Predictika · Application delivery

An AI sales agent's Thunder ADC deployment, checked before it goes out

An AI sales agent prepares a Thunder ADC deployment for a data center: physical appliances with their modular license, vThunder instances on VMware or KVM, or Thunder ADC for bare metal, with the number of units, the traffic the customer needs to carry, ports, power, FIPS and DDoS requirements, and the total capacity it states. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the figures A10 Networks publishes and returns a verdict, every reason and the figures it computed.

Scope: Thunder ADC appliances, vThunder bandwidth licenses and bare metal licenses: published model and license rows, throughput, SSL, connection rate, ports, power, FIPS and virtual I/O. See everything this validator covers

This validator models a Thunder ADC deployment of one platform at a time, based on the figures in the public A10 Thunder ADC data sheet and spec sheet, not just the scenarios shown below.

  • Published model and license rows — an appliance must be one of the 14 rows the data sheet lists (1060S with a 20 or 35 Gbps license, 3350E, 3350, 3350S with a 50 Gbps license, 3360S with 50, 100 or 150, 7460S with 150, 200 or 250, 7460S-MAX, 6655S and 7655S). Each row gives layer 7 throughput, SSL bulk throughput, layer 7 connection rate, port counts, maximum power, hardware DDoS acceleration and FIPS availability.
  • vThunder and bare metal — the bandwidth license must be one A10 offers (25, 100 and 200 Mbps and 1, 3, 5, 10, 20, 40 and 100 Gbps), the I/O mode must be supported by the hypervisor (VMware ESXi: VMXNET3, SR-IOV, PCI passthrough; KVM: VirtIO, OvS with DPDK, SR-IOV, PCI passthrough) and meet what the license needs, and a bare metal license must be 10, 20, 40 or 60 Gbps with no more cores than it covers (4, 8, 14 and 24).
  • Capacity and connectivity — total application throughput, SSL bulk throughput and layer 7 connection rate across the units that carry traffic against what the customer needs (an active-standby pair counts one unit as carrying traffic), the ports needed on each unit, and the rack power budget against the units' maximum draw.
  • Requirements and options — FIPS 140-2 Level 2 (listed only for the 3350S, 6655S and 7655S, and the data sheet says FIPS models must be purchased), hardware DDoS protection (FTA models), the 40 degree Celsius operating limit, optics that are not from A10 (which go to a person), and the total capacity the quote states, which must equal the computed one.

Any Thunder ADC deployment that touches these rules is in scope — not only the scenarios pictured here. Not covered: prices (A10 does not publish list prices, so this page shows no price build-up), other Thunder platforms and models the tables here do not include, software feature licenses and support terms, container deployments, and real-traffic performance, which depends on configuration.

The AI sales agentBuilds the deployment from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Only the model and license combinations the data sheet lists (14 appliance rows)Only with workarounds
Each model has its own throughput, SSL, connection rate, port and power figures, and the license changes them. A rules-based CPQ needs a compatibility table or one rule per row, and every data sheet update means editing them.		Model and license arrive in one request and are matched to the published rows on every call.
Totals across units, with an active-standby pair counting one unitOnly with care
Capacity is a per-unit figure times the units that carry traffic, which depends on the high availability mode, and then it is compared with three different requirements.		The units that carry traffic, the totals and all three comparisons are computed on every call.
vThunder licenses that depend on the hypervisor and I/O modeOnly with care
Which I/O modes a hypervisor supports, and which modes a bandwidth license needs, are two separate tables that both depend on earlier choices.		The hypervisor, the I/O mode and the license are compared together, in any order.
Capacity the quote statesOnly with care
The stated total is derived from the chosen row and the units, so a rule has to recompute it and compare.		The stated capacity is a field in the request, compared with the computed one on every call.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a person often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1The data sheet lists no appliance with the selected model and a modular license of 25 Gbps.
2The data sheet lists no appliance with the selected model and a modular license of 20 Gbps.
3The quote has 0 units; at least 1 is needed.
4The quote needs 300,000 Mbps of application throughput; the units that carry traffic give 0 Mbps in total.
5The quote needs 1500 tenths of a Gbps of SSL bulk throughput; the units that carry traffic give 0 in total.
6The quote needs 4000 thousand layer 7 connections a second; the units that carry traffic give 0 thousand in total.
7An active-standby pair needs at least 2 units; the quote has 1.
8The quote needs 100,000 Mbps of application throughput; the units that carry traffic give 0 Mbps in total.
9The quote needs 500 tenths of a Gbps of SSL bulk throughput; the units that carry traffic give 0 in total.
10The quote needs 1000 thousand layer 7 connections a second; the units that carry traffic give 0 thousand in total.
11The quote needs 180,000 Mbps of application throughput; the units that carry traffic give 175,000 Mbps in total.
12The quote needs 351,000 Mbps of application throughput; the units that carry traffic give 350,000 Mbps in total.
13The quote needs 1710 tenths of a Gbps of SSL bulk throughput; the units that carry traffic give 1700 in total.
14The quote needs 5001 thousand layer 7 connections a second; the units that carry traffic give 5000 thousand in total.
15The quote needs 9 100/40 GE ports on each unit; the selected model has 8.
16The quote needs 25 25/10 GE ports on each unit; the selected model has 24.
17The quote needs 1 1 GE copper ports on each unit; the selected model has 0.
18FIPS 140-2 Level 2 validation is listed only for the Thunder 3350S, 6655S and 7655S appliances, and FIPS models must be purchased.
19Hardware-based DDoS protection needs an appliance with FTA hardware acceleration (7460S, 7460S-MAX, 6655S or 7655S).
20The room temperature of 41 degrees Celsius is above the 40 degree operating limit.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. FIPS and hardware DDoS requirements: Three 7460S appliances for a payments data center with a FIPS requirement

    
The agent's request. Please quote 3 Thunder 7460S appliances with a 250 Gbps modular license in active-active mode for a data center that needs 500 Gbps of application throughput, 250 Gbps of SSL bulk throughput and 8,000 thousand layer 7 connections a second. Each unit needs 8 100/40 GE ports, 0 25/10 GE ports and 0 1 GE copper ports. The room is at 25 degrees Celsius and the rack allows 3,000 watts. FIPS 140-2 validation is required, hardware DDoS protection is required, and the optics are from A10. The quote states 660,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • FIPS model required. FIPS 140-2 Level 2 validation is listed only for the Thunder 3350S, 6655S and 7655S appliances, and FIPS models must be purchased.
    • 
    

    
2. FIPS and hardware DDoS requirements: The agent resubmits after fixing the errors

    
The agent's request. Please quote 2 Thunder 7655S appliances in active-active mode for a data center that needs 500 Gbps of application throughput, 250 Gbps of SSL bulk throughput and 8,000 thousand layer 7 connections a second. Each unit needs 8 100/40 GE ports, 0 25/10 GE ports and 0 1 GE copper ports. The room is at 25 degrees Celsius and the rack allows 3,000 watts. FIPS 140-2 validation is required, hardware DDoS protection is required, and the optics are from A10. The quote states 680,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Deployment summary. 2 units carry traffic and give 680,000 Mbps of application throughput in total, against 500,000 Mbps required.
    • 
    

    
3. vThunder license and virtual I/O mode: Four vThunder instances at 40 Gbps on VMware with VMXNET3

    
The agent's request. Please quote 4 vThunder instances on VMware ESXi with a 40 Gbps bandwidth license each and the VMXNET3 I/O mode, in active-active mode, for a deployment that needs 120 Gbps of application throughput. FIPS 140-2 validation is not required and hardware DDoS protection is not required. The quote states 160,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Bandwidth license needs SR-IOV or PCI passthrough. A vThunder license of 40,000 Mbps needs SR-IOV (10 Gbps), SR-IOV or PCI passthrough (20 and 40 Gbps) or PCI passthrough (100 Gbps); the selected I/O mode does not meet that.
    • 
    

    
4. vThunder license and virtual I/O mode: The agent resubmits after fixing the errors

    
The agent's request. Please quote 4 vThunder instances on VMware ESXi with a 40 Gbps bandwidth license each and the SR-IOV I/O mode, in active-active mode, for a deployment that needs 120 Gbps of application throughput. FIPS 140-2 validation is not required and hardware DDoS protection is not required. The quote states 160,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Deployment summary. 4 units carry traffic and give 160,000 Mbps of application throughput in total, against 120,000 Mbps required.
    • 
    

    
5. Hardware DDoS, optics and approvals: Three 3360S appliances with hardware DDoS protection and third-party optics

    
The agent's request. Please quote 3 Thunder 3360S appliances with a 150 Gbps modular license in active-active mode for a data center that needs 360 Gbps of application throughput, 140 Gbps of SSL bulk throughput and 5,000 thousand layer 7 connections a second. Each unit needs 2 100/40 GE ports, 4 25/10 GE ports and 0 1 GE copper ports. The room is at 25 degrees Celsius and the rack allows 3,000 watts. FIPS 140-2 validation is not required, hardware DDoS protection is required, and the optics are from another vendor. The quote states 390,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Hardware DDoS protection needs an FTA model. Hardware-based DDoS protection needs an appliance with FTA hardware acceleration (7460S, 7460S-MAX, 6655S or 7655S).
    • 
      
  • Optics not from A10. A10 highly recommends its qualified optics and transceivers for network reliability; a person should confirm the optics.
    • 
    

    
6. Hardware DDoS, optics and approvals: The agent resubmits after fixing the errors

    
The agent's request. Please quote 3 Thunder 7460S appliances with a 150 Gbps modular license in active-active mode for a data center that needs 360 Gbps of application throughput, 140 Gbps of SSL bulk throughput and 5,000 thousand layer 7 connections a second. Each unit needs 2 100/40 GE ports, 4 25/10 GE ports and 0 1 GE copper ports. The room is at 25 degrees Celsius and the rack allows 3,000 watts. FIPS 140-2 validation is not required, hardware DDoS protection is required, and the optics are from another vendor. The quote states 390,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Optics not from A10. A10 highly recommends its qualified optics and transceivers for network reliability; a person should confirm the optics.
    • 
      
  • Deployment summary. 3 units carry traffic and give 390,000 Mbps of application throughput in total, against 360,000 Mbps required.
    • 
    

    
7. Hardware DDoS, optics and approvals: The agent resubmits after fixing the errors

    
The agent's request. Please quote 3 Thunder 7460S appliances with a 150 Gbps modular license in active-active mode for a data center that needs 360 Gbps of application throughput, 140 Gbps of SSL bulk throughput and 5,000 thousand layer 7 connections a second. Each unit needs 2 100/40 GE ports, 4 25/10 GE ports and 0 1 GE copper ports. The room is at 25 degrees Celsius and the rack allows 3,000 watts. FIPS 140-2 validation is not required, hardware DDoS protection is required, and the optics are from A10. The quote states 390,000 Mbps of application throughput in total. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Deployment summary. 3 units carry traffic and give 390,000 Mbps of application throughput in total, against 360,000 Mbps required.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a Thunder ADC deployment for a data center: physical appliances with their modular license, vThunder instances on VMware or KVM, Thunder ADC for bare metal. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the figures A10 Networks publishes and returns a verdict, every reason and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote 3 Thunder 3360S appliances. Each unit needs 2 100/40 GE ports, 4 25/10 GE ports and 0 1 GE copper ports. The rest of the request is on screen. The quote states 390,000 Mbps of application throughput in total.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with one finding and one approval, all in one answer. Hardware-based DDoS protection needs an appliance with FTA hardware acceleration (7460S, 7460S-MAX, 6655S or 7655S).
    6. 
      
  6. The validator returned one blocking finding and one approval in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other.
    7. 
      
  7. What this shows: for only the model and license combinations the data sheet lists (14 appliance rows), a rules-based CPQ can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the model to Thunder 7460S.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. Not blocked, but held for a person.
    12. 
      
  12. The one blocking finding is cleared; one approval remains for a person: optics not from A10.
    13. 
      
  13. The agent resubmits once more.
    14. 
      
  14. The revised request. It changes the optics from A10 to yes.
    15. 
      
  15. It calls the validator once more.
    16. 
      
  16. This time the validator clears it.
    17. 
      
  17. The earlier finding is cleared, and the validator's figure matches the quote.
    18. 
      
  18. Two problems caught in one call, fixed in two passes, and a clean quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    19.