@ekhabaro to answer your questions.
Yes I can ping any public IP on any controller. Note tho, they are all behind firewall with 1:1 public/private IP mapping. Currently, there are no firewall rules for the source IP I am trying to connect from. To answer you second question; no, I am not using NAT on my router. I simply pluged it into my home modem and it's got a public ip. I can see the same ip as on the interface hitting the controllers so there is no nat on the ISP side.
Note that I can successfuly build control connections with vBond so I am puzzeled on why vManage and vSmart have issues. See the vbond_handshake.png attached. No issues there.
vBond is .101
vManage is .100
vSmart .102
router .12
Then the router tries to connect to vManage/vSmart (see captures attached). I can see client hello message sent by the router. However, nothing is coming back. The cotrollers are indeed getting those client hello messages, they are just not responding (see below). They keep shooting these short "Len=16" UDP messages. I am not sure what are these, but they contain almost no data.
Here is a tcpdump from vManage to prove the point that firewall is not blocking any traffic and messages are hitting the controllers. Additionaly, I confirmed that in the FW console where I cannot find anything blocked traffic from or to the routers ip.
vManage# tcpdump vpn 0 interface eth1 | i abc
15:14:39.484312 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:14:44.495975 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:14:48.068752 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:14:48.081467 IP 93-xx-xx-12.abc.12406 > 172.29.28.10.36496: UDP, length 144
15:14:49.504772 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:14:49.504826 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:14:51.128740 IP 93-xx-xx-12.abc.12406 > 172.29.28.10.36496: UDP, length 144
15:14:54.514592 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:14:57.142641 IP 93-xx-xx-12.abc.12406 > 172.29.28.10.36496: UDP, length 144
15:14:59.521085 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
15:15:04.527726 IP 172.29.28.10.12446 > 93-xx-xx-12.abc.12406: UDP, length 16
I assume these 144 long UDP packets are client hello messages sent by the router. Note that .12 is the router and .10 is vManage private IP. It seems that the vManage just doesn't give a **bleep** about the client hello messages.
Am I hitting a bug here?
I am running:
vManage 19.2.2
vBond, vSmart 19.2.1 (tried with 19.2.2 same thing, did not work)
router IOS-XE SDWAN 16.12.3 (also tried with a lower version, no luck)
*all controllers and the router have public color assigned (no restrict)
compatibility matrix shows no isses with versions
https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/compatibility-matrix.html
What versions are you running? Do you have any more ideas?
Rudi
