负载均衡一条链路不通
- 0关注
- 0收藏，81浏览
问题描述：
version 7.1.064, Release 8860P1210
#
sysname Firewall-1000
#
clock protocol none
#
context Admin id 1
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
ip pool aa 10.6.0.100 10.6.0.200
ip pool aa gateway 10.6.0.1
#
dialer-group 1 rule ip permit
#
dns server 8.8.8.8
dns server 114.114.114.114
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
object-group ip address cz
0 network subnet 10.0.0.0 255.0.0.0
#
object-group ip address
0 network host address 192.168.3.35
10 network host address 192.168.3.34
#
object-group ip address ת
0 network host address 10.2.4.106
#
nqa template icmp pppoe
destination ip 8.8.8.8
#
nqa template icmp
destination ip 10.2.4.105
#
nqa template icmp ר
destination ip 115.236.75.53
#
interface Dialer0
mtu 1492
ppp chap password cipher $c$3$XxSXNKm2ywIZXgnzAyYIfjcapCSKEtC88w==
ppp chap user 057194275540
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 057194275540 password cipher $c$3$+aWswYQHPVzTcHErkjqSDRAxu7E+w8Ne+A==
dialer bundle enable
dialer-group 1
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
tcp mss 1400
nat outbound
#
interface Virtual-Template1
ppp authentication-mode chap domain system
remote address pool aa
ip address 10.6.0.1 255.255.255.0
dns server 114.114.114.114
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
ip address 115.236.75.54 255.255.255.252
session log enable ipv4 inbound
session log enable ipv4 outbound
nat outbound
gateway 115.236.75.53
#
interface GigabitEthernet1/0/1
port link-mode route
ip address 192.168.88.253 255.255.255.0
ipv6 address 2402:4B80:FFFF:1008:1:45:0:1/96
undo ipv6 nd ra halt
#
interface GigabitEthernet1/0/2
port link-mode route
session log enable ipv4 inbound
session log enable ipv4 outbound
nat outbound
pppoe-client dial-bundle-number 0
#
interface GigabitEthernet1/0/3
port link-mode route
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
ip address 192.168.100.1 255.255.255.0
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
shutdown
#
interface GigabitEthernet1/0/11
port link-mode route
#
interface GigabitEthernet1/0/12
port link-mode route
#
interface GigabitEthernet1/0/13
port link-mode route
#
interface GigabitEthernet1/0/14
port link-mode route
#
interface GigabitEthernet1/0/15
port link-mode route
#
interface GigabitEthernet1/0/16
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/17
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/18
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/19
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/20
port link-mode route
#
interface GigabitEthernet1/0/21
port link-mode route
#
interface GigabitEthernet1/0/22
port link-mode route
#
interface GigabitEthernet1/0/23
port link-mode route
#
interface GigabitEthernet1/0/24
port link-mode route
#
interface GigabitEthernet1/0/25
port link-mode route
#
interface M-GigabitEthernet1/0/0
ip address 192.168.0.1 255.255.255.0
#
interface Ten-GigabitEthernet1/0/26
port link-mode route
#
interface Ten-GigabitEthernet1/0/27
port link-mode route
ip address 10.2.4.106 255.255.255.252
ip last-hop hold
nat outbound
ipv6 address 2402:4B80:FFFF:1008:0:45:0:1/96
undo ipv6 nd ra halt
gateway 10.2.4.105
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name DMZ
#
security-zone name Untrust
import interface Dialer0
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
import interface Ten-GigabitEthernet1/0/27
#
security-zone name Management
import interface GigabitEthernet1/0/5
import interface M-GigabitEthernet1/0/0
import interface Virtual-Template1
#
scheduler logfile size 16
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-admin
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
user-role network-operator
#
ip route-static 0.0.0.0 0 Dialer0
ip route-static 10.0.0.0 8 Ten-GigabitEthernet1/0/27 10.2.4.106
ip route-static 192.168.0.0 23 192.168.88.254
ip route-static 192.168.2.0 23 192.168.88.254
ip route-static 192.168.4.0 23 192.168.88.254
ip route-static 192.168.6.0 23 192.168.88.254
ip route-static 192.168.8.0 24 192.168.88.254
ip route-static 192.168.10.252 32 192.168.88.254
ip route-static 192.168.10.253 32 192.168.88.254
ip route-static 192.168.12.0 23 192.168.88.254
ip route-static 192.168.96.0 22 192.168.88.254
ip route-static 192.168.224.0 21 192.168.88.254
ipv6 route-static :: 0 2402:4B80:FFFF:1008:0:45:FFFF:FFFE
ipv6 route-static 2402:4B80:1008:45:: 64 2402:4B80:FFFF:1008:1:45:FFFF:FFFE
#
undo info-center enable
info-center loghost 127.0.0.1 port 3301 format default
info-center source CFGLOG loghost level informational
#
ssh server enable
#
acl basic 2000
rule 0 permit
#
radius scheme aa
primary authentication 139.196.46.207
primary accounting 139.196.46.207
key authentication cipher $c$3$OzS/gUBr+K73/CSvL0+LgR3FVmqowOPryRwzHdiJ
key accounting cipher $c$3$OHFywh37NknaLK7Et+fx+rwS9hS0+cUHjqbJkhiQ
retry 5
timer response-timeout 8
user-name-format without-domain
#
domain system
authentication ppp local radius-scheme aa
authorization ppp local radius-scheme aa
accounting ppp local radius-scheme aa
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$sEJvh100jJXbpXbO$92xlOhh4Cz0hFcczsw/PYW9cWpmkjvsj/9ytemIC5131zhXLtXk2A6/4SexbUBI7TNafyD9Xx/HESSnDd1cwwQ==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
password-control length 8
undo password-control complexity user-name check
#
local-user system class manage
password hash $h$6$329G4OkZLt4afOY5$wYz8UeIxIRGQc4yh96+UatXE/V1goX9DohDOkT3A6oXY+7HN5Ug1p6hqFbDqSWe5xnp4KWyboatIg86WkqQGRw==
service-type ssh https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
session statistics enable
session log bytes-active 1
session log flow-begin
#
l2tp-group 1 mode lns
allow l2tp virtual-template 1
undo tunnel authentication
tunnel name LNS
#
nat global-policy
rule name GlobalPolicyRule_20
source-zone Trust
destination-zone Untrust
destination-ip cz
action snat object-group תort-preserved
counting enable
#
l2tp enable
#
ip https enable
#
blacklist ip 115.206.241.20
blacklist destination-ip 115.206.241.20
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
inspect email parameter-profile mailsetting_default_parameter
undo authentication enable
#
loadbalance link-group pppoe
transparent enable
probe pppoe
success-criteria at-least 1
link 2
success-criteria at-least 1
#
loadbalance link-group
transparent enable
probe
success-criteria at-least 1
link
success-criteria at-least 1
probe
#
loadbalance link-group ר
transparent enable
probe ר
success-criteria at-least 1
link 1
success-criteria at-least 1
#
loadbalance class 1 type link-generic match-any
#
loadbalance class ype link-generic match-any
match 1 source ip address 10.0.0.0 8
#
loadbalance action ##defaultactionforllbipv4##%%autocreatedbyweb%% type link-generic
link-group pppoe
#
loadbalance action ob$action$#for#1 type link-generic
link-group ר
fallback-action continue
#
loadbalance action ob$action$#for#ype link-generic
link-group
fallback-action continue
#
loadbalance policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%% type link-generic
class 1 action ob$action$#for#1
class ction ob$action$#for#
default-class action ##defaultactionforllbipv4##%%autocreatedbyweb%%
#
virtual-server ##defaultvsforllbipv4##%%autocreatedbyweb%% type link-ip
virtual ip address 0.0.0.0 0
lb-policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%%
bandwidth busy-protection enable
bandwidth interface statistics enable
service enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
loadbalance link
router ip 10.2.4.105
success-criteria at-least 1
#
loadbalance link 1
router ip 115.236.75.53
max-bandwidth 2000000 kbps
max-bandwidth inbound 2000000 kbps
max-bandwidth outbound 2000000 kbps
success-criteria at-least 1
#
loadbalance link 2
router interface Dialer0
max-bandwidth 10000000 kbps
max-bandwidth inbound 10000000 kbps
max-bandwidth outbound 1000000 kbps
success-criteria at-least 1
#
security-policy ip
rule 0 name Any_Any_0_IPv4
action pass
counting enable
rule 21 name in-out
action pass
rule 23 name Trust-to-Unrust
action pass
source-zone Trust
destination-zone Untrust
rule 24 name Local-to-Untrust
action pass
source-zone Local
destination-zone Untrust
#
security-policy ipv6
rule 0 name ipv6
action pass
counting enable
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
防火墙配置如上，做出链路负载均衡，现在有两条链路正常，10段的链路在业务端PING网关都不通
内网 10.0.0.0/8，专门匹配走【Ten-GigabitEthernet1/0/27（10.2.4.106，下一跳 10.2.4.105）这条链路】，业务端 ping 10.2.4.105 不通；另外两条链路（固定公网 GE0/0、PPPoE Dialer0）正常。 重点：你同时写了一条静态路由
ip route-static 10.0.0.0 8 Ten-GigabitEthernet1/0/27 10.2.4.105+ LLB 负载均衡 class 专门匹配 10.0.0.0/8 走这条链路；且链路组开了transparent enable，这是最主要冲突点，再加探测、NAT、回程、接口 NAT 叠加问题。
链路清单：
- link1：GE1/0/0，115.236.75.54，下一跳 115.236.75.53 ✅正常
- link2：Dialer0（PPPoE）✅正常
- link：Ten1/0/27，10.2.4.106，下一跳 10.2.4.105 ❌不通（10 段源匹配这条）
一、先理解 transparent enable（致命点）
loadbalance link-group xxx transparent enable = 透明模式：这条链路组流量不做 NATH3C
但是：
Ten-GigabitEthernet1/0/27接口下配置了nat outbound- 同时还有全局 nat-policy，源 zone Trust、目的 zone Untrust、源 10.0.0.0/8 做 snat
冲突：透明模式要求不转换源 IP，但接口 / 全局策略又要给 10 段做 SNAT；报文转发逻辑混乱，ping 网关（10.2.4.105）回程回不来。 👉 专门给 10 段的这个 link-group（名字ר），transparent enable 必须删掉！
system-view
loadbalance link-group ר
undo transparent enable
quit
补充：transparent 一般用于服务器入方向负载、专线（不需要 NAT）；普通上网多链路负载，绝大多数场景不要开 transparent。
二、静态路由和 LLB 策略路由冲突（第二个大坑）
ip route-static 10.0.0.0 8 Ten-GigabitEthernet1/0/27 10.2.4.105
你又用 LLB class 匹配 10.0.0.0/8 交给链路组ר走同一条链路。 V7 防火墙优先级：LLB 链路负载均衡 > 静态路由 看似出口一样，但探测失败、链路状态切换时行为异常，ping 网关容易丢。
两种方案二选一： 方案 A（推荐，交给 LLB 全权调度）：删掉这条静态路由
undo ip route-static 10.0.0.0 8 Ten-GigabitEthernet1/0/27 10.2.4.105
方案 B：10 段不走 LLB，纯静态路由，删掉对应的 loadbalance class 匹配。
三、NQA 探测配置缺陷（会误判链路）
nqa template icmp ר
destination ip 115.236.75.53
❗这条链路（10.2.4.105）的探测模板，探测目标写的是另一条运营商网关 115.236.75.53，不是本链路网关 10.2.4.105！ 探测对象错了，链路状态判断完全不准，会出现链路实际断了探测还显示 up，或者反过来。 修改：
nqa template icmp ר
undo destination ip 115.236.75.53
destination ip 10.2.4.105
reaction trigger per-probe
quit
建议加上
reaction trigger per-probe，每次探测结果实时通知 LLB，否则探测不实时。
四、链路配置检查：这条链路没有加入 link-group！
loadbalance link
router ip 10.2.4.105
success-criteria at-least 1
对比正常 link1/link2 写法：
loadbalance link 1
router ip 115.236.75.53
link-group ר
✅ 缺少 link-group ר，这条链路没有加入链路组！
修正：
loadbalance link
router ip 10.2.4.105
link-group ר
success-criteria at-least 1
quit
你现在的配置：链路定义了，但没加到链路组，LLB 策略调用链路组的时候找不到这个成员，流量转发异常。
五、NAT 叠加风险（10 段 ping 网关场景）
业务端源：10.0.0.0/8 → ping 10.2.4.105（同网段运营商网关）
- 接口下
nat outbound - 全局 nat-policy：Trust→Untrust，源 10 段做 snat 当 ping 目的是同链路侧网关（10.2.4.105）：
- 如果做了 SNAT：源 IP 变成出口 IP 10.2.4.106，网关回包没问题；
- 但如果你后面开了 transparent（不做 NAT），源 10.0.0.0/8 发给运营商网关，运营商网关没有回程路由指向防火墙 10.2.4.106，直接丢包，ping 不通。
这就是现象：内网 10 段 ping 10.2.4.105 不通，别的链路正常最直接原因。
临时验证命令（在防火墙本机 ping 测试，区分是转发问题还是业务端问题）
ping -a 10.2.4.106 10.2.4.105
ping -a 10.0.0.10 10.2.4.105
六、排查命令顺序（按这个顺序收集信息）
# 1、查看链路状态、是否up、探测结果
display loadbalance link brief
display loadbalance link-group ר
# 2、查看NQA探测结果
display nqa template icmp ר
display nqa result
# 3、看路由表，10段走哪里
display ip routing-table 10.0.0.0 8
display fib 10.0.0.0 8
# 4、看会话，ping报文有没有建立会话、是否被nat
display session table source 10.0.0.0 8 destination 10.2.4.105
display nat session source 10.0.0.0 8 destination 10.2.4.105
# 5、看丢包统计
display interface Ten-GigabitEthernet1/0/27
七、整理好的修复顺序（直接照着敲）
- 修正 NQA 探测模板，探测本链路网关 10.2.4.105，增加 per-probe
- 给这条 10.2.4.105 的 loadbalance link，增加
link-group ר - 链路组ר
undo transparent enable（最重要） - 删除冲突静态路由
undo ip route-static 10.0.0.0 8 Ten-GigabitEthernet1/0/27 10.2.4.105 - save，测试业务端 ping 网关 10.2.4.105
八、额外小坑提醒
你 web 自动生成的 LLB 策略名字乱码（ob$action$#for#ype），是 web 页面异常残留，功能上会匹配错乱；业务恢复稳定后建议删掉 web 自动生成的 LLB policy/class，CLI 重新规范命名一套，避免后续随机故障。
暂无评论
1. 检查物理链路状态
display interface brief 查看接口是否UP
display link-aggregation verbose 确认聚合组成员状态
2. 检查负载均衡配置
display loadbalance link-group 查看链路组状态
display loadbalance link 查看各链路健康状态
确认健康检测配置：display loadbalance probe
3. 检查路由配置
display ip routing-table 确认等价路由是否存在
display policy-based-routing 检查PBR是否影响转发
4. 检查安全策略
display security-policy ip 确认是否放行相关流量
display object-policy ip 查看地址对象配置
5. 抓包定位
debugging ip packet 或使用 packet-capture 在接口抓包
确认报文是否从故障链路发出
6. 常见原因
健康检测失败导致链路被摘除
接口IP/网关配置错误
运营商侧线路故障
安全策略未放行健康检测报文
建议先执行 display loadbalance link 查看链路状态，若显示Inactive则检查健康检测配置和物理连通性。
暂无评论
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论