[Help] SD-WAN with BGP on Loopback Issues – Packets Dropped on Hub Side

[errore_maximus]

Hi everyone,

I'm at my wit's end trying to configure SD-WAN with BGP on loopback with segmentation over a single overlay (no ADVPN). Here's the situation:

Problem:

• Hub and Spoke tunnel connectivity is established.
• Pinging from Spoke's loopback to Hub's loopback fails (packets are dropped on the Hub side).
• Pinging from Hub's loopback to Spoke's loopback works fine.

I’ve triple-checked the following:

• Firewall policies. (overlay -> Loopback: any any)
• Local-in policies.
• Routing.
• Interface configurations.

The Hub's local traffic log shows the packets arriving, but there are no replies.

Application Control

Application Name	BGP
Protocol	6
Service	BGP

Data

Received Bytes	0 B
Received Packets	0
Sent Bytes	0 B
Sent Packets	0
VPN Type	ipsecvpn
Message	Connection Failed

Action

Action	deny
Threat	262,144
Policy Type	Firewall

Packet Sniffer:
Confirms the packets are entering the Hub but vanishing with no response.

Configuration Details:

Here’s the relevant config for both Hub and Spoke:

## Hub ##

config system interface

edit "Loopback-HC"

set type loopback

set vrf 1

set ip 10.10.11.254/32

set allowaccess ping

next

edit "Loopback0"

set type loopback

set vrf 1

set ip 10.10.98.1/32

set allowaccess ping

next

end

config vpn ipsec phase1-interface

edit "EDGE_MPLS_0"

set type dynamic

set interface "vlan_10-sdwan-gw"

set ike-version 2

set peertype dialup

set usrgrp "usrgrp-mpls"

set proposal aes256gcm-prfsha256 aes256-sha256

set encapsulation vpn-id-ipip

set exchange-interface-ip enable

set exchange-ip-addr4 10.10.98.1

set add-route disable

set network-overlay enable

set network-id 53

set dpd-retrycount 2

set dpd-retryinterval 5

set dpd on-idle

next

end

config vpn ipsec phase2-interface

edit "EDGE_MPLS_0"

set phase1name "EDGE_MPLS_0"

set proposal aes256gcm

set keepalive enable

next

end

config system interface

edit "EDGE_MPLS_0"

set vrf 1

next

end

## SPOKE ##

config system interface

edit "Loopback0"

set type loopback

set vrf 1

set ip 10.10.98.10/32

set allowaccess ping

next

end

config vpn ipsec phase1-interface

edit "H1_MPLS1"

set interface "port1"

set ike-version 2

set localid "usr-test-mpls"

set psksecret Secret

set keylife 28800

set peertype any

set net-device enable

set proposal aes256gcm-prfsha256 aes256-sha256

set idle-timeout enable

set encapsulation vpn-id-ipip

set exchange-interface-ip enable

set exchange-ip-addr4 10.10.98.10

set network-overlay enable

set network-id 53

set remote-gw 10.10.90.10

set dpd-retrycount 3

set dpd-retryinterval 5

set dpd on-idle

next

end

config vpn ipsec phase2-interface

edit "H1_MPLS1"

set phase1name "H1_MPLS1"

set proposal aes256gcm

set keepalive enable

set keylifeseconds 3600

next

end

config system interface

edit "H1_MPLS1"

set vrf 1

next

end

Any insights into what might be causing this behavior? I’ve been staring at the config for hours and can't pinpoint the issue.

Thanks in advance!

[funkylicious]

Have you tried running a debug flow ?

diag debug enable
diag debug flow filter addr X.X.X.X <----- IP address of interesting traffic.
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 100 <----- This will display 100 packets for this flow.
diag debug enable

to stop:

diag debug disable

[errore_maximus]

Hey @funkylicious ,

yes I did, but I cant really read it except policy=0 - I made a fresh debug output:

2024-11-16 09:10:41 id=65308 trace_id=364 func=print_pkt_detail line=5920 msg="vd-SDWAN-VDOM:1 received a packet(proto=6, 10.10.98.10:13436->10.10.98.1:179) tun_id=10.10.98.10 from EDGE_MPLS_0. flag [S], seq 2498956494, ack 0, win 65535"
2024-11-16 09:10:41 id=65308 trace_id=364 func=ipsec_spoofed4 line=243 msg="src ip 10.10.98.10 match selector 0 range 0.0.0.0-255.255.255.255"
2024-11-16 09:10:41 id=65308 trace_id=364 func=init_ip_session_common line=6110 msg="allocate a new session-007efa5c"
2024-11-16 09:10:41 id=65308 trace_id=364 func=iprope_dnat_check line=5480 msg="in-[EDGE_MPLS_0], out-[]"
2024-11-16 09:10:41 id=65308 trace_id=364 func=iprope_dnat_tree_check line=824 msg="len=0"
2024-11-16 09:10:41 id=65308 trace_id=364 func=iprope_dnat_check line=5505 msg="result: skb_flags-02000008, vid-0, ret-no-match, act-accept, flag-00000000"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=80000000 gw-0.0.0.0 via SDWAN-VDOM"
2024-11-16 09:10:41 id=65308 trace_id=364 func=iprope_access_proxy_check line=458 msg="in-[EDGE_MPLS_0], out-[], skb_flags-02000008, vid-0"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_check line=2404 msg="gnum-100017, check-ffffffffa002c2e0"
2024-11-16 09:10:41 id=65308 trace_id=364 func=iprope_policy_group_check line=4902 msg="after check: ret-no-match, act-accept, flag-00000000, flag2-00000000"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_fwd_check line=810 msg="in-[EDGE_MPLS_0], out-[Loopback0], skb_flags-02000008, vid-0, app_id: 0, url_cat_id: 0"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=99, len=1"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_user_identity_check line=1903 msg="ret-matched"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_check_one_policy line=2374 msg="policy-0 is matched, act-drop"
2024-11-16 09:10:41 id=65308 trace_id=364 func=__iprope_fwd_check line=847 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-11-16 09:10:41 id=65308 trace_id=364 func=fw_local_in_handler line=620 msg="iprope_in_check() check failed on policy 0, drop"

[funkylicious]

Well, do you have a firewall rule srcintf:IPsec interface(EDGE_MPLS_0) and dstintf:Loopback(Loopback0) ?

[errore_maximus]

Yes a firewall policy exists. But for srcintf: overlay (sdwan zone where EDGE_MPLS_0 is member) and dstintf: Loopback0

[errore_maximus]

Now its working. I made an srcintf: any to dstintf: any policy. But why does the overlay zone dont work?!