SD-WAN All tunnels not established

[msosa]

   Hello, I´m testing a SD-WAN network with a customer, the scenario is:

HQ: MX84 as VPN Concentrator one-armed (behind a Fw)

Branch1: MX64 with 2 Internet connections (behind a Fw)

Branch2: MX64 with 2 Internet connections

Full Mesh required.

   I configured the auto-VPN for the devices, and it started to work fine, HQ has 2 tunnels to each branch, but when I see the connection between the branches, I expected to see 4 tunnels, but there is only working 2,  the Branch2 Wan1 are not establishing the VPN tunnels to Branch 1 Wan1 and Wan2:

I though it could be a problem with the Internet 1, but it is working well, and as I say before, the tunnels to the HQ are working, Wan1 and Wan2 from my branch device:

A summary of the VPN Tunnels status:

HQ - Branch1 Wan1 : OK

HQ - Branch1 Wan2 : OK

HQ - Branch2 Wan1 : OK

HQ - Branch12Wan2 : OK

Branch1 Wan1 - Branch 2 Wan 1: Fail

Branch1 Wan1 - Branch 2 Wan 2: Ok

Branch1 Wan2 - Branch 2 Wan 1: Fail

Branch1 Wan2 - Branch 2 Wan 2: Ok

    Can somebody give me an advise what could be the reason? or how to troubleshooting it?

Thanks in advance!

Mauricio

[NolanHerring]

You mentioned this:

Branch1: MX64 with 2 Internet connections (behind a FW)

I can't help but to think that this FW might be causing an issue, again not certain though.

[msosa]

thank you for your answer! I don´t think the firewall is the cause, because as you could see, I have VPN tunnels running on the same interfaces.

[PhilipDAth]

Have you got all the sites configured as hubs?

[msosa]

Yes the are..

[msosa · Accepted solution]

UPDATE: I moved the MX to the front of the firewall and it worked ok, certainly it was doing something strange but I´m sure it was not blocking anything.. and the funny thing is that the tunnels worked some times.. anyway it is ok now, thank you all for your comments!