A regional hub uses a public transport address while a new remote office sits behind a firewall doing port address translation. The branch must build control connections and direct IPsec tunnels to the hub without a public address on its transport. Which statement correctly describes NAT effects and the Validator role in NAT discovery?
Select an answer to reveal the explanation.
Short Explanation
Your branch can still punch through without its own public IP. The Validator acts as your introducer, learning the outside address and introducing peers for direct tunnels.
Full Explanation
Behind port address translation the branch sends from a private address that the firewall rewrites. During bring-up the branch contacts the SD-WAN Validator, which sees the translated source address and port and reports them back, acting like a STUN server. The branch then advertises that public mapped address and port as part of its TLOC through the SD-WAN Controller over OMP, so peers such as the publicly addressed hub can send IPsec packets back through the existing NAT binding; keepalives hold the binding open. The static port-forwarding option fails because discovery is automatic and the scenario states the branch has no public transport address, so forwarded ports are neither required nor the described mechanism. The relay option fails because the Validator never carries branch data traffic; it only orchestrates and discovers, and data flows over direct IPsec tunnels between edges. The option where the Validator shares the branch private address fails because a private address is unreachable across the translation, which is why the mapped public address is what gets advertised. The newer names SD-WAN Validator and Controller replace vBond and vSmart. In practice, check show sdwan control local-properties on the branch to see private and public address and port and the NAT type, and show sdwan bfd sessions to confirm tunnels to the hub are up.