Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 40 replies
  • Subscribers 31 subscribers
  • Views 2749 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VoIP communication problems over SD-WAN and IPsec-Interfaces

Max Lange

Hi,

We have several departments and connect them via IPsec “Tunnel Interfaces”. For each interface we set up a Gateway and configured a SD-WAN policy.

This works for the most Services, but not for VoIP and Radius. The traffic is logged as allowed in the src, but never appears in the dst. We created a static route for the VoIP-Network to get it working. But this static route cannot be the solution, as it negates the sense of SD-WAN routing.

Our configuration:

Department 1

Network

172.16.0.0/16

VoIP-Subnet

172.16.7.0/24

xfrm1

172.16.254.1/30

xfrm1-GW

172.16.254.2/30

xfrm2

172.16.254.5/30

xfrm2-GW

172.16.254.6/30

 

Department 2

Network

172.17.0.0/16

VoIP-Subnet

172.17.7.0/24

xfrm1

172.16.254.2/30

xfrm1-GW

172.16.254.1/30

xfrm2

172.16.254.6/30

xfrm2-GW

172.16.254.5/30

 

SD-WAN routing

(All XGs) Current precedence for routing: Static route, VPN route, SD-WAN policy route.
(All XGs) Policy route also applies to system-generated and reply traffic.

 

Department 1

Department 2

Incoming Interface

Any

Any

Src Network

Any

Any

Dst Network

172.17.0.0/16

172.16.0.0/16

Services

Any

Any

Primary GW

xfrm1-GW

xfrm1-GW

Backup GW

xfrm2-GW

xfrm2-GW

 

Static route

 

Department 1

Department 2

Destination IP/Mask

172.17.7.0/24

172.16.7.0/24

GW

172.16.254.2

172.16.254.1

Interface

xfrm1

xfrm1


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to LuCar Toni

    thank you for idea.

    but it was already enabled.

  • 0 in reply to Sophos22

    If you change the Source to ANY and only using the Destination, does the SD-WAN Rule be applied for VOIP? 

    __________________________________________________________________________________________________________________

  • 0 in reply to Sophos22

    So it is actually the same rule like static? That is odd. If you use conntrack -E and check for the connection, you should see the SD-WAN PBR applied. 

    __________________________________________________________________________________________________________________

  • 0 in reply to Sophos22
    Sophos22 said:
    but it was already enabled
    Sophos22 said:
    was already set to any

    same here

  • 0 in reply to LuCar Toni
    LuCar Toni said:
    Can you verify, you have the SD-WAN System generated Switch enabled? 

    console> show routing sd-wan-policy-route reply-packet
    SD-WAN policy route is turned on for reply packets.
    console> show routing sd-wan-policy-route system-generate-traffic
    SD-WAN policy route is turned on for system-generated traffic.
    console>

  • 0 in reply to LuCar Toni
    LuCar Toni said:
    use conntrack -E and check for the connection

    what do you mean? is it a console command? If so i do not find it. 

  • 0 in reply to Max Lange

    Every Connection in Conntrack reflects the SD-WAN, even if it is not applied.

    [UPDATE] proto=tcp proto-no=6 timeout=10 state=CLOSE orig-src=172.25.235.10 orig-dst=192.168.1.5 orig-sport=57196 orig-dport=389 reply-src=192.168.1.5 reply-dst=172.25.235.10 reply-sport=389 reply-dport=57196 [ASSURED] id=3138929965 masterid=0 devin=xfrm1 devout=PortA nseid=16810139 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=8 natid=0 fw_action=1 bwid=0 appid=2974 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=5 outzone=1 devinindex=26 devoutindex=6 hb_src=1 hb_dst=8 flags0=0xa0000200008 flags1=0x10106800000 flagvalues=3,21,41,43,87,89,90,96,104 catid=83 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:0d:3a:22:87:7e src_mac=12:34:56:78:9a:bc startstamp=1653921030 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=11434 current_state[1]=11434 vlan_id=0 inmark=0x0 brinindex=0 sessionid=464 sessionidrev=12567 session_update_rev=13 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid[0]=0 pbrid[1]=0 profileid[0]=0 profileid[1]=0 nhop_id[0]=65535 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 saidx[0]=0 saidx[1]=0 saidx_rev[0]=0 saidx_rev[1]=0 atomic_flags=0x0 conn_fp_id=NOT_OFFLOADED

    Those values (pbrid0 and pbrid1) should be not 0. If there is 0, the SD-WAN rule is not applied. 

    You can use conntrack -E |grep IP_of_device

    This should give you an overview of all connections. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni
    LuCar Toni said:
    You can use conntrack -E |grep IP_of_device

    console> conntrack -E
    % Error: Unknown Parameter 'conntrack'
    console>

  • 0 in reply to Max Lange

    Conntrack is a advanced Shell command. 

    __________________________________________________________________________________________________________________

Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?