现网的组网情况相对复杂,现场的工程师也无法给出确定的组网情况,最终根据本端和对端抓包的情况将拓扑简化为下图(涉及客户IP信息部分已作修改和打码):
现场怀疑我司LB设备没有将业务报文转发,协助现场远程抓包和收集debug
发现在debug ip packet中,有报文的收发记录,但是全局抓包的结果是,只抓到了收的包,没有抓到发出去的包,设备上做了nat server。
nat server global 100.0.0.1 inside 10.0.0.2 rule 10.0.0.2 counting
抓包和debug匹配的ACL如下:
acl advanced 3915
rule 5 permit ip source 120.0.0.4 0 destination 100.0.0.1 0
rule 10 permit ip source 120.0.0.4 0 destination 10.0.0.2 0
两次debug和抓包,都是debug可以看到包的收发,但是抓包只能抓到收的报文,抓不到发的报文。
*May 27 15:12:06:612 2022 HN-CSX-F1090-LB IPFW/7/IPFW_PACKET: -COntext=1;
Receiving, interface = Vlan-interface100
version = 4, headlen = 20, tos = 116
pktlen = 548, pktid = 57219, offset = 0, ttl = 52, protocol = 17
checksum = 45334, s = 120.0.0.4, d = 100.0.0.1
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Receiving IP packet from interface Vlan-interface100.
Payload: UDP
source port = 20040, destination port = 7100
checksum = 0x93a4, length = 528.
*May 27 15:12:06:612 2022 HN-CSX-F1090-LB IPFW/7/IPFW_PACKET: -COntext=1;
Sending, interface = Route-Aggregation1
version = 4, headlen = 20, tos = 116
pktlen = 548, pktid = 57219, offset = 0, ttl = 51, protocol = 17
checksum = 14819, s = 120.0.0.4, d = 10.0.0.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Sending IP packet received from interface Vlan-interface100 at interface Route-Aggregation1.
Payload: UDP
source port = 20040, destination port = 7100
checksum = 0x1b71, length = 528.
起初现场反馈的是,10.0.0.2访问120.0.0.4要走默认路由,根据默认路由推断,10.0.0.2主动访问120.0.0.4时是从vlan200接口下做nat转换为20.0.0.1出去,这样的转发路径与对端访问本端时的路径不一致,且对端配合抓包时可以收到本端发出去的报文,但是并未对本端发过去的报文做回应,因此怀疑是来回路径不一致导致的报文转发丢包。
补全双向acl ,测试业务时用补全的acl全局抓包,并收集全量的debug信息:
acl advanced 3915
rule 0 permit ip source 120.0.0.4 0 destination 10.0.0.2 0
rule 5 permit ip source 120.0.0.4 0 destination 100.0.0.1 0
rule 10 permit ip source 10.0.0.2 0 destination 120.0.0.4 0
rule 15 permit ip source 100.0.0.1 0 destination 120.0.0.4 0
rule 25 permit ip source 200.0.0.1 0 destination 120.0.0.4 0
debugging nat packet acl 3915
debugging ip packet acl 3915
debugging security-policy packet ip acl 3915
debugging ip info acl 3915
debugging aspf packet acl 3915
debug ip info中有如下报错,被保持上一跳阻断:
*May 31 14:42:03:272 2022 HN-CSX-F1090-LB IPFW/7/IPFW_INFO: -COntext=1; MBUF was intercepted! Phase Num is 2(pre routing2), Service ID is 2(keep lasthop), Bitmap is 2000000000000000, return 2(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is Vlan-interface1010, s= 120.0.0.4, d= 10.0.0.2, protocol= 17, pktid = 60571.
本端发出的包报文:
10.0.0.2访问120.0.0.4的报文,匹配已有的会话NAT转源(会话创建过程没有debug到),源地址变为200.0.0.1,并从vlan-if200 口发出。
*May 30 15:52:29:023 2022 HN-CSX-F1090-LB NAT/7/COMMON: -COntext=1;
PACKET: (Vlan-interface200-out-session) Protocol: UDP
10.0.0.2: 7100 - 120.0.4:20040(VPN: 0) ------>
200.0.01: 1345 - 120.0.04(VPN: 0)
对端发来的报文:
120.0.0.4访问本端的报文,在vlan-if 100口进入,匹配NAT server转目的,目的地址转换为10.0.0.2,防火墙按这个该转换关系创建会话表项,会检查到五元组(120.0.0.4:20040、10.0.0.2、UDP)和上面一条完全一样,会话冲突所以创建失败,刚好吻合debug ip info中的报错
*May 30 15:27:18
:129 2022 HN-CSX-F1090-LB NAT/7/COMMON: -COntext=1;
PACKET: (Vlan-interface1010-in-config) Protocol: UDP
120.0.0.4:20040 - 100.0.0.1: 7100(VPN: 0) ------>
120.0.0.4:20040 - 10.0.2.2: 7100(VPN: 0)
解决办法:通过配置保证出入接口一致
1、
2、
(1)nat server加reversible 参数允许反向转换;
nat server global 100.0.0.1 inside 10.0.0.2 reversible
(2)通过明细静态路由,将去往120.0.0.4 的下一跳向100.0.0.2
ip route-static 120.0.0.4 32 100.0.0.2
由于现场从10.0.0.2到120.0.0.4已经有了快转表(快转走vlan-if200接口),因此需要先删除该表项,这里进行的操作是reset会话,以达到删除快转表的目的。
reset session table
ipv4 source-ip 10.0.0.2 destination-ip 120.0.0.4
从报文的包ID值也可以看出报文正常收发:
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作