Hi,
firewall behind router or router behind firewall?
If firewall behind router, it works as normal - no caveats actually (just allow respective user traffic flows on firewall).
But if router behind firewall, then you should allow respective ports. Plus, if router in configuration has private IP, but it is then mapped to public IP (through NAT), then you should have either 1:1 NAT or at least one router with 1:1 or direct public IP.
If two site routers both are behind firewall and they gt public IP through dynamic NAT/PAT, then ipsec and bfd don't come up between these sites.
See: Firewall Port Considerations section and NAT from CVD
https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#NAT
https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#FirewallPortConsiderations
HTH,
Please rate and mark as an accepted solution if you have found any of the information provided useful.
