A. In case of direct Internet access, the only traffic allowed back is the traffic matching the state table entries on the vEdge router.

B. Open Certificate Authority and automated enrollment feature.

C. Only authorized controllers are allowed to communicate back to the vEdg e router after the vEdge router establishes connection with the controllers.

D. The vEdge routers run on hardened Linux operating systems.

E. By default, all incoming traffic is denied at the transport (WAN) side interfaces.