Mikrotik NAT and Cisco Catalyst SDWAN

Christophe Lucas

Do you have ever tried to put a Mikrotik in front of a Cisco Catalyst SDWAN Router in NAT Mode ? It seems it is not already easy to make it works with a simple :

/ip firewall nat
add action=masquerade chain=srcnat out-interface=PPP src-address=10.0.0.0/29

Same for :

/ip firewall nat
add action=src-nat chain=srcnat out-interface=PPP src-address=10.0.0.0/29 to-addresses=<IP_ADDRESS>

Replace with a Cisco with a simple nat overload and it works perfectly. So ? what ? It seems Mikrotik and Cisco is not working with NAT is the same way and it making DTLS and BFD Cisco SDWAN failing. The way I found to do it is as :

/ip firewall nat
add action=endpoint-independent-nat chain=srcnat out-interface=PPP protocol=udp randomise-ports=yes src-address=10.0.0.0/29 to-addresses=<IP_ADDRESS>
add action=endpoint-independent-nat chain=dstnat in-interface=PPP protocol=udp randomise-ports=no

If you want more information, begins by reading RFC4787 and for EIM RFC7857.

Have fun :)