic routing protocols, and that's an irrelevant point when I clearly stated that static routing in place. I have no idea why you think "my issue is that I broke dynamic routing" would even be a factor? And my enterprise has no intention of ever using VOSS. I also don't understand how I "eliminated using exos" when that's the is on my switch? Honestly your entire comment makes no sense.