Which Cisco SD-WAN controller can act as a STUN server during Edge device onboarding?

The vBond orchestrator is the only Cisco SD-WAN controller that can act as a STUN (Session Traversal Utilities for NAT) server. Its primary role is to authenticate and authorize all SD-WAN components and establish the initial control plane connections. When an Edge device is behind a NAT, vBond uses STUN to help the Edge device discover its public IP address and port, enabling it to establish IPsec tunnels to other SD-WAN components. vSmart is the policy and routing engine. vManage is the centralized management system. The PnP server is for zero-touch provisioning but doesn't act as a STUN server itself.