Which control-plane component must reside in public IP space to assist NAT traversal?

The vBond orchestrator is the only control-plane component that must have a public IP address to facilitate NAT traversal. Its role is to authenticate and authorize all SD-WAN devices (vSmart, vManage, and WAN Edge routers) and then orchestrate the initial connectivity between them. This initial connection often involves traversing NAT devices, which necessitates vBond being publicly reachable. WAN Edge routers are the data plane and can reside behind NAT. vSmart controllers manage the control plane and typically have private IPs, relying on vBond for initial reachability. vManage is the network management system and also typically uses private IPs.