A network administrator is bringing up one WAN Edge router for branch connectivity. Which types of tunnels form when the WAN edge router connects to the Cisco SD-WAN fabric?

WAN Edge routers do not form IPsec tunnels directly with the vManage controller, as vManage functions as the network management system and not a forwarding plane device.

While a DTLS or TLS tunnel is initially formed with the vBond controller for orchestration, the primary persistent control plane tunnel is established with the vSmart controller, which this option omits.

Upon joining the SD-WAN fabric, a WAN Edge router first establishes a DTLS or TLS tunnel with a vSmart controller for secure control plane communication and policy exchange. Subsequently, it forms secure IPsec tunnels with other WAN Edge routers to carry encrypted data plane traffic across the overlay network, enabling branch-to-branch connectivity.

WAN Edge routers establish DTLS or TLS tunnels with vSmart for control, but they do not form IPsec tunnels with the vBond controller, which serves an orchestration role.