SD-WAN

Just upgraded to 3.2.1, which has the following listed in the release note:

I95-14820 The 128T now has a signaled mechanism for establishing inbound flows to systems behind firewalled or LTE environments. 

I've got a router (r2) deployed behind a NAT device that isn't explicitly configured to forward any ports to the router. It peers with another router (r1). Prior to upgrading, peering and sessions from r2 -> r1 was working fine (and still works after upgrading to 3.2.1). However I tried adding a service which routes from r1 -> r2 inbound through the NAT, and it does not appear to be making it through. 

Any details on what is needed to make this feature work?

 

Aha, figured it out. On the r2 router interface that was deployed behind the NAT, I needed to set the ""Peer Connectivity"" to ""outbound-only"" in the neighborhood config.

 

 

After setting this in the neighborhood on r2, the setting was reflected on in the adjacency config in r1, and inbound sessions worked through the NAT.

 

Handy feature!!

 

Just tried this functionality on an LTE interface that was operating through a carrier NAT. Worked like a charm!

Thanks, Reid, I was wondering about the purpose of the Peer Connectivity setting. I should point out that the change in Neighborhood from bidirectional to outbound-only doesn't seem to be inherited in the auto-generated Adjacency under it. The only way to affect it is to set adjacency auto-gen=FALSE, and set the Peer Connectivity option manually to outbound-only.

Gene, it should absolutely get propagated... but perhaps not as you're expecting. When you set it on the neighborhood in r2, it gets set in the adjacency on r1. (This is where it's actually relevant. The router r1 -- in Reid's example -- needs to know that r2 is outbound only.)

 

Can you double check to make sure your configuration is getting generated as described here?

Patrick A Timmons I just tested out the behavior you described, and indeed that's exactly what I've obseved. Thanks for the clarification.

Great, thanks for checking!