A 911 PSAP places SD-WAN controllers so Internet-transported Edges can reach them securely. What reachability design principle should lead?
Select an answer to reveal the explanation.
Short Explanation
If the firehouse Edge only has Internet transport, it still has to find the controllers. That means vBond and friends need reachable addresses—public or properly NATed—from VPN 0’s point of view. Hide them completely and onboarding never starts.
Full Explanation
SD-WAN Edges form authenticated DTLS/TLS control connections across the transport VPN toward the controller complex. When a 911 PSAP’s Edges use Internet transports, controllers—especially vBond for onboarding—need public addressing or carefully designed NAT and port reachability so those control sessions can establish from VPN 0’s perspective. Without that reachability, Edges never join the fabric even if underlay circuits light up.
Binding controllers only to service-VPN interfaces and never exposing reachability from transport breaks Internet-transported Edge onboarding. Relying solely on underlay multicast discovery without DNS or IP bootstrap is not how Edges find controllers in production SD-WAN. Making vBond unreachable from the Internet so Edges use only private MPLS ignores common Internet-color onboarding and dual-transport designs.
Exam caveat: control-plane reachability from transport is distinct from placing departmental data in VPN 0; controllers must be reachable for control connections without collapsing overlay VRFs into the transport table.
Operational check: from an Internet-attached Edge, resolve and reach vBond and subsequent controllers on the designed addresses and ports, confirm control connections establish and stay up, and retest after any NAT or firewall change on the PSAP controller path.