FPR 6.7 - NAT for UDP port 12446 not working.

[Xividar]

Hi Guys,

I have x3 Cisco SD-WAN controllers behind my FirePower. I have a 1:1 NAT for each controller, if I send ICMP from my vManage, I can see the packets getting translated to my public address, no issue there. However, any UDP packets generated from vManage do not get translated, specifically UDP with a source 12446.

Is there anything specific to UDP port 12446? These packets would be to initiate a DTLS connection from my C-Edge through the FirePower.

Cheers.

[Sheraz.Salim]

check this link might help you https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214517-vedge-can-t-establish-ipsec-tunnel-if-on.html

otherwise setup the capture on ASA or capture the ASP drops. but dont think ASA will drop or temper the UDP.

[Xividar]

Hey @Sheraz.Salim I saw this document, helpful, but not applicable in my case.

And this is not for ASA, it's for FirePower. I tried the same setup on ASA, and it works 100% fine, so it is something with FirePower for sure. Like I said, if I take a packet capture in my core, UDP packets from vManage though FirePower are NOT NAT'd. ICMP packets from vManage ARE NAT'd.