When should you disable listen-only mode?

Disabling listen-only mode is a critical step in the process of ensuring that the Virtual Enforcement Nodes (VENs) can actively report their status and configuration back to the Policy Compute Engine (PCE) after they have been upgraded. When in listen-only mode, the VENs cannot send any data or communications to the PCE, which is essential for enforcing policies based on the latest information and updates received from the VENs.

By disabling this mode after the upgrade, you allow the VENs to resume normal communication, enabling them to effectively report their operational status, any changes that have occurred, and to receive updated policies. This ensures that the security posture is accurately reflected and maintained based on the latest information.

The other scenarios, such as completing the initial setup, initiating data backups, or immediately after software installation, are not necessarily about coordinating communication between the VENs and PCE post-upgrade, which is why they are not the right times to disable listen-only mode.