A new SD-WAN branch has completed factory-default onboarding and Versa Director has pushed the staging configuration. After reboot, the branch still…

The branch onboarding process transitions from a temporary staging connection to a permanent control connection with the designated Controller. The stage-two configuration, pushed by Director, contains the necessary parameters for this transition. The most critical parameter is the IP address of the Controller, which is configured as the remote endpoint in the branch's IPsec (or TLS) profile. If this IP address is missing, incorrect, or unreachable, the branch device cannot establish the secure tunnel to the Controller and will fall back to its last known connection, the staging server.

A. Analytics log collector IP address: A missing analytics collector IP would prevent monitoring data from being sent but would not stop the primary control connection.

C. Tenant LAN DHCP pool: This configuration is for the local area network and has no impact on the device's ability to connect to the WAN-side Controller.

D. URL filtering profile: This is a security policy feature that is applied after the control connection is established; it is not a prerequisite for it.

1. Versa Networks, "Zero Touch Provisioning Quick Start Guide, Release 21.2.2", Section: "Onboarding Workflow", Page 10. The guide explains that the stage-2 configuration "contains the information for the CPE to connect to the controller," highlighting the Controller IP as the essential element for the next step.

2. Versa Networks, "VOS Configuration Guide, Release 21.2.2", Section: "Configuring IPsec Tunnels". This section details the requirement of a remote IP address in the IKE gateway configuration for the tunnel to be established, which is the mechanism used for the control connection.