DTLS Connection Failure (DCONFAIL) when you have two isp

[dijix1990]

Hi, can you share with you experience when you bump into error DCONFAIL? I suppose that my error connect with Firewall's provider, but I have two isp and it's too difficult to troubleshoot one of them, for example when I try to use tracert with source I can see that trace goes via both channels. 

My devices is isr4331/c8200

[Kanan Huseynli]

Hi,

here design matters.

You say you have two ISPs, do you use PI addresses (your own scope) or PA addresses from one of or both ISPs?

Firewall connected to ISPs and router is behind firewall, right?

[dijix1990]

I have PA addresses and one of the ISPs has checkpoint FW (I knew about it when I first time bumped into problem like this, isp said they had problem on their checkpoint after changing palo alto) isp every time asks to show them

Ping to gw, trace to Google, telnet tcp port to problem ip address and etc, for legacy environment it's easy, just add new ip route /32 to testing host, for sdwan environment it's a little inconvenient

[MHM Cisco World]

Did you open dtls port in FW?

MHM

[dijix1990]

It's not my FW

[MHM Cisco World]

Check this link

https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214509-troubleshoot-control-connections.html

And I think you need to open sdwan ports in FW' ask admin do that.

MHM

[dijix1990]

Of course I saw this guide, but when you have some channels it's not appropriate for troubleshooting by guide. It's ISP's FW and they asked to try use telnet port, traceroute etc. When I do telnet with source interface (second isp) I can see that part of traffic goes via first isp because of default gw and the same thing for traceroute with source interface,so for doing test properly I need to disable first isp and make some test like telnet, ping etc it's not convenient and I was thinking maybe I can do tests without disabling first isp

[ivances]

Hi dijix1990.

Try this one: traceroute [IP SDWAN CONTROLLER] egress [INTERFACE OF THE ISP YOU WANT TO TEST] next-hop [IP OF YOUR NEXT HOP VIA ISP]

For example: traceroute 123.123.123.123 egress Gi1 next-hop 52.34.2.1

With the egress+next-hop command, you can bypass the routing table, disabling the ECMP on the global routing table.

[dijix1990]

Hi, yes it works! thanks

[ivances]

Perfect! Please, remember to vote my comment as useful