A hospital behind a strict firewall is onboarding new branches where control connections stall during DTLS handshake, NAT hides private addresses, and only HTTPS is currently allowed outbound. Which firewall and NAT ports should you open for DTLS/TLS control connections?
Select an answer to reveal the explanation.
Short Explanation
Your edges are knocking but the firewall muffles the handshake. Open DTLS/TLS ports outward so control can connect, like unlocking both the front and side gates.
Full Explanation
The correct answer is right because branch WAN Edge routers initiate control connections outbound toward the Validator for authentication and orchestration and then to the Controller and Manager, using UDP port 12346 for DTLS, the default, and TCP port 23456 when TLS is used toward the Controller and Manager (the Validator uses DTLS only), so a strict firewall with NAT must permit them outbound with stateful return. A distractor allowing those exact ports only toward Controller and Manager fails on orchestration scope because omitting the Validator prevents certificate validation and controller discovery, leaving onboarding stalled before any DTLS handshake can complete. A distractor allowing the same ports inbound fails on direction and state because sessions originate inside behind NAT and require an outbound permit to build translation, while an inbound-only rule never triggers the handshake and does not help stalls. A distractor keeping UDP 12346 but substituting TCP 443 for TLS fails on service-port mapping because 443 is HTTPS management and control-plane TLS strictly uses TCP 23456, so TLS control would still stall under an HTTPS-only policy. Exam caveat is to memorize exact DTLS and TLS numbers, outbound direction, and all three destinations and not confuse control TLS with web HTTPS. Practical check is to inspect firewall hit counts and NAT translations sourced from the WAN Edge and capture ClientHello messages leaving on UDP 12346 and TCP 23456 with responses from each component.