TLOC cannot connect to vSmart

[PatrickCavell85782]

Folks, If a TLOC cannot connect to any vSmart with a TLS/DTLS connection I assume that TLOC is not eligible to create an IPSEC tunnel to another vEdge. I'm assuming here that if the vSmart does not learn about the TLOC it cannot then exchange that info with other vEdge's for purposes of creating tunnels. Am I correct?

I am running into an issue where I think this is happening. One TLOC goes straight to the Internet and is NAT'ed and can connect to both vSmarts. The other TLOC is an mpls connection that must traverse the customer's enterprise firewall to go out to the internet. My suspicion is that the customer's FW is blocking this traffic to/from the vSmarts. Sound reasonable?

Thanks.

[ekhabaro · Accepted solution]

Your understanding is correct. This is typical problem and to advertise TLOC information to vSmart controller even if no control connections are established over this TLOC, you need to specify `max-control-connections 0` for mpls interface tunnel-interface to instruct Edge router that it's expected and to instruct it to advertise information about MPLS TLOC anyway to vSmart controller.

[PatrickCavell85782]

I just adjusted the max-control-connections to 0 on the MPLS interface and it seems to have no affect. No MPLS tunnels are coming up.

[inderdeeps]

I agress with @ekhaboro use "max-control-connections 0"

[PatrickCavell85782]

Looks like the tunnels have now come up. I guess there's a a few minute delay to take effect. Thanks folks.

[svemulap@cisco.com]

Good to hear, Patrick.

Check the below Design-Guide document:
https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html?dtid=osscdc000283#CiscoCloudHostedDeploymentrecommended
which talks about the use case of "max-control-connections 0"

Hope it helps.

[PatrickCavell85782]

Thanks. Great info.

[inderdeeps]

Good to hear buddy, best of luck !

Regards

Inderdeep Singh

****RATE MY RESPONSE IF YOUR LIKE MY REPLY***