A. Open Certificate Authority and automated enrollment feature

B. By default, all incoming traffic is denied art the transport (WAN) side interfaces,

C. In case of direct Internet access, the only traffic allowed back is the traffic matching the state table entries on the vEdge router.

D. Only authorized controllers are allowed to communicate back to the vEdge router after the vEdge router establishes connections with the controllers

E. The vEdge routers run on hardened Linux operating systems