This topic provides an example of how to use SD-WAN and ADVPN together.
ADVPN (Auto Discovery VPN) is an IPsec technology that allows a traditional hub-and-spoke VPN’s spokes to establish dynamic, on-demand, direct tunnels between each other to avoid routing through the topology's hub device. The primary advantage is that it provides full meshing capabilities to a standard hub-and-spoke topology. This greatly reduces the provisioning effort for full spoke-to-spoke low delay reachability, and addresses the scalability issues associated with very large fully meshed VPN networks.
If a customer's head office and branch offices all have two or more internet connections, they can build a dual-hub ADVPN network. Combined with SD-WAN technology, the customer can load-balance traffic to other offices on multiple dynamic tunnels, control specific traffic using specific connections, or choose better performance connections dynamically.
|
SD-WAN load-balance mode rules (or services) do not support ADVPN members. Other modes' rules, such as SLA and priority, support ADVPN members. |
This topic covers three parts:
- Configure dual-hub ADVPN with multiple branches.
- Configure BGP to exchange routing information among hubs and spokes.
- Configure SD-WAN on spoke to do load-balancing and control traffic.
Configuration example
A typical ADVPN configuration with SD-WAN usually has two hubs, and each spoke connects to two ISPs and establishes VPN tunnels with both hubs.
This example shows a hub-and-spoke configuration using two hubs and one spoke:
- Hub1 and Hub2 both use wan1 to connect to the ISPs and port10 to connect to internal network.
- Spoke1 uses wan1 to connect to ISP1 and wan2 to connect to ISP2.
- wan1 sets up VPN to hub1.
- wan2 sets up VPN to hub2.
The SD-WAN is configured on the spoke. It uses the two VPN interfaces as members and two rules to control traffic to headquarters or other spokes using ADVPN VPN interfaces. You can create more rules if required.
For this example:
- Use SD-WAN member 1 (via ISP1) and its dynamic shortcuts for financial department traffic if member 1 meets SLA requirements. If it doesn't meet SLA requirements, it will use SD-WAN member 2 (via ISP2).
- Use SD-WAN member 2 (via ISP2) and its dynamic shortcuts for engineering department traffic.
- Load balance other traffic going to hubs and other spokes between these two members.
- Set up all other traffic to go with their original ISP connection. All other traffic does not go through SD-WAN.
- Set up basic network configuration to let all hubs and spokes connect to their ISPs and the Internet.
|
Hub internal network |
172.16.101.0/24 |
|
Spoke1 internal network |
10.1.100.0/24 |
|
ADVPN 1 network |
10.10.100.0/24 |
|
ADVPN 2 network |
10.10.200.0/24 |
|
Hub1 wan1 IP |
11.1.1.11 |
|
Hub2 wan1 IP |
11.1.2.11 |
|
Hub1 VPN IP |
10.10.100.254 |
|
Hub2 VPN IP |
10.10.200.254 |
|
Spoke1 to hub1 VPN IP |
10.10.100.2 |
|
Spoke1 to hub2 VPN IP |
10.10.200.2 |
|
Ping server in Headquarters |
11.11.11.11 |
|
Internal subnet of spoke1 |
22.1.1.0/24 |
|
Internal subnet of spoke2 |
33.1.1.0/24 |
|
Firewall addresses |
Configure hub_subnets and spoke_subnets before using in policies. These can be customized. |
The GUI does not support some ADVPN related options, such as auto-discovery-sender, auto-discovery-receiver, auto-discovery-forwarder, and IBGP neighbor-group setting, so this example only provides CLI configuration commands.
Hub1 sample configuration
To configure the IPsec phase1 and phase2 interface:
config vpn ipsec phase1-interface
edit "hub-phase1"
set type dynamic
set interface "wan1"
set peertype any
set net-device disable
set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1
set add-route disable
set dpd on-idle
set auto-discovery-sender enable
set tunnel-search nexthop
set psksecret sample
set dpd-retryinterval 5
next
end
config vpn ipsec phase2-interface
edit "hub-phase2"
set phase1name "hub-phase1"
set proposal aes128-sha1 aes256-sha1 3des-sha1 aes128-sha256 aes256-sha256 3des-sha256
next
end
To configure the VPN interface and BGP:
config system interface
edit "hub-phase1"
set ip 10.10.100.254 255.255.255.255
set remote-ip 10.10.100.253 255.255.255.0
next
end
config router bgp
set as 65505
config neighbor-group
edit "advpn"
set link-down-failover enable
set remote-as 65505
set route-reflector-client enable
next
end
config neighbor-range
edit 1
set prefix 10.10.100.0 255.255.255.0
set neighbor-group "advpn"
next
end
config network
edit 1
set prefix 172.16.101.0 255.255.255.0
next
edit 2
set prefix 11.11.11.0 255.255.255.0
next
end
end
To configure the firewall policy:
config firewall policy
edit 1
set name "spoke2hub"
set srcintf "hub-phase1"
set dstintf "port10"
set srcaddr "spoke_subnets"
set dstaddr "hub_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow traffic from spokes to headquater"
next
edit 2
set name "spoke2spoke"
set srcintf "hub-phase1"
set dstintf "hub-phase1"
set srcaddr "spoke_subnets"
set dstaddr "spoke_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow traffic from spokes to spokes"
next
edit 3
set name "internal2spoke"
set srcintf "port10"
set dstintf "hub-phase1"
set srcaddr "hub_subnets"
set dstaddr "spoke_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow traffic from headquater to spokes"
next
end
Hub2 sample configuration
Hub2 configuration is the same as hub1 except the wan1 IP address, VPN interface IP address, and BGP neighbor-range prefix.
To configure the IPsec phase1 and phase2 interface:
config vpn ipsec phase1-interface
edit "hub-phase1"
set type dynamic
set interface "wan1"
set peertype any
set net-device disable
set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1
set add-route disable
set dpd on-idle
set auto-discovery-sender enable
set tunnel-search nexthop
set psksecret sample
set dpd-retryinterval 5
next
end
config vpn ipsec phase2-interface
edit "hub-phase2"
set phase1name "hub-phase1"
set proposal aes128-sha1 aes256-sha1 3des-sha1 aes128-sha256 aes256-sha256 3des-sha256
next
end
To configure the VPN interface and BGP:
config system interface
edit "hub-phase1"
set ip 10.10.200.254 255.255.255.255
set remote-ip 10.10.200.253 255.255.255.0
next
end
config router bgp
set as 65505
config neighbor-group
edit "advpn"
set link-down-failover enable
set remote-as 65505
set route-reflector-client enable
next
end
config neighbor-range
edit 1
set prefix 10.10.200.0 255.255.255.0
set neighbor-group "advpn"
next
end
config network
edit 1
set prefix 172.16.101.0 255.255.255.0
next
edit 2
set prefix 11.11.11.0 255.255.255.0
next
end
end
To configure the firewall policy:
config firewall policy
edit 1
set name "spoke2hub"
set srcintf "hub-phase1"
set dstintf "port10"
set srcaddr "spoke_subnets"
set dstaddr "hub_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow traffic from spokes to headquater"
next
edit 2
set name "spoke2spoke"
set srcintf "hub-phase1"
set dstintf "hub-phase1"
set srcaddr "spoke_subnets"
set dstaddr "spoke_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow traffic from spokes to spokes"
next
edit 3
set name "internal2spoke"
set srcintf "port10"
set dstintf "hub-phase1"
set srcaddr "hub_subnets"
set dstaddr "spoke_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow traffic from headquater to spokes"
next
end
Spoke1 sample configuration
To configure the IPsec phase1 and phase2 interface:
config vpn ipsec phase1-interface
edit "spoke1-phase1"
set interface "wan1"
set peertype any
set net-device enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set add-route disable
set dpd on-idle
set auto-discovery-receiver enable
set remote-gw 11.1.1.11
set psksecret sample
set dpd-retryinterval 5
next
edit "spoke1-2-phase1"
set interface "wan2"
set peertype any
set net-device enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set add-route disable
set dpd on-idle
set auto-discovery-receiver enable
set remote-gw 11.1.2.11
set psksecret sample
set dpd-retryinterval 5
next
end
config vpn ipsec phase2-interface
edit "spoke1-phase2"
set phase1name "spoke1-phase1"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
edit "spoke1-2-phase2"
set phase1name "spoke1-2-phase1"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
end
To configure the VPN interface and BGP:
config system interface
edit "spoke1-phase1"
set ip 10.10.100.2 255.255.255.255
set remote-ip 10.10.100.254 255.255.255.0
next
edit "spoke1-2-phase1"
set ip 10.10.200.2 255.255.255.255
set remote-ip 10.10.200.254 255.255.255.0
next
end
config router bgp
set as 65505
config neighbor
edit "10.10.100.254"
set advertisement-interval 1
set link-down-failover enable
set remote-as 65505
next
edit "10.10.200.254"
set advertisement-interval 1
set link-down-failover enable
set remote-as 65505
next
end
config network
edit 1
set prefix 10.1.100.0 255.255.255.0
next
end
end
To configure SD-WAN:
config system sdwan
set status enable
config members
edit 1
set interface "spoke1-phase1"
next
edit 2
set interface "spoke1-2-phase1"
next
end
config health-check
edit "ping"
set server "11.11.11.11"
set members 1 2
config sla
edit 1
set latency-threshold 200
set jitter-threshold 50
set packetloss-threshold 5
next
end
next
end
config service
edit 1
set mode sla
set dst "finacial-department"
config sla
edit "ping"
set id 1
next
end
set priority-member 1 2
next
edit 2
set member 2
set dst "engineering-department"
next
end
end
|
|
If no SD-WAN zone is specified, members are added to the default virtual-wan-link zone. |
To configure the firewall policy:
config firewall policy
edit 1
set name "outbound_advpn"
set srcintf "internal"
set dstintf "virtual-wan-link"
set srcaddr "spoke_subnets"
set dstaddr "spoke_subnets" "hub_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow internal traffic going out to headquater and other spokes"
next
edit 2
set name "inbound_advpn"
set srcintf "virtual-wan-link"
set dstintf "internal"
set srcaddr "spoke_subnets" "hub_subnets"
set dstaddr "spoke_subnets"
set action accept
set schedule "always"
set service "ALL"
set comments "allow headquater and other spokes traffic coming in"
next
end
Troubleshooting ADVPN and shortcut paths
Before spoke vs spoke shortcut VPN is established
Use the following CLI commands to check status before spoke vs spoke shortcut VPN is established.
# get router info bgp summary BGP router identifier 2.2.2.2, local AS number 65505 BGP table version is 13 3 BGP AS-PATH entries 0 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.10.100.254 4 65505 3286 3270 11 0 0 00:02:15 5 10.10.200.254 4 65505 3365 3319 12 0 0 00:02:14 5 Total number of neighbors 2
# get router info routing-table bgp
Routing table for VRF=0
B* 0.0.0.0/0 [200/0] via 10.10.200.254, spoke1-2-phase1, 00:00:58
[200/0] via 10.10.100.254, spoke1-phase1, 00:00:58
B 1.1.1.1/32 [200/0] via 11.1.1.1 (recursive via 12.1.1.1), 00:01:29
[200/0] via 11.1.1.1 (recursive via 12.1.1.1), 00:01:29
B 11.11.11.0/24 [200/0] via 10.10.200.254, spoke1-2-phase1, 00:01:29
[200/0] via 10.10.100.254, spoke1-phase1, 00:01:29
B 33.1.1.0/24 [200/0] via 10.10.200.3, spoke1-2-phase1, 00:00:58
[200/0] via 10.10.100.3, spoke1-phase1, 00:00:58
[200/0] via 10.10.200.3, spoke1-2-phase1, 00:00:58
[200/0] via 10.10.100.3, spoke1-phase1, 00:00:58# diagnose vpn tunnel list
list all ipsec tunnel in vd 3
------------------------------------------------------
name=spoke1-phase1 ver=1 serial=5 12.1.1.2:0->11.1.1.11:0 dst_mtu=15324
bound_if=48 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/536 options[0218]=npu create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=0 refcnt=22 ilast=0 olast=0 ad=r/2
stat: rxp=1 txp=185 rxb=16428 txb=11111
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=4
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=spoke1 proto=0 sa=1 ref=4 serial=1 auto-negotiate adr
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA: ref=6 options=1a227 type=00 soft=0 mtu=15262 expire=42820/0B replaywin=2048
seqno=ba esn=0 replaywin_lastseq=00000002 itn=0 qat=0
life: type=01 bytes=0/0 timeout=42903/43200
dec: spi=03e01a2a esp=aes key=16 56e673f0df05186aa657f55cbb631c13
ah=sha1 key=20 b0d50597d9bed763c42469461b03da8041f87e88
enc: spi=2ead61bc esp=aes key=16 fe0ccd4a3ec19fe6d520c437eb6b8897
ah=sha1 key=20 e3e669bd6df41b88eadaacba66463706f26fb53a
dec:pkts/bytes=1/16368, enc:pkts/bytes=185/22360
npu_flag=03 npu_rgwy=11.1.1.11 npu_lgwy=12.1.1.2 npu_selid=0 dec_npuid=1 enc_npuid=1
------------------------------------------------------
name=spoke1-2-phase1 ver=1 serial=6 112.1.1.2:0->11.1.2.11:0 dst_mtu=15324
bound_if=90 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/536 options[0218]=npu create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=0 refcnt=21 ilast=0 olast=0 ad=r/2
stat: rxp=1 txp=186 rxb=16498 txb=11163
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=74
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=spoke1-2 proto=0 sa=1 ref=4 serial=1 auto-negotiate adr
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA: ref=6 options=1a227 type=00 soft=0 mtu=15262 expire=42818/0B replaywin=2048
seqno=bb esn=0 replaywin_lastseq=00000002 itn=0 qat=0
life: type=01 bytes=0/0 timeout=42901/43200
dec: spi=03e01a2b esp=aes key=16 fe49f5042a5ad236250bf53312db1346
ah=sha1 key=20 5dbb15c8cbc046c284bb1c6425dac2b3e15bec85
enc: spi=2ead61bd esp=aes key=16 d6d97be52c3cccb9e88f28a9db64ac46
ah=sha1 key=20 e20916ae6ea2295c2fbd5cbc8b8f5dd8b17f52f1
dec:pkts/bytes=1/16438, enc:pkts/bytes=186/22480
npu_flag=03 npu_rgwy=11.1.2.11 npu_lgwy=112.1.1.2 npu_selid=1 dec_npuid=1 enc_npuid=1
# diagnose sys sdwan service
Service(1): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(sla)
Member sub interface:
Members:
1: Seq_num(1), alive, sla(0x1), cfg_order(0), cost(0), selected
2: Seq_num(2), alive, sla(0x1), cfg_order(1), cost(0), selected
Dst address: 33.1.1.1-33.1.1.100
Service(2): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(manual)
Member sub interface:
Members:
1: Seq_num(2), alive, selected
Dst address: 33.1.1.101-33.1.1.200# diagnose firewall proute list list route policy info(vf=vd2): id=2132869121 vwl_service=1 vwl_mbr_seq=1 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0:65535 iif=0 dport=1-65535 oif=70 oif=71 destination(1): 33.1.1.1-33.1.1.100 source wildcard(1): 0.0.0.0/0.0.0.0 id=2132869122 vwl_service=2 vwl_mbr_seq=2 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0:65535 iif=0 dport=1-65535 oif=71 destination(1): 33.1.1.101-33.1.1.200 source wildcard(1): 0.0.0.0/0.0.0.0
After spoke vs spoke shortcut VPN is established
Use the following CLI commands to check status after spoke vs spoke shortcut VPN is established.
# get router info routing-table bgp
Routing table for VRF=0
B* 0.0.0.0/0 [200/0] via 10.10.200.254, spoke1-2-phase1, 00:01:33
[200/0] via 10.10.100.254, spoke1-phase1, 00:01:33
B 1.1.1.1/32 [200/0] via 11.1.1.1 (recursive via 12.1.1.1), 00:02:04
[200/0] via 11.1.1.1 (recursive via 12.1.1.1), 00:02:04
B 11.11.11.0/24 [200/0] via 10.10.200.254, spoke1-2-phase1, 00:02:04
[200/0] via 10.10.100.254, spoke1-phase1, 00:02:04
B 33.1.1.0/24 [200/0] via 10.10.200.3, spoke1-2-phase1_0, 00:01:33
[200/0] via 10.10.100.3, spoke1-phase1_0, 00:01:33
[200/0] via 10.10.200.3, spoke1-2-phase1_0, 00:01:33
[200/0] via 10.10.100.3, spoke1-phase1_0, 00:01:33# diagnose sys sdwan service
Service(1): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(sla)
Member sub interface:
1: seq_num(1), interface(spoke1-phase1):
1: spoke1-phase1_0(111)
2: seq_num(2), interface(spoke1-2-phase1):
1: spoke1-2-phase1_0(113)
Members:
1: Seq_num(1), alive, sla(0x1), cfg_order(0), cost(0), selected
2: Seq_num(2), alive, sla(0x1), cfg_order(1), cost(0), selected
Dst address: 33.1.1.1-33.1.1.100
Service(2): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(manual)
Member sub interface:
1: seq_num(2), interface(spoke1-2-phase1):
1: spoke1-2-phase1_0(113)
Members:
1: Seq_num(2), alive, selected
Dst address: 33.1.1.101-33.1.1.200# diagnose vpn tunnel list
list all ipsec tunnel in vd 3
------------------------------------------------------
name=spoke1-phase1 ver=1 serial=5 12.1.1.2:0->11.1.1.11:0 dst_mtu=15324
bound_if=48 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/536 options[0218]=npu create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=1 refcnt=20 ilast=0 olast=0 ad=r/2
stat: rxp=1 txp=759 rxb=16428 txb=48627
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=4
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=vd2-1 proto=0 sa=1 ref=5 serial=1 auto-negotiate adr
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA: ref=6 options=1a227 type=00 soft=0 mtu=15262 expire=42536/0B replaywin=2048
seqno=2f8 esn=0 replaywin_lastseq=00000002 itn=0 qat=0
life: type=01 bytes=0/0 timeout=42898/43200
dec: spi=03e01a42 esp=aes key=16 1f131bda108d33909d49fc2778bd08bb
ah=sha1 key=20 14131d3f0da9b741a2fd13d530b0553aa1f58983
enc: spi=2ead61d8 esp=aes key=16 81ed24d5cd7bb59f4a80dceb5a560e1f
ah=sha1 key=20 d2ccc2f3223ce16514e75f672cd88c4b4f48b681
dec:pkts/bytes=1/16360, enc:pkts/bytes=759/94434
npu_flag=03 npu_rgwy=11.1.1.11 npu_lgwy=12.1.1.2 npu_selid=0 dec_npuid=1 enc_npuid=1
------------------------------------------------------
name=spoke1-2-phase1 ver=1 serial=6 112.1.1.2:0->11.1.2.11:0 dst_mtu=15324
bound_if=90 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/536 options[0218]=npu create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=1 refcnt=19 ilast=0 olast=0 ad=r/2
stat: rxp=1 txp=756 rxb=16450 txb=48460
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=74
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=vd2-2 proto=0 sa=1 ref=5 serial=1 auto-negotiate adr
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA: ref=6 options=1a227 type=00 soft=0 mtu=15262 expire=42538/0B replaywin=2048
seqno=2f5 esn=0 replaywin_lastseq=00000002 itn=0 qat=0
life: type=01 bytes=0/0 timeout=42900/43200
dec: spi=03e01a43 esp=aes key=16 7fc87561369f88b56d08bfda769eb45b
ah=sha1 key=20 0ed554ef231c5ac16dc2e71d1907d7347dda33d6
enc: spi=2ead61d9 esp=aes key=16 00286687aa1762e7d8216881d6720ef3
ah=sha1 key=20 59d5eec6299ebcf038c190860774e2833074d7c3
dec:pkts/bytes=1/16382, enc:pkts/bytes=756/94058
npu_flag=03 npu_rgwy=11.1.2.11 npu_lgwy=112.1.1.2 npu_selid=1 dec_npuid=1 enc_npuid=1
------------------------------------------------------
name=spoke1-phase1_0 ver=1 serial=55 12.1.1.2:0->13.1.1.3:0 dst_mtu=15324
bound_if=48 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/728 options[02d8]=npu create_dev no-sysctl rgwy-chg frag-rfc accept_traffic=1
parent=vd2-1 index=0
proxyid_num=1 child_num=0 refcnt=18 ilast=8 olast=8 ad=r/2
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=vd2-1 proto=0 sa=1 ref=2 serial=1 auto-negotiate adr
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA: ref=3 options=1a227 type=00 soft=0 mtu=15262 expire=42893/0B replaywin=2048
seqno=1 esn=0 replaywin_lastseq=00000000 itn=0 qat=0
life: type=01 bytes=0/0 timeout=42901/43200
dec: spi=03e01a44 esp=aes key=16 c3b77a98e3002220e2373b73af14df6e
ah=sha1 key=20 d18d107c248564933874f60999d6082fd7a78948
enc: spi=864f6dba esp=aes key=16 eb6181806ccb9bac37931f9eadd4d5eb
ah=sha1 key=20 ab788f7a372877a5603c4ede1be89a592fc21873
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
npu_flag=00 npu_rgwy=13.1.1.3 npu_lgwy=12.1.1.2 npu_selid=51 dec_npuid=0 enc_npuid=0
------------------------------------------------------
name=spoke1-2-phase1_0 ver=1 serial=57 112.1.1.2:0->113.1.1.3:0 dst_mtu=15324
bound_if=90 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/728 options[02d8]=npu create_dev no-sysctl rgwy-chg frag-rfc accept_traffic=1
parent=vd2-2 index=0
proxyid_num=1 child_num=0 refcnt=17 ilast=5 olast=5 ad=r/2
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=vd2-2 proto=0 sa=1 ref=3 serial=1 auto-negotiate adr
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA: ref=3 options=1a227 type=00 soft=0 mtu=15262 expire=42900/0B replaywin=2048
seqno=1 esn=0 replaywin_lastseq=00000000 itn=0 qat=0
life: type=01 bytes=0/0 timeout=42901/43200
dec: spi=03e01a45 esp=aes key=16 0beb519ed9f800e8b4c0aa4e1df7da35
ah=sha1 key=20 bc9f38db5296cce4208a69f1cc8a9f7ef4803c37
enc: spi=864f6dbb esp=aes key=16 1d26e3556afcdb9f8e3e33b563b44228
ah=sha1 key=20 564d05ef6f7437e1fd0a88d5fee7b6567f9d387e
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
npu_flag=00 npu_rgwy=113.1.1.3 npu_lgwy=112.1.1.2 npu_selid=53 dec_npuid=0 enc_npuid=0
# diagnose firewall proute list list route policy info(vf=vd2): id=2132869121 vwl_service=1 vwl_mbr_seq=1 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0:65535 iif=0 dport=1-65535 oif=111 oif=70 oif=113 oif=71 destination(1): 33.1.1.1-33.1.1.100 source wildcard(1): 0.0.0.0/0.0.0.0 id=2132869122 vwl_service=2 vwl_mbr_seq=2 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0:65535 iif=0 dport=1-65535 oif=113 oif=71 destination(1): 33.1.1.101-33.1.1.200 source wildcard(1): 0.0.0.0/0.0.0.0