vbond and vedge behind nat firewall

[nezar jam]

If you have topology Vmanage , Vsamrt , Vbond behind firewall ,  Vedge in other site also behind firewall 

i configured Vedge  ip address for vbond  public ip , also i made nat for it on the firewall - DC  1 to 1

Vedge can,t  register 

any one can help ?    

[omz]

I think the suggested design is not to have vBond behind NAT. 

Do you have eth0 on vBond configured for VPN0? Can you try with Gig interface on vbond in VPN0?

[nezar jam]

the Vbond already configured with interface Gig0/0 

[omz]

"already" .. should have shared the updated topology in the first place 

[balaji.bandi]

Look at the required ports :

https://sdwan-docs.cisco.com/Product_Documentation/Getting_Started/Viptela_Overlay_Network_Bringup/01Bringup_Sequence_of_Events/Firewall_Ports_for_Viptela_Deployments

[nezar jam]

all ports opened 

[balaji.bandi]

Looks like this is LAB environment ( EVE or PNET Lab), remove FW and check with direct connection?

[nezar jam]

its working if i removed the public ip and used the private ip with routing 

in real live there is no routing between ISP and your site , only NAT

[balaji.bandi]

is this Fortinet doing NAT here? what kind of NAT Static NAT?

[nezar jam]

Yes Static Nat from outside to inside

[Gentry17]

You can likewise in fact out the vEdge behind a firewall with PAT, on the grounds that the vBond will work with NAT crossing, yet you're not actually going to assess a lot other than DTLS or IPSec which you're presumably not going to decode.