Course contents

Unit 3: Underlay, overlay and TLOCLesson 3.7 (7 of 7 in this unit)20 of 27 in the Cisco SD-WAN course

NAT traversal, DNS and firewall dependencies

How a WAN Edge behind NAT learns its public address, where DNS and time are needed, and what a firewall has to permit for control connections and tunnels.

Intermediate · 11 min read

You'll learn to explain how a WAN Edge behind NAT tells other routers its public address, say where DNS is needed, and list what a firewall must permit so control connections and tunnels can form.

Technical definition

NAT traversal is the set of steps that lets a WAN Edge behind network address translation be reached by other WAN Edges. The router learns its translated (public) address and port with the help of a controller, advertises them in its TLOC, and peers send tunnel packets to that address.

Three outside services the overlay depends on

A WAN Edge that works in the lab often fails at a real branch for reasons outside SD-WAN. The branch sits behind a router or firewall that translates addresses, the Validator is given by name, and a firewall policy was written long before anyone had heard of the fabric. All three sit between the router and its peers. This lesson covers what each one changes and how to see it.

NAT and the public address

With NAT, the address on BR-01's interface is not the address that others see. Suppose its internet interface is 192.168.10.2, translated to 203.0.113.10 by the ISP's equipment. If BR-01 advertised 192.168.10.2, HUB-01 would send tunnel packets to an address it cannot reach. Instead, the fabric finds the translated address.

NAT traversal
NAT traversalThe edge learns its public address from the Validator.Edgeprivate addressNATtranslatesValidatorreports public addressTunnelsuse public address

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Tunnels use the public address and port.
  1. BR-01 contacts the Validator. The Validator sees the source address and port after translation.
  2. The Validator reports it back. BR-01 now knows its public address and port.
  3. The TLOC carries both. BR-01 advertises its private and its public address in the TLOC route, as the TLOC lesson describes.
  4. Peers aim at the public address. For a public colour, HUB-01 sends tunnel packets to 203.0.113.10 and the port shown. The NAT device allows them in because BR-01's own traffic created the translation.

The translation is kept alive by traffic. If it expires, packets from peers no longer reach the router until BR-01 sends again; BFD packets in the tunnel normally keep it open. That is one reason tunnels over NAT are checked with BFD and not only with a ping.

NAT and the public address
NAT and the public addressSituation; Usual result. One side behind NAT, the other with a public address (a hub): Works, because the hub can reach the translated address Both sides behind NAT: Can work; depends on how the NAT devices handle packets from a new sender Private colour on an interface behind NAT: Peers aim at the private address, which is not reachable, so tunnels fail Hub behind NAT with a fixed translation: Works when the translation is stable and the hub advertises the right public addressSituationUsual resultOne side behind NAT, theother with a public address(a hub)Works, because the hub can reach the translated addressBoth sides behind NATCan work; depends on how the NAT devices handle packets from a new senderPrivate colour on aninterface behind NATPeers aim at the private address, which is not reachable, so tunnels failHub behind NAT with a fixedtranslationWorks when the translation is stable and the hub advertises the rightpublic address

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

DNS

DNS appears at the start of the connection. If the Validator is configured by name, the router resolves it through a DNS server reachable from the transport VPN, and every transport that is meant to bring up control connections needs a working resolver. If the Validator is given as an address, this step is skipped. Zero-touch onboarding also uses a name for a cloud redirection service; the onboarding guide gives the name and what has to be permitted, so check it for your release.

DNS in SD-WAN
DNS in SD-WANIf the Validator is a name, DNS must resolve it.NameNeeds DNSAddressNo DNS neededor

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A failing name keeps the edge from starting.
ip name-server 198.51.100.53 ! system vbond vbond.example.net

Fragment of an IOS XE SD-WAN configuration for BR-01, shortened. The resolver address is a documentation example and vbond.example.net is a placeholder. Most networks push this from a Manager template or configuration group, and keywords and placement can differ by release.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-01#ping vbond.example.net
Translating "vbond.example.net"...domain server (198.51.100.53) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.51.100.40, timeout is 2 seconds:
!!!!!
The name resolved to an address and answered. If the first line shows a failure, DNS is the problem, and control connections will not start. If it resolves but the ping fails, the cause may be a route or a firewall that blocks ICMP, which is not itself proof that the control port is blocked.

Also check time. Certificates have validity dates, so a router with a wrong clock can fail authentication even when DNS and transport are fine. Use NTP, and reach it before assuming a certificate fault.

Firewalls

A firewall in front of the WAN Edge, or the router's own protection on its transport interface, has two groups of traffic to permit.

What a firewall must allow
What a firewall must allowControl and data both need ports.UDP 12346DTLS control, with offsetsTCP 23456TLS control, with offsetsIPsec data planeUDP 12346 range and 4500

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Open only what is needed.
Firewalls
FirewallsTraffic; Between; What to permit. Control connections: WAN Edge and Validator, Controller, Manager The control protocol and ports your release uses, outbound from the edge, with return traffic Tunnels (IPsec): WAN Edge and other WAN Edges The UDP ports in the TLOC attributes, in both directions Name resolution: WAN Edge and the DNS server DNS to the resolver in use Time: WAN Edge and the NTP source NTP to the server in useTrafficBetweenWhat to permitControl connectionsWAN Edge and Validator, Controller,ManagerThe control protocol and ports yourrelease uses, outbound from the edge,with return trafficTunnels (IPsec)WAN Edge and other WAN EdgesThe UDP ports in the TLOC attributes,in both directionsName resolutionWAN Edge and the DNS serverDNS to the resolver in useTimeWAN Edge and the NTP sourceNTP to the server in use

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

The ports are not listed here because they depend on the release and on settings such as port offsets. Take them from the configuration guide for your version, and from the TLOC output for the tunnel ports in use.

The router also decides which services it answers on a transport interface. By default some are blocked, and the allowed services are a setting on the tunnel interface. Check your release for the defaults before relying on a service such as ICMP being open, since it affects both ping tests and what the other side can learn about the router.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-01#show sdwan control connections
PEER    PEER      PEER         STATE
TYPE    PROTOCOL  SYSTEM IP
vsmart  dtls      10.255.0.11  connect
vmanage dtls      10.255.0.10  connect
Both rows stay in connect and do not reach up. When the name resolves and the address is reachable, that pattern points at something between the router and the controllers dropping the control protocol: a firewall rule, a missing return path or a port that is not open.

Learn more: Transport-Side IP and ISP ReachabilityColour Semantics and Public/Private Transport DesignOrganization Name and Certificate Domain

Where this goes wrong

  • Opening the firewall for the controllers but not for tunnels between branches, so control is up and BFD is empty.
  • Allowing only one direction and expecting a stateful firewall to handle the rest, then losing the session when its timer expires.
  • Testing with ping only. ICMP can be allowed while the control port is blocked, or the reverse.
  • Forgetting DNS and time, then investigating certificates for hours.

Test yourself on NAT, DNS and firewalls

Predict · scenario 1

BR-01's internet interface is 192.168.10.2, translated by the ISP to 203.0.113.10. Which address should HUB-01 use for tunnel packets to BR-01 on a public colour?

Predict · scenario 2

A WAN Edge is configured with the Validator as a name. It has a default route and can ping outside addresses, but no control connection starts. Which check comes next?

Predict · scenario 3

Control connections are up, OMP routes are present, but BFD shows no sessions to the hub. The hub has a public address. Which cause fits best?

FAQ

Can two WAN Edges that are both behind NAT form a tunnel?
Often yes, because each learns its public address and port and the other sends packets there. It depends on how the NAT devices behave: some translate in a way that blocks packets from a new sender. Check your release's documentation for the NAT types supported, and consider a hub when a direct tunnel cannot form.
Why does the router need DNS?
If the Validator is configured as a name, the router must resolve it before it can connect. Onboarding methods that use a name for a redirection service also need resolution. A router given only addresses does not need DNS for those steps.
Does a firewall need to inspect the SD-WAN traffic?
It needs to permit it. Control connections and tunnels are encrypted, so inspection of their contents is not possible. The firewall rules have to allow the protocols and ports your release uses, and the firewall must keep state long enough that tunnel sessions do not time out.