Skip to main content
Version: v25.07.31

CGW Troubleshooting

This document provides steps for troubleshooting and diagnosing CGW configurations. It also contains verification methods for different traffic modes, response validation, and log analysis.

Common Symptoms and Causes​

SymptomPossible Cause
No traffic passing through CGWIncorrect mode selection or configuration error
Traffic not routing as expectedMisconfigured routing rules or incorrect mode setting
Unable to access certain domains/IPsBlocked or unallowed IPs/domains in selective mode
Unexpected traffic behaviorMisconfigured policy settings or local IP routing issues

Troubleshooting Steps​

Cloud Configuration Verification​

Access the CE Terminal​

Log in to the CE (Customer Edge) terminal and gain superuser privileges:

sudo su -

Check the Last Configuration Response​

To confirm the last applied configuration response, run:

cat /tmp/last_config_response.json |jq .gatewayConfig

This command displays the JSON configuration, allowing you to verify settings like gatewayMode, allowedDomains, blockedIPAddresses, and defaultPolicy. For example:

The given one is just an example output; when this command is run, it will show something like this.

Example Response:​

Global​

[
  {
    "translationAddress": "masquerade",
    "ceDeviceIp": "100.100.0.77/30",
    "allowedDomains": [
      "www.google.com"
    ],
    "localSeqId": 19,
    "peDeviceIp": "100.100.0.78/30",
    "gatewayMode": "GLOBAL",
    "blockedIPSubnets": [],
    "blockedIPAddresses": [
      "13.13.13.13"
    ],
    "blockedDomains": [
      "www.facebook.com"
    ],
    "mode": "CE_PEGW",
    "defaultPolicy": "ALLOW",
    "sourceSubnet": [
      "172.30.3.0/24"
    ],
    "zone": "cn",
    "id": 1,
    "allowedIPAddresses": [
      "12.12.12.12"
    ],
    "allowedIPSubnets": [],
    "singleArm": null,
    "cid": 38
  }
]

Full​

[
  {
    "translationAddress": "masquerade",
    "ceDeviceIp": "100.100.0.77/30",
    "allowedDomains": [
      "www.google.com"
    ],
    "localSeqId": 19,
    "peDeviceIp": "100.100.0.78/30",
    "gatewayMode": "FULL",
    "blockedIPSubnets": [],
    "blockedIPAddresses": [
      "13.13.13.13"
    ],
    "blockedDomains": [
      "www.facebook.com"
    ],
    "mode": "CE_PEGW",
    "defaultPolicy": "ALLOW",
    "sourceSubnet": [
      "172.30.3.0/24"
    ],
    "zone": "cn",
    "id": 1,
    "allowedIPAddresses": [
      "12.12.12.12"
    ],
    "allowedIPSubnets": [],
    "singleArm": null,
    "cid": 38
  }
]

Selected​

[
  {
    "translationAddress": "masquerade",
    "ceDeviceIp": "100.100.0.77/30",
    "allowedDomains": [
      "www.google.com"
    ],
    "localSeqId": 19,
    "peDeviceIp": "100.100.0.78/30",
    "gatewayMode": "SELECTED",
    "blockedIPSubnets": [],
    "blockedIPAddresses": [
      "13.13.13.13"
    ],
    "blockedDomains": [
      "www.facebook.com"
    ],
    "mode": "CE_PEGW",
    "defaultPolicy": "BLOCK",
    "sourceSubnet": [
      "172.30.3.0/24"
    ],
    "zone": "cn",
    "id": 1,
    "allowedIPAddresses": [
      "12.12.12.12"
    ],
    "allowedIPSubnets": [],
    "singleArm": null,
    "cid": 38
  }
]
Q:1 What does CGW represent?

The gatewayMode parameter defines how traffic is routed through the Cloud Gateway (CGW). It determines the scope of traffic that will pass via the CGW: GLOBAL Mode – All global traffic (outside the local domain) is routed through the CGW. FULL Mode – All traffic (global, local, and domain) is routed through the CGW. SELECTED Mode – Only traffic defined by specific rules (allowed/blocked domains, IPs, or subnets) is routed through the CGW.

Q:2 What does defaultPolicy do?

The defaultPolicy parameter defines the baseline action for traffic that does not match any specific allow/deny rules: ALLOW – Traffic is permitted to pass through the CGW unless explicitly blocked. BLOCK – Traffic is denied by default unless explicitly allowed.

Q:3 Which parameters should be checked while verifying JSON output?

gatewayMode → Make sure it matches the routing design (GLOBAL, FULL, SELECTED), IPs and Subnets → Confirm CE/PE Tunnel IPs , source subnets, and netmask values, Allowed/Blocked Lists For Example, CE Tunnel IP:- 100.100.0.77/30 and PE Tunnel IP:-100.100.0.78/30. → Check domains and IPs allowed or blocked, defaultPolicy → Ensure fallback policy (ALLOW or BLOCK) is correct, translationAddress → Verify masquerade or public IP translation.