Which component of the Cisco SD-WAN control plane architecture should be located in a public Internet address space and facilitates NAT-traversal?

WAN Edge routers are the devices that sit behind NAT and rely on vBond to traverse it - they do not need a public IP address in the architecture.

vSmart controllers exchange OMP sessions with WAN Edges but do not need to be publicly addressed, as their connectivity can be established after vBond facilitates initial NAT traversal.

vBond is the only SD-WAN component mandated to have a publicly routable IP address because it authenticates new WAN Edge routers and controllers as they come online, and then helps them discover each other across NAT - a process that requires vBond itself to be reachable from any transport network. It uses STUN-like mechanisms to identify the public IP and port mappings of devices behind NAT, enabling hole-punching for subsequent direct tunnel establishment.

vManage handles management plane functions and does not need a public IP address specifically for NAT traversal - its accessibility depends on the operator's management network design.