组网及说明
不涉及
告警信息
<Internet>*Sep 20 21:12:34:101 2026 Internet IPFW/7/IPFW_PACKET: -COntext=3;
Receiving, interface = Route-Aggregation1.10
version = 4, headlen = 20, tos = 16
pktlen = 60, pktid = 26965, offset = 0, ttl = 63, protocol = 6
checksum = 32843, s = A, d = B
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
VsysID = 1
prompt: Receiving IP packet from interface Route-Aggregation1.10.
Payload: TCP
source port = 39090, destination port = 2020
sequence num = 0x5f0d457f, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0xd2a8, header length = 40.
*Sep 20 21:12:34:102 2026 Internet IPFW/7/IPFW_INFO: -COntext=3;
MBUF was intercepted! Phase Num is 0(pre all), Service ID is 6(spa), Bitmap is 200000000000000, return 1(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is Route-Aggregation1.10,
s= A, d= B, protocol= 6, pktid = 26965
VsysID = 1.
问题描述
现场防火墙做零信任网关，想在虚墙（也配置了被零信任网关纳管）上边做个源nat转换的纯转发，报文从Ragg1.10上来，然后再从Ragg1.10出去，在1.10上做源nat
Debug发现报文直接被spa丢弃
<Internet>*Sep 20 21:12:34:101 2026 Internet IPFW/7/IPFW_PACKET: -COntext=3;
Receiving, interface = Route-Aggregation1.10
version = 4, headlen = 20, tos = 16
pktlen = 60, pktid = 26965, offset = 0, ttl = 63, protocol = 6
checksum = 32843, s = A, d = B
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
VsysID = 1
prompt: Receiving IP packet from interface Route-Aggregation1.10.
Payload: TCP
source port = 39090, destination port = 2020
sequence num = 0x5f0d457f, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0xd2a8, header length = 40.
*Sep 20 21:12:34:102 2026 Internet IPFW/7/IPFW_INFO: -COntext=3;
MBUF was intercepted! Phase Num is 0(pre all), Service ID is 6(spa), Bitmap is 200000000000000, return 1(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is Route-Aggregation1.10,
s= A, d= B, protocol= 6, pktid = 26965
VsysID = 1.
过程分析
spa就是零信任模块，说明这个流量没走nat，直接被零信任丢弃
经过确认spa要求通过inode客户端敲门后才能放通流量
如果有其他非零信任的流量，建议不要开spa
解决方法
单独建立虚墙，把这个接口共享进去，这个虚墙不开spa，就能正常转发了
附：怎么确认设备开没开spa
