When TLS proxy is enabled on a Cisco SD-WAN device with Unified Threat Defense (UTD), client hello packets are sent to UTD for inspection and action. The client hello packet is part of the initial handshake process in the TLS protocol, and it contains important information such as the client's supported ciphers and TLS version. Inspecting this packet allows the UTD service to perform actions such as decrypting, inspecting, or blocking traffic based on policy.