VoIP communication problems over SD-WAN and IPsec-Interfaces

Hi,

So I got called back and we could fix this problem. In my case the routing precedence needed to be set to 1. Static, 2. SD-WAN policy routes, 3. VPN routes

I was not aware that point 3 (VPN routes) affect Tunnel interfaces. After changing it, the conntrack shows that the right rule was applied, but routed to the WAN-interface instead of the xfrm. Disable the sip system module fixed this. Thanks Wayne Folta and LuCar Toni!

So VoIP is working now, I will test our other affected services tomorrow and will let you know if it works or not.

Hi,

just tested Radius and this is weird, it works for all but for one XG.

If I use the “Test connection” button it works, but if a client wants to connect to Wi-Fi the traffic is routed to the WAN interface instead of the xfrm, but pbrid_dir0 shows the right rule. If I use a static route for the Radius server it works fine.

Next I set up a Radius server in the department, so I do not need to route the traffic, but this is weird too: a tcpdump shows that the request is given to the server, but the request is not shown in the server log. But again, if I use the “Test connection” button it works.

Hi,

I will open a new discussion for the RADIUS problem. Thanks to all of you!

Hi,

I will open a new discussion for the RADIUS problem. Thanks to all of you!

Just for transparency: There seems to be a logging issue with conntrack right now. So if the correct route is used but pbrid_dir shows still 0, it could be related to a logging issue, which is under investigation. 

It shows rule 4 is used (pbrid_dir0=4). Rule 4 should route to xfrm1 but instead it is routet to Port2 (WAN interface). system-generated traffic routing is enabled.

This could mean, another rule is taking precedence. VPN or static.

What is the route precedence? Check for the routes like route -n or ip r g radius_server 

Then verify, if there is another route. 

Because pbrid is always filled, even if static/VPN is being used. 

the precedence is static, sd-wan, vpn. There are no other routes to the server. 

So a ip r g Server_IP shows WAN? Because ip and route commands do not honor SD-WAN routes. This means, this should resolve to WAN. 

Yes, it shows Port2 WAN interface. So the XG ignores the config for system-generated traffic?

console> show routing sd-wan-policy-route system-generate-traffic
SD-WAN policy route is turned on for system-generated traffic.

Do you have a NAT Rule configured for this Server? Eventually this could cause this issue. 

no

Then you should consult support to get this debugged. 

I'm on holiday for 3 weeks after that I will open a case. Thanks again!