Two branches sit behind carrier NAT with only private addresses, while the data center has public IPs. Edges can reach the Validator and Controller but peer IPsec fails until NAT addresses are learned. Which statement correctly describes NAT impact and the Validator role in NAT discovery for control and data connections?
Select an answer to reveal the explanation.
Short Explanation
When your branches sit behind carrier NAT, you need their public return addresses before peer tunnels can form. NAT discovery lets the Validator learn each translated address so the Controller can distribute it in TLOCs for tunnel setup.
Full Explanation
Behind carrier NAT, the branches have only private addresses, so peers cannot initiate IPsec until the post-NAT public IP and port are known. Each edge initiates outbound to the reachable Validator, which observes the NAT-mapped address and reflects it; the Controller then distributes that mapping in TLOCs so control and edge-to-edge data tunnels can be built. The Validator does not terminate data-plane IPsec: it assists discovery and tunnel bring-up, while customer data stays edge-to-edge for scale and policy. The mapping belongs in TLOCs, not OMP routes, because OMP routes carry data prefixes and VPN topology, whereas TLOCs identify transport locators, including the NAT-mapped public IP and port used as a tunnel destination. The Controller is not responsible for learning the mapping, and the Validator’s role is not limited to authentication; the Controller depends on the Validator-observed address because it cannot reliably learn it from OMP peering alone behind NAT. For exams, remember that NAT permits outbound initiation but blocks inbound initiation without reflected TLOCs, and keep authentication distinct from discovery. In practice, check show omp tlocs, control connection history, and Validator logs to confirm the advertised public locator matches the carrier binding before troubleshooting IPsec.