苏州电信SSG5培训资料--09-故障排查讲解学习.ppt

《苏州电信SSG5培训资料--09-故障排查讲解学习.ppt》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、苏州电信SSG5培训资料--09-故障排查FlowDebuggerBasicsNeversendthedebugtotheconsole!setconsoledbufAlwaysuseaflowfilter!setffilter?TheflowfilterusesanORalgorithm.Youcansetmultiplefiltersanditwillfilteranytrafficthatfitsanyofthefilters.ToturntheflowdebuggerON/OFF[debug/undebug]flowbasi

2、cTrytorundebugsonlyduringscheduleddowntimes.FlowDebugger举例,ICMP请求******997629.0:packetreceived[60]******ipid=5359(14ef),@03c9f550packetpassedsanitycheck.trust:192.168.100.205/4608->172.27.10.251/512,1(8/0)choseinterfacetrustasincomingnatif.searchrou

3、teto(trust,192.168.100.205->172.27.10.251)invrtrust-vrforvsd-0/flag-0/ifp-null[Dest]2.route172.27.10.251->0.0.0.0,tountrustrouted(172.27.10.251,0.0.0.0)fromtrust(trustin0)tountrustpolicysearchfromzone2->zone1NoSWRPCrulematch,searchHWrulePermittedbypolicy9Nosrcxlatechoo

4、seinterfaceuntrustasoutgoingphyifnolooponifpuntrust.sessionapplicationtype0,nameNone,timeout60secservicelookupidentifiedservice0.Session(id:818)createdforfirstpak1routeto172.27.10.251arpentryfoundfor172.27.10.251nsp2wingprepared,readycachemacinthesessionflowgotsession.

5、flowsessionid818postaddrxlation:192.168.100.205->172.27.10.251.FlowDebuggerExample,ICMPResponse******997629.0:packetreceived[60]******ipid=29278(725e),@03c391d0packetpassedsanitycheck.untrust:172.27.10.251/512->192.168.100.205/4608,1(0/0)existin

6、gsessionfound.sesstoken3flowgotsession.flowsessionid818postaddrxlation:172.27.10.251->192.168.100.205.IKEDebuggerBasicsForsimplicity,trytoonlyinitiateonly1IKEtunnelatatime.AlwayssendthedebugtothebuffersetconsoledbufToturnthedebuggerON/OFFdebugikebasic/debugikedetailTry

7、torunthedebugduringascheduleddowntimeIKEDebugExample,P1:InitiateIKE<172.27.10.208>******RecvkernelmsgIDX-0,TYPE-5******IKE<172.27.10.208>Phase1:Initiatednegotiationinmainmode.<172.27.10.209=>172.27.10.208>IKE<172.27.10.208>ConstructISAKMPheader.IKE<172.27.10.208>Constr

8、uct[SA]forISAKMPIKE<172.27.10.208>ConstructNetScreen[VID]IKE<172.27.10.208>Constructcustom[VID]IKE<172.27.10.208>Xmit