Hi all, So today I noticed that the destination addresses listed under firewall info for my dashboard had changed, and this explains nicely why some devices have been having a hard time connecting to the dashboard. My question is - for MX devices, what source address would they use management connections on TCP/7734, 7752 and UDP/7351, 9350-9351?  I can packet capture and see this traffic on the WAN interface, but not always the LAN interface (espcially the UDP traffic).  This might just be a coincidence because I am capturing at different times, or does the MX originate the UDP traffic from the WAN address (i.e. not one of the LAN subnets)? Thanks in advance. ... View more

I'm working through an issue with MX64 as a client VPN server behind a 3rd party (Fortigate) firewall.  I have UDP/4500 and UDP/500 forwarded from the WAN interface of the other firewall to the MX64.  I've looked at packet captures and can see the following: 1) SA completes (client to server ephemeral port 57234 to 500) 2) KE completes (ephemeral port 57234 to 500) 3) ID - client sends ID on ephemeral ports 35121 to 4500, but MX replies with source port 4500 to destination 4500 - i.e. it doesn't reply with dst port 35121 - that the session is established on - so it gets dropped.   I ran a test with another MX NATted behind another firewall, and this worked fine.  The difference was at step 3) - this MX replied from 4500 back to the ephemeral DST port (42854 in this case), then established the connection and proceeded to ESP.   My question is, in the first non-working scenario, why is the MX64 replying from 4500->4500 instead of  4500->35121? I can't fund any reason why it's not behaving in the same way as the working example.  ... View more