A new site WAN Edge router has just received its certificate and organization name. Connectivity to the fabric controllers over the Internet must be authenticated before OMP can start. Which WAN Edge control-connection behavior correctly establishes its secure channels to each controller type?
Select an answer to reveal the explanation.
Short Explanation
You've got the roles straight. Your edge makes a brief introduction to the Validator, then holds lasting DTLS sessions to the Controller and Manager, with TLS available as an option.
Full Explanation
A WAN Edge starts with the SD-WAN Validator, which authenticates the device by certificate and organization name and hands back the addresses of the SD-WAN Controller and SD-WAN Manager. The Validator session uses DTLS only (UDP 12346) and carries no data; it is temporary and drops once the edge has the controller list. The edge then builds persistent control connections to the Controller, where OMP runs, and to the Manager for configuration and statistics. DTLS is the default transport for these, and TLS (TCP) can be configured instead where UDP is a problem. The TLS-only option fails because the Validator never uses TLS and DTLS remains the default for the other controllers. The option giving a permanent Validator session carrying OMP fails because the Validator only orchestrates; OMP peers directly with the Controller. The fixed TLS-to-Controller and DTLS-to-Manager pattern fails because no such per-controller split exists; the protocol is a choice, not a role-based rule. The newer names SD-WAN Manager, Controller and Validator replace vManage, vSmart and vBond. In practice, check certificates and organization name, then use show sdwan control connections to confirm the Controller and Manager sessions are up and the Validator entry has dropped.