topic Issue with VXLAN traffic passing through the firewall in General Topics

Issue with VXLAN traffic passing through the firewall

tamilvanan — Thu, 26 May 2022 17:21:26 GMT

Hi Team,

We have an SDWAN box placed behind the firewall and the SD_WAN box need to communicate with the controllers which is located on the internet.

The topology is given below:

SD_WAN Box<--->F/W LAN interface<--->F/W ISP interface <--> Internet <---->Controllers.

The SD_WAN Box is trying to establish VXLAN connectivity to the Controllers located on the internet.

On the traffic logs and the session browsers we could see the traffic flow b/n the SD_WAN Box and the VXLAN is being allowed by the firewall and the application is being correctly identified as "VXLAN".

We had configured only source NAT on the firewall but we could see on the log that the destination port is being translated to 511 from 4789

Why the firewall is translating the destination port even though the DNAT is not configured.

Re: Issue with VXLAN traffic passing through the firewall

BPry — Thu, 26 May 2022 20:55:59 GMT

@tamilvanan,

Have you run a test nat-policy-match against the traffic to verify that it's actually hitting the NAT policy that you expect. IF the firewall is modifying the port, sounds like you're hitting a DIPP entry that you might not be expecting.

Re: Issue with VXLAN traffic passing through the firewall

Travis.Tibbs — Fri, 12 Aug 2022 13:33:41 GMT

What I have found is that the VxLAN Session information (both from the web UI and from the CLI using the "show session ..." output) is incorrect - or at least misleading. The first packet of the session is shown correctly, but all VxLAN packets after the start of the session are assigned to their own session with strange output. I'm not sure, but I think the strange output showed the destination information from *inside* the VxLAN traffic (even with tunnel inspection turned off!). Is it possible that 511 was the destination port inside the VxLAN traffic? A packet capture on the firewall opened in Wireshark shows that the firewall is forwarding traffic correctly.

I have a case opened with Technical Support to try to determine if there is a way to interpret the output or if it is simply a bug.