Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

Ports used by Cisco vEdge Devices

Updated: July 7, 2026

Want to summarize with AI?

Log in

Lists the ports used by Cisco vEdge devices for DTLS control plane connections and IPsec data plane connections in overlay networks.

When a Cisco vEdge device joins the overlay network, it establishes DTLS control plane connections with the controller devices—Cisco SD-WAN Validator, Cisco SD-WAN Manager, and Cisco Catalyst SD-WAN Controller. The router uses these control connections to learn the location of Cisco Catalyst SD-WAN Controller from Cisco SD-WAN Validator, to receive its configuration from Cisco SD-WAN Manager, and to receive its policy and any policy updates from Cisco Catalyst SD-WAN Controller. When initially establishing these DTLS connections, the Cisco vEdge device uses the base port 12346. If it is unable to establish a connection using this base port, it port-hops through ports 12366, 12386, 12406, and 12426, returning, if necessary, to 12346, until it successfully establishes the DTLS connections with the three controller devices. This same port number is used to establish the IPsec connections and BFD sessions to the other Cisco vEdge devices in the overlay network. Note that if the vEdge configuration includes a port offset, the base port number and the four sequential port numbers are incremented by the configured offset.

To see which port DTLS and BFD are using for the control and data connections, look at the Private Port column in the output of the show control local-properties command. The command output also shows the public port number that the interface is using. If the WAN port of the Cisco vEdge device is not connected to a NAT device, the private and public port numbers are the same. If a NAT device is present, the port number listed in the Public Port column is the one being used by the NAT device, and it is the port that BFD is using. This public port number is the one remote Cisco vEdge devices use to send traffic to the local site.

If a NAT device is present, the port number listed in the Public Port column is used by the NAT device, and BFD. This public port number is used by remote Cisco vEdge devices to send traffic to the local site.

In a network with firewall devices, you must open the Cisco Catalyst SD-WAN base ports on the firewall devices to allow traffic to flow across the overlay network. You open all the base ports that the Cisco vEdge devices in the network might use, which are the default base ports and the four base ports that the router can port-hop among.

Note

Port hopping is generally not needed on Cisco SD-WAN Controllers and on Cisco SD-WAN Manager.

For additional details regarding DTLS, TLS, and IPsec ports for Cisco Catalyst SD-WAN device connections, see Firewall Port Considerations

For Cisco vEdge devices configured to use DTLS tunnels, which use UDP, at a minimum you must open the five base ports that are used by a Cisco vEdge device with a default port offset of 0. Specifically, you open:

  • Port 12346

  • Port 12366

  • Port 12386

  • Port 12406

  • Port 12426

If you have configured a port offset value on any of the Cisco vEdge devices, you also need to open the ports configured with the port offset value:

  • Port (12346 + port offset value)

  • Port (12366 + port offset value)

  • Port (12386 + port offset value)

  • Port (12406 + port offset value)

  • Port (12426 + port offset value)