A new branch WAN Edge at a retail store shows no control connections, the site has Internet reachability, the serial is in Plug-and-Play, and the admin suspects certificate or Validator reachability. Which diagnostic approach should the engineer use to determine why the WAN Edge fails to join the control plane?
Select an answer to reveal the explanation.
Short Explanation
You are narrowing a no-join mystery fast with two complementary clues. History shows DTLS attempts while Manager flags expired certificates, and correlation is your detective pairing both sides together.
Full Explanation
The correct diagnostic pairs Edge connection-history with Manager certificate validation because onboarding failure leaves no active control session to inspect, so only the history log reveals the sequential DTLS and TLS attempts to the Validator and Controller with specific abort reasons such as certificate invalid, serial not authorized, or timeout indicating Validator unreachability despite Internet access, while the dashboard confirms expiry, revocation, or manufacturing certificate mismatch. Checking current control state alongside peer tunnel health fails by concept because BFD and branch-to-branch tunnels depend on an established control plane and therefore remain empty during onboarding and cannot explain why authentication or orchestration never completed. Reviewing generic system status alongside Validator reachability and serial onboarding is operationally useful but fails by concept because uptime, software version, and ping success do not decode the control handshake failure code or certificate trust chain, leaving the suspected certificate issue unverified. Inspecting local-properties alongside template attachment fails by concept because organization name, certificate serial, and Validator address confirm intended configuration, not attempted outcome, and template attachment typically requires control connectivity to deliver policy, so it cannot diagnose the initial join block. Exam caveat: do not confuse data-plane liveness with control-plane orchestration when Internet works but no control exists. Practical check: test Validator hostname resolution and UDP 12346 reachability from the Edge, then cross-check the connection-history error with Manager certificate inventory before re-onboarding.