Auto changing ipsec port between wan edges

[dijix1990]

I'm interested what happens when some of ipsec ports were blocked?

from design guide we have 20 ports for ipsec tunnel, if I will block the active port and restart transport interface the wan edge changes port or not?

[dijix1990]

I blocked one active source port on the external fw, reloaded transport interface and cedge couldn't establish session to another cedge although port hopping was enable 

[dijix1990]

so after some tests iknow it doesn't work

[Kanan Huseynli]

Hi,

WAN edge does not aware of you have blocked ports on transport or not.

It uses base number UDP source 12346 and increments +20 unless it successful. Below is from CVD:

"The WAN Edge will increment the port by 20 and try ports 12366, 12386, 12406, and 12426 before returning to 12346"

If port-offset (which is different parameter) is configured (need to be explicitly configured, default is 0, maximum is 19), then base port value will be 12346+offset and port-hop is still plus 20 (+20).

If you have several routers behind firewall, configure different port-offset on them.

[dijix1990]

About 1 year ago I asked TAC, and they said that wan edge change port
automatically if it one of them not responding

[Kanan Huseynli]

Port-hop should happen automatically

Port-offset is process of changing base port number (base is 12346), this should be configured explicitly

[dijix1990]

If the first connection attempt on the initial base port does not succeed after about 1 minute, the router hops to port 12366. After about 2 minutes, it hops to port 12386; after about 5 minutes, it hops to port 12406; and after about 6 minutes, it hops to port 12426. Then the cycle returns to initial port, 12346.

Did you try? In my instalation it didn't work)

[Kanan Huseynli · Accepted solution]

I checked and it works. Blocked udp port 12366 on path, and it hopped to next available 12386

NAT TYPE: E -- indicates End-point independent mapping
A -- indicates Address-port dependent mapping
N -- indicates Not learned
Note: Requires minimum two vbonds to learn the NAT type

PUBLIC PUBLIC PRIVATE PRIVATE PRIVATE MAX RESTRICT/ LAST SPI TIME NAT VM
INTERFACE IPv4 PORT IPv4 IPv6 PORT VS/VM COLOR STATE CNTRL CONTROL/ LR/LB CONNECTION REMAINING TYPE CON REG
STUN PRF IDs
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
GigabitEthernet1 172.20.1.111 12366 172.20.2.1 :: 12366 0/0 biz-internet up 2 no/yes/no No/No 0:00:00:15 0:11:54:00 N 5 Default
GigabitEthernet3 172.20.3.1 12426 172.20.3.1 :: 12426 0/0 public-internet up 2 no/yes/no No/No 0:00:00:01 0:11:53:59 N 5 Default

Site1-RTR1#sh sdwan control local | begin NAT
NAT TYPE: E -- indicates End-point independent mapping
A -- indicates Address-port dependent mapping
N -- indicates Not learned
Note: Requires minimum two vbonds to learn the NAT type

PUBLIC PUBLIC PRIVATE PRIVATE PRIVATE MAX RESTRICT/ LAST SPI TIME NAT VM
INTERFACE IPv4 PORT IPv4 IPv6 PORT VS/VM COLOR STATE CNTRL CONTROL/ LR/LB CONNECTION REMAINING TYPE CON REG
STUN PRF IDs
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
GigabitEthernet1 172.20.1.111 12386 172.20.2.1 :: 12386 2/1 biz-internet up 2 no/yes/no No/No 0:00:01:21 0:11:58:23 N 5 Default
GigabitEthernet3 172.20.3.1 12426 172.20.3.1 :: 12426 0/0 public-internet up 2 no/yes/no No/No 0:00:00:02 0:11:51:01 N 5 Default

WAN_ROUTER#sh ip access
Extended IP access list test
10 deny udp any eq 12366 any (24 matches)
20 permit udp any eq 12346 any
30 permit udp any eq 12406 any
40 permit udp any eq 12386 any (20 matches)
60 permit ip any any (1574 matches)

[dijix1990]

Which software do you use? I tested vmanage 20.9.3 and cedge 17.9.3a

[Kanan Huseynli]

I mostly use latest version for labs. So, I have 20.11.1/17.11.1.

P.S 17.12/20.12 recently released, didn't check yet

[dijix1990]

hm, maybe it's bug on the 20.9 

[Kanan Huseynli]

Do you have NAT on path?

[dijix1990]

No

[Kanan Huseynli]

Then, I don't sure what is going in your case.

It worked as expected in my case.

[dijix1990]

I've tested on the version 17.12/20.12 it works and it haven't work on the version 17.9/20.9... So from version to version some of the features can work and some can't