零信任网关无法做nat转发

不涉及

<Internet>*Sep 20 21:12:34:101 2026 Internet IPFW/7/IPFW_PACKET: -COntext=3;

Receiving, interface = Route-Aggregation1.10

version = 4, headlen = 20, tos = 16

pktlen = 60, pktid = 26965, offset = 0, ttl = 63, protocol = 6

checksum = 32843, s = A, d = B

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Receiving IP packet from interface Route-Aggregation1.10.

Payload: TCP

 source port = 39090, destination port = 2020

  sequence num = 0x5f0d457f, acknowledgement num = 0x00000000, flags = 0x2

  window size = 64240, checksum = 0xd2a8, header length = 40.

*Sep 20 21:12:34:102 2026 Internet IPFW/7/IPFW_INFO: -COntext=3;

MBUF was intercepted! Phase Num is 0(pre all), Service ID is 6(spa), Bitmap is 200000000000000, return 1(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is Route-Aggregation1.10,

s= A, d= B, protocol= 6, pktid = 26965

VsysID = 1.

现场防火墙做零信任网关，想在虚墙（也配置了被零信任网关纳管）上边做个源nat转换的纯转发，报文从Ragg1.10上来，然后再从Ragg1.10出去，在1.10上做源nat

Debug发现报文直接被spa丢弃

<Internet>*Sep 20 21:12:34:101 2026 Internet IPFW/7/IPFW_PACKET: -COntext=3;

Receiving, interface = Route-Aggregation1.10

version = 4, headlen = 20, tos = 16

pktlen = 60, pktid = 26965, offset = 0, ttl = 63, protocol = 6

checksum = 32843, s = A, d = B

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Receiving IP packet from interface Route-Aggregation1.10.

Payload: TCP

 source port = 39090, destination port = 2020

  sequence num = 0x5f0d457f, acknowledgement num = 0x00000000, flags = 0x2

  window size = 64240, checksum = 0xd2a8, header length = 40.

*Sep 20 21:12:34:102 2026 Internet IPFW/7/IPFW_INFO: -COntext=3;

MBUF was intercepted! Phase Num is 0(pre all), Service ID is 6(spa), Bitmap is 200000000000000, return 1(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is Route-Aggregation1.10,

s= A, d= B, protocol= 6, pktid = 26965

VsysID = 1.

spa就是零信任模块，说明这个流量没走nat，直接被零信任丢弃

经过确认spa要求通过inode客户端敲门后才能放通流量

如果有其他非零信任的流量，建议不要开spa

单独建立虚墙，把这个接口共享进去，这个虚墙不开spa，就能正常转发了

附：怎么确认设备开没开spa