Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 40 replies
  • Subscribers 31 subscribers
  • Views 2751 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VoIP communication problems over SD-WAN and IPsec-Interfaces

Max Lange

Hi,

We have several departments and connect them via IPsec “Tunnel Interfaces”. For each interface we set up a Gateway and configured a SD-WAN policy.

This works for the most Services, but not for VoIP and Radius. The traffic is logged as allowed in the src, but never appears in the dst. We created a static route for the VoIP-Network to get it working. But this static route cannot be the solution, as it negates the sense of SD-WAN routing.

Our configuration:

Department 1

Network

172.16.0.0/16

VoIP-Subnet

172.16.7.0/24

xfrm1

172.16.254.1/30

xfrm1-GW

172.16.254.2/30

xfrm2

172.16.254.5/30

xfrm2-GW

172.16.254.6/30

 

Department 2

Network

172.17.0.0/16

VoIP-Subnet

172.17.7.0/24

xfrm1

172.16.254.2/30

xfrm1-GW

172.16.254.1/30

xfrm2

172.16.254.6/30

xfrm2-GW

172.16.254.5/30

 

SD-WAN routing

(All XGs) Current precedence for routing: Static route, VPN route, SD-WAN policy route.
(All XGs) Policy route also applies to system-generated and reply traffic.

 

Department 1

Department 2

Incoming Interface

Any

Any

Src Network

Any

Any

Dst Network

172.17.0.0/16

172.16.0.0/16

Services

Any

Any

Primary GW

xfrm1-GW

xfrm1-GW

Backup GW

xfrm2-GW

xfrm2-GW

 

Static route

 

Department 1

Department 2

Destination IP/Mask

172.17.7.0/24

172.16.7.0/24

GW

172.16.254.2

172.16.254.1

Interface

xfrm1

xfrm1


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Max Lange

    Every Connection in Conntrack reflects the SD-WAN, even if it is not applied.

    [UPDATE] proto=tcp proto-no=6 timeout=10 state=CLOSE orig-src=172.25.235.10 orig-dst=192.168.1.5 orig-sport=57196 orig-dport=389 reply-src=192.168.1.5 reply-dst=172.25.235.10 reply-sport=389 reply-dport=57196 [ASSURED] id=3138929965 masterid=0 devin=xfrm1 devout=PortA nseid=16810139 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=8 natid=0 fw_action=1 bwid=0 appid=2974 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=5 outzone=1 devinindex=26 devoutindex=6 hb_src=1 hb_dst=8 flags0=0xa0000200008 flags1=0x10106800000 flagvalues=3,21,41,43,87,89,90,96,104 catid=83 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:0d:3a:22:87:7e src_mac=12:34:56:78:9a:bc startstamp=1653921030 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=11434 current_state[1]=11434 vlan_id=0 inmark=0x0 brinindex=0 sessionid=464 sessionidrev=12567 session_update_rev=13 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid[0]=0 pbrid[1]=0 profileid[0]=0 profileid[1]=0 nhop_id[0]=65535 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 saidx[0]=0 saidx[1]=0 saidx_rev[0]=0 saidx_rev[1]=0 atomic_flags=0x0 conn_fp_id=NOT_OFFLOADED

    Those values (pbrid0 and pbrid1) should be not 0. If there is 0, the SD-WAN rule is not applied. 

    You can use conntrack -E |grep IP_of_device

    This should give you an overview of all connections. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni
    LuCar Toni said:
    You can use conntrack -E |grep IP_of_device

    console> conntrack -E
    % Error: Unknown Parameter 'conntrack'
    console>

  • 0 in reply to Max Lange

    Conntrack is a advanced Shell command. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    OK

    LuCar Toni said:
    pbrid0 and pbrid1

    This doesn't show up. I only have those:

    pbrid_dir0=4 pbrid_dir1=0

    [UPDATE] proto=tcp      proto-no=6 timeout=10 state=CLOSE orig-src=10.56.166.5 orig-dst=172.30.3.100 orig-sport=64125 orig-dport=5432 reply-src=172.30.3.100 reply-dst=10.56.166.5 reply-sport=5432 reply-dport=64125 [ASSURED] mark=0x4007 id=2260928384 masterid=0 devin=LANuDMZ.2 devout=xfrm3 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=72 natid=0 fw_action=1 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=1 outzone=1 devinindex=42 devoutindex=46 hb_src=0 hb_dst=0 flags0=0x400a2800200000 flags1=0x10000000000 flagvalues=21,35,37,41,43,54,104 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:1a:8c:5f:72:00 src_mac=00:50:56:82:7c:98 startstamp=1653926568 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=46 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=13245 current_state[1]=13245 vlan_id=0 inmark=0x0 brinindex=43 sessionid=1191 sessionidrev=17158 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=4 pbrid_dir1=0 nhop_id[0]=65535 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED

  • 0 in reply to Max Lange

    This indicates, it will use SD-WAN rule 4. Which rule is 4 in your setup? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni
    Source Any
    Destination 172.30.0.0/16
    Service Any
  • 0 in reply to Max Lange

    This rule is not being used, as you say? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    As I sad the most things work, but not Radius or VoIP. If I create a static route it works.

  • 0 in reply to Max Lange

    Check the Conntrack for this particular traffic and verify. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I will test this this weekend.

Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?