Open Certificate Authority and automated enrollment feature.

By default, all incoming traffic is denied at the transport (WAN) side interfaces.

Only authorized controllers are allowed to communicate back to the vEdge router after the vEdge router establishes connections with the controllers.

In case of direct Internet access, the only traffic allowed back is the traffic matching the state table entries on the vEdge router.

The vEdge routers run on hardened Linux operating systems.