A new WAN Edge at a warehouse shows no OMP routes and users report no SD-WAN reachability. SD-WAN Manager shows the Edge flapping between connect and challenge, then tear-down toward the SD-WAN Controller. Which interpretation of these control-connection states guides troubleshooting?

WAN Edge control connections progress from connect with socket establishment to challenge where certificates and identity are validated over DTLS/TLS, then to authenticated and up where OMP runs, so cycling between connect and challenge followed by tear-down indicates transport works but authentication fails due to certificate, serial, organization, or root-CA mismatch rather than routing or policy; established OMP peering would show up state with OMP routes exchanged, total transport loss would remain at connect without reaching challenge, and graceful restart would show an up session with timers rather than tear-down. The SD-WAN Controller was formerly called vSmart and the Validator was formerly called vBond. For the exam remember challenge equals identity check and tear-down equals rejected session, and operationally verify with show control connections, show certificate status, and clock and trust-chain checks on SD-WAN Manager.