A retail chain places WAN Edge routers behind broadband NAT at 200 stores, with a SD-WAN Validator and SD-WAN Controller reachable on public IPs in the cloud. Stores must form control connections and then direct IPsec tunnels between sites. Which statement describes NAT handling and the Validator role in NAT discovery?
Select an answer to reveal the explanation.
Short Explanation
You're behind a locked lobby door and need the front desk to tell others where to find you. NAT discovery via the Validator shares your public mapping so peers can reach you. Without that introduction, direct tunnels simply can't start.
Full Explanation
When an Edge sits behind NAT it initiates outbound sessions to the Validator, formerly vBond, which observes the source public IP and port after NAT, returns that mapping to the Edge, which then advertises its private and public TLOC information to the Controller and ultimately other Edges through TLOC routes, allowing control connections to be established and data-plane IPsec to use NAT traversal with the correct destination and UDP encapsulation. Bypassing the Validator and using private addresses fails because private addresses are not routable across the internet and orchestration requires Validator authentication and mapping, having the Controller perform NAT discovery probing fails because that is not its role since the Controller, formerly vSmart, distributes routing and policy after Validator orchestration, and having the Validator terminate data tunnels fails because it only handles orchestration and never forwards branch data traffic. Exam caveat: remember Validator is always the first contact for authentication, NAT detection, and Controller assignment. Practical check: in SD-WAN Manager verify TLOCs show both public and private colors and confirm control connections show the NATed public IP.