SD-WAN

 View Only
last person joined: yesterday 

Ask questions and share experiences with SD-WAN and Session Smart Router (formerly 128T).
  • 1.  Conductor config push issues over firewall

    Posted 03-05-2024 11:17

    We're attempting to onboard a new SSR router to our existing conductor. The SSR router in the remote location is behind a firewall running static NAT, we've opened the appropraite TCP ports as mentioned in the documentation however we're getting errors when pushing the config from the conductor to the SSR. We see the SRR router inital connect in the conductor. When checking the logs we see the following error messages;



    ------------------------------
    Stephen Elias
    SVP
    ------------------------------


  • 2.  RE: Conductor config push issues over firewall

     
    Posted 03-05-2024 11:44

    Hi,

    Onboarding a router that is behind a NAT works absolutely fine and is one of the main use-cases. Following are my onboarding checks that I typically do:

    1. Go to router linux console and run: nc <CONDUCTOR_IP> 930 , example: nc 11.22.33.44 930 -> you should see SSH response back -> then cancel it with Ctrl-C
    2. Go to router linux console and run: nc <CONDUCTOR_IP> 4505 , example: nc 11.22.33.44 4505 -> the socket should be opened and you can type anything -> then cancel it with Ctrl-C

    If those 2 checks pass, on the newly installed router, the success rate is >99% (in my cases). You will need to accept the AssetId in the Conductor GUI and wait 5-10 min after the Commit (that accepts the new Router with new AssetID). Waiting time depends from the router CPU/RAM/SSD resources - faster CPU/RAM/SSD, less time to wait.

    If you want to restart the process from the beginning:

    1. On the Conductor GUI where AsssetID is -> Click Reset (for the AssetID) -> Commit
    2. In the Router linux run: systemctl stop 128T 
    3. In the Router linux run: initialize128t

    I hope you are not using FQDN for Conductor address and you are using IP address.



    ------------------------------
    Ivan Stanev
    ------------------------------



  • 3.  RE: Conductor config push issues over firewall

    Posted 03-05-2024 12:03

    Thanks we tried the NC command and it times out.  The FW team has the 930, 4505, 4506 TCPs port open however I'm suspecting since it's a NextGen stateful FW it needs the actual SSH application open on a non-standard port as well. TCP 930 etc...

    We will try again and update the thread.



    ------------------------------
    Stephen Elias
    SVP
    ------------------------------