vEdges behind NAT devices

[AkashKoshiya1991]

Hello Folks,

I have a topology as given below.

LAN----vEdge2----NAT---INTERNET-----NAT----vEdge2----LAN

My control connections are up but not able to form the BFD tunnel. What could be the issue?

Thanks in advance!!

[osdesent]

Are you doing PAT?

In case your controllers are hosted in the cloud, are you able to ping vBond from both vedges?

Regards 

[AkashKoshiya1991 · Accepted solution]

It started working once I set port-offset on vEdges and BFD tunnels came
up.

[svemulap@cisco.com]

Good to hear.

port-offset is needed in the case of a dual Edge site, when the devices sit behind a SAME NAT device.
This command is added to get around some of the modem implementations where they can't handle the NAT flows uniquely.

Documentation Link: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book/config-cmd.html#wp3976402740

[AkashKoshiya1991]

Right, actually I have dual vEdges on both sites and translated into one ip
with different port.

As first vEdge has already occupied 12346 port and port of secondary vEdge
being translated into random port so what i did was set port-offset on
secondary vEdges on both end.

On the top of that, I removed port-offset and set port-hop on both
secondary VEdges and it worked as well.

So either way it works in this type of scenario.

[svemulap@cisco.com]

Just to be clear: Usecases for port-offset and port-hop are different. See below:

We have talked about port-offset and what it does and when it is used (from a deployment use case)

For port-hop - it is hop from the base-port. i.e., it will hop across 5 base ports. (12346, 12366, 12386, 12406 and 12426)
There are deployment recommendations, when to use port-hop or not.
Typically, it is not recommended on the DC devices, as it will cause churn and it is disabled by default.

vEdge# show control local-properties | include port-hopp
port-hopped FALSE <<<<<<<<<<<<
vEdge#

vEdge# sh ver
20.4.1
vEdge#

Documentation link for port-hop: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book/config-cmd.html#wp2677012234

Hope it helps.

[AkashKoshiya1991]

Yes, I understand. So even if I don't set port-offset, as per guidelines
vEdge will try to establish a connection with next port 12366 after a
minute, so I would have waited for a minute but before that I set port
offset command. That makes sense.

[svemulap@cisco.com]

Good to hear, that all worked out.