SDWAN - Port Hopping and Port-Offset with example

Port Hopping: 

WAN Edge devices manage control plane connectivity using port hopping.

To summarize and clarify:

• Default base port: 12346

• Port hopping pattern: Increments by 20, trying 12366, 12386, 12406, 12426, then loops back.

• Enabled by default on WAN Edge routers, but can be disabled globally or per interface

• Recommended practice:

  • Enable on branches for better connection reliability

  • Disable on data centers, hubs, or high-traffic locations to avoid connection disruption

• Disabled by default on controllers (vManage, vSmart) and should remain disabled

• vManage/vSmart with multi-core setup: Use different base ports per core

Port Offset:

Why Use Port Offsets Behind NAT?

When multiple WAN Edge routers sit behind the same NAT device and share a public IP address, if they all use the same base port (12346) to initiate connections to the controllers, the NAT device may not handle translation cleanly, causing connection failures or instability.

Solution: Port Offset

• Base Port: 12346

• With Port Offset = 1:

  • Base port becomes 12347

  • Port hopping pattern becomes: 12367, 12387, 12407, 12427

vBond IPs and port are static, It is recommended to permit UDP destination port 12346 to vBond and permit UDP source port 12346 from vBond.

This offset ensures each WAN Edge behind the same NAT has a unique source port pattern, minimizing NAT conflicts and making port usage predictable.

Default Behavior

• Port Offset = 0 by default (i.e., no change from 12346)

• You must explicitly configure an offset per WAN Edge router

Now Lets Play with Port-offset 

from vEDGE to Other vEDGE and Controllers BFD session and Control Connections  with destination UDP port 12346

Lets change the Port-offset = 2 on vEDGE 

all BFD and IPsec tunnel are reset