After a certificate renewal, a branch WAN Edge shows no OMP routes and users report intermittent reachability. SD-WAN Manager shows one controller connection stuck in challenge and another in tear-down. Which interpretation of the control connection states best guides troubleshooting?
Select an answer to reveal the explanation.
Short Explanation
Handshakes have awkward pauses, and yours is stuck mid-greeting. Challenge validation failing points you straight at certificates and clock before OMP.
Full Explanation
The correct interpretation correctly identifies that challenge is a transient validating phase for DTLS/TLS parameters and tear-down is an active closing state, which together mean no stable control connection exists and therefore explains why OMP routes are missing and reachability is intermittent after a certificate renewal. The variant describing graceful cleanup after control already distributed OMP routes fails on control effect because it assumes OMP routes should persist, while missing control means OMP is withdrawn and the observed symptom is no OMP routes. The variant treating challenge as OMP route exchange fails on sequencing because challenge is an early authentication phase of the control connection that precedes OMP, which cannot establish until control itself is up. The variant claiming the peer closed TCP and control will recover once routes return fails on causality because DTLS runs over UDP and control must establish first before OMP routes can be learned. An exam caveat is to distinguish transient challenge and tear-down from established up states and not assume redundancy hides failed controllers when OMP is empty. A practical check is to verify certificate validity, organization-name, serial and root CA consistency on Manager and Validators, then check DTLS errors, system IP conflicts, and controller reachability before resetting connections.