The best way to look at why this is happening it to check the following after you have made the activation request   1 - check on vedge that there is now a certificate SN and no token.        - if not then you need to verify the token and chassis id ...

that's a great question.  I have seen some odd behavior with packets marked cs6 before.   It is not a common marking for transit packets.  Typically cs6 is used for control packets or routing advertisements which are locally terminated.  Your origina...

By default BFD uses CS6 for marking.  check with Juniper to see if this might get caught up in the control plane ACL.  Even though the traffic is transit it may see that as "control" traffic and punt it.     

this design leverages the behavior noted in the slide.   private color uses private address and public color uses public address.   for this design to work you need 1:1 nat so the branch can reach the controllers via public address.   NAT has to be d...