Describes the process by which devices try different ports when establishing connections in an overlay network.
Port hopping is a connection establishment process that
-
enables devices to try different ports when attempting to establish connections with each other if the first port fails, and
-
rotates through a total of five base ports with increasing wait times between connection attempts.
After a failure, the port value is incremented and the connection attempt is retried.
Port hopping operation
In the context of a Cisco Catalyst SD-WAN overlay network, the software rotates though a total of five base ports, waiting longer and longer between each connection attempt.
Default port configuration:
-
If you have not configured a port offset, the default base port is 12346, and port hopping is done sequentially among ports 12346, 12366, 12386, 12406, and 12426, and then returning to port 12346.
-
If you have configured a port offset, that initial port value is used and the next port is incremented by 20. For example, for a port configured with an offset of 2, port hopping is done sequentially among ports 12348, 12368, 12388, 12408, and 12428, and then returning to port 12348.
Incrementing the ports by 20 ensures that there is never any overlap among the possible base port numbers.
Device behavior with port hopping:
-
Cisco vEdge devices use port hopping when attempting to establish connections to Cisco SD-WAN Manager, Cisco SD-WAN Validator, and Cisco SD-WAN Controllers. You can also manually request a Cisco vEdge device to port-hop.
-
Cisco SD-WAN Controllers and Cisco SD-WAN Manager instances are normally installed behind a properly behaving NAT device, so port hopping is generally not needed and generally does not occur on these devices.
-
Cisco SD-WAN Validators always connect to other Cisco vEdge devices using port 12346. They never use port hopping.
If the first connection attempt on the initial base port does not succeed after about 1 minute, the router hops to port 12366. After about 2 minutes, it hops to port 12386; after about 5 minutes, it hops to port 12406; and after about 6 minutes, it hops to port 12426. Then the cycle returns to initial port, 12346.
With a full-cone NAT device, the source ports for all connections initiated by a given Cisco vEdge device remain consistent across all sessions initiated by the Cisco vEdge device. For example, if the router initiates a session with public source port 12346, this is the port used for all communication.
As port-hop is the default configuration, the devices request the Cisco SD-WAN Validator for a new control connection. When the new control connection is established, the edge devices start transmitting TLOC updates to the peer. TLOC update messages could be lost during unstable control connections and IPSec security association between the devices and the peer may not be in sync, which results in a BFD session failure.
To avoid this issue, we recommend that you configure no port-hop or static entries on data center devices. You can either have all edges connected to a single Cisco SD-WAN Validator or balance the edges between two Cisco SD-WAN Validators by changing the order of the IP in the below command.
For static entries, you can configure the IP addresses on a data center device in this command:system vbond <vBond FQDN> vpn 0 host <vBond FQDN> ip <vBond ip1> <vBond ip2>
system no port-hopExternal triggers like change of System IP, change of Color on TLOC while adding TLOC can trigger port-hop, even though no port-hop is configured.
Cisco vEdge Device port hopping sequence
To describe how port hopping works, we use an example of a Cisco vEdge device with the default base port of 12346. When a router has attempted to connect to another Cisco vEdge device but the connection does not succeed within a certain time, the router hops to the next base port and tries establishing the connection on that port.
