°ä²¼¹¦·ò£º2020-11-02
±¾ÎÄ×÷Õߣº°¢²ý
Ó×Èñʱʱ½Óµ½¿Í»§µÄ·´À¡ÊÇ £¬·À»ðǽ²¿ÊðºÃÁ˵«ÊÇÒµÎñ»¹ÊDz»Í¨ £¬ÍùÍùÊøÊÖÎÞ²ß ¡£½ñÌìÓ×Èñ £¬²»²Ø×ÅÒ´×ÅÁË £¬°ÑÕä²Ø¶àÄêµÄ¼ÑÄ𠣬¹ÊÕÏÓ×ÇÏÃÅÄóöÀ´ÈÃϲ»¶Ó×ÈñµÄ¸÷ÈËϸƷϸƷ ¡£
·À»ðǽµÄ°²È«²é³¸öÐÔ
ÍøÂçÔ´ÓÚÉúÑÄÈ´ÓÖ¸ßÓÚÉúÑÄ £¬×÷ΪÍøÂçÊÀ½ç´óÃŵĶ¦¶¦Ì¨¸¦µÄ“°²È«²é³¹Ù“ÏÂÒ»´ú·À»ðǽ £¬ÓÐËû×Ô¼ºÌØÓеē°²È«ÊôÐÔ” £¬×ñÊØÍøÂçÊÀ½çµÄ“°²È«¹æ¶¨” £¬ÎÒÃǾÍÄܸüºÃµÄÔÚ·À»ðǽµÄ¹ÊÕÏÅŲé¹ý³ÌÖÐÓÎÈÐÓÐÓà ¡£ÕâЩ“°²È«ÊôÐÔ”µ¹³ÉÁËÎÒÃÇÔÚÖ´ÐзÀ»ðǽ¹ý³ÌÖеē°í½Åʯ” £¬¹ÌÈ»ÅŲé¹ÊÕϹý³ÌÊǼ²¿àµÄ £¬½â¾öÎÊÌâºóµÄ»¶ÀÖÊÇʼÖÕÃú¿ÌÖµµÃ»ØζµÄ ¡£
·À»ðǽΪÁËÏàÐÅÊý¾Ý°üÊÇ¿ÉÐÅµÄ £¬ÔÚÊÕµ½Êý¾Ý°üµÄʱ³½ÉèÖÃÁËÁ½¸ö“°²È«²é³µã”£º
1 ·´Ïòõ辶²é³Reverse Path Forwarding (RPF)
2 Òì²½²é³£¨asymroute £¬Ò²¾ÍÊǸ÷È˳£ËµµÄÏνÓÆëÈ«ÐԲ鳣©
Á½Ïî²é³Ö»Óж¼ÇÐºÏ £¬²Å»á³ÖÐøÆäËûÄ£¿é²é³ £¬²»È»Ö±½ÓÅ×ÆúÊý¾Ý°ü £¬ÄÇÕë¶ÔÕâÁ½¸ö²é³¸öÐÔÎÒÃÇ·¢Õ¹ÁÄÁÄ£º
·´Ïòõ辶²é³
Ëùν·´Ïòõ辶²é³ £¬µ¥Ò»¾ÙÀý £¬¾ÍÊÇÈôÊÇ´ÓÄÚÍø¿Úport31ÊÕµ½Ò»¸öÊý¾Ý°ü £¬·´ÏòµÄ»Ø°ü±ØÐë´ÓÄÚÍø¿Úport31»ØÈ¥ £¬Ò²¾ÍÊÇҪȷ±£Ô´½øÔ´³ö £¬·´Ö®ÒÔΪ´ËÊý¾Ý°üΪºýŪ°üÖ´ÐÐÅ×Æú×÷Ϊ ¡£Èç¹û £¬·À»ðǽÊÕµ½Êý¾Ý°üÊÇsrc_addr_ip->dst_addr_ipΪ172.16.1.16->219.222.191.72 £¬·À»ðǽ²»»áÖ´ÐÐÆäËûÄ£¿é²é³£¨ÕâЩģ¿é»áÉæ¼°µ½Ô´Ö÷ÕŵØַת»»¡¢UTMµÈ£© £¬¶øÊÇÏÈÖ´Ðз´Ïòõ辶²é³ £¬Æ¾¾Ý·´ÏòÁ÷Á¿219.222.191.72->172.16.1.16 £¬ÔÚ²éÕÒ·ÓɱíºóÈôÊÇÒ²ÊÇ´Óport31³öÈ¥µÄ £¬×¢Ã÷Á÷Á¿ÊÇÕý³£µÄ £¬³ÖÐø´¦ÖÃÆäËûÄ£¿é²é³£»ÈôÊÇ´æÔÚÁíÒ»¸ö·ÓÉͨ·ºÃ±È´Óport32³öÈ¥»òÕßÉõÖÁûÓвéÕÒµ½ÏàӦ·ÓÉ £¬Õâ¸ö½«µ¼Ö·´Ïòõ辶²é³Ê§°Ü·À»ðǽִÐÐÅ×Æú×÷Ϊ ¡£
ʹÓÃdebug flow×¥°üºÅÁî £¬»á·¢ÏÖÓиöÌáÐÑΪ£ºreverse path check fail, drop £¬³ö¸ñÏÔÑÛ £¬Õâ¸öÌáÐѾÍÊÇÒò·´Ïòõ辶²é³Ê§°ÜÖ±½ÓÖ´ÐÐÁËÅ×Æú×÷ΪÁË £¬ÕâÖÖÇé¿ö½¨ÒéÊDzéһϷÀ»ðǽÉϵÄ·ÓÉÅäÖÃÎÊÌâ ¡£
Ò첽·Óɲé³
ËùνÒ첽·ÓÉ²é³ £¬¾ÍÊÇҪȷ±£À´»Øõ辶ҪһÖ £¬±£ÕÏÊý¾ÝÏνӵÄÆëÈ«ÐÔ ¡£È磺tcpµÄÈý´ÎÎÕÊÖµÄÊý¾Ý°ü¶¼Òª¹ý·À»ðǽ £¬Õý³£µÄtcpÈý´ÎÎÕÊÖ½»»¥¹ý³ÌÈçÏ£º
ÈôÊdzöÏÖÀ´»Øõ辶²»Ò»ÖµÄÇé¿ö £¬·À»ðǽÒÔΪ±¨ÎÄÓÐÎÊÌâÖ±½ÓÅ×Æú ¡£
Ó×Èñ´Ë¿Ì¾Í˵˵ÕâÁ÷Á¿×ª·¢ÄÄÀï³öÏÖÎÊÌâÁË £¬´ÓÁ÷Á¿×ª·¢À´¿´PC1½Ó¼û·þÎñÆ÷µÄÁ÷Á¿tcp syn±¨ÎÄת·¢õ辶ÊÇ
PC1->RouterA->NGFW->RouterB->internet->Server £¬»Ø°üsyn+ackµÄת·¢õ辶ÊÇInternet>RouterB>RouterA->PC1 £¬Î´¾¹ý·À»ðǽ £¬ack±¨ÎÄPC1->RouterA->NGFW(Å×Æú±¨ÎIJ»×ª·¢) £¬·À»ðǽ·¢ÏֻỰ״̬²»ÆëÈ«£¨ÎÒûÓп´µ½syn+ack,ÎÒ²»ÐÅÀµÄ㣩 £¬Ö´ÐÐÅ×Æú×÷Ϊ ¡£
ʹÓÃdebug flowºÅÁî¶ÔÊý¾ÝÁ÷·ÖÎöͨ³£»áÌáÐÑΪ£º“org dir, ack in state syn_sent, drop”
µ±È»ÕâÀﻹÓиüΪÆæÝâµÄÊý¾Ýת·¢õ辶 £¬ÈôÊÇÊÇsyn°üת·¢õ辶²»Íâ·À»ðǽ £¬syn+ackµÄ»Ø¸´±¨Îľ¹ý·À»ðǽ £¬ÕâÖÖÇé¿öÏ·À»ðǽÊÇÎÞ·¨ÕÒµ½¶ÔÓ¦µÄ»á»°£¨ÎÒûÓп´µ½syn £¬ÎÒѹ¸ù¾ÍûÓÐÄãµÄ»á»°£© £¬Ö±½ÓÅ×Æú £¬ÕâÖÖÒ²ÊôÓÚÒ첽·ÓɵÄÒ»ÖÖÌØÊⳡ¾° ¡£Ê¹ÓÃdebug flow×¥°üºÅÁî £¬»á·¢ÏÖÓиöÌáÐÑΪ£º“no session matched” ¡£
»¹ÓÐÒ»ÖÖ¾ÍÊÇÀ´»ØµÄ¶þ²ãmac²»Ò»ÖÂÎÊÌâÒ²ÊÇÒ첽·Óɲ鳵ÄÒ»ÖÖÌØÀýÁË £¬Í¨³£ÕâÖÖ³¡¾°³£¼ûÓÚ·À»ðǽͨÃ÷ģʽ²¿ÊðµÄʱ³½ ¡£Ò²¾ÍÊÇÈôÊǹý·À»ðǽµÄÊý¾Ý°üÊÇmac1->mac2[pc1->pc2] £¬»Ø°üµÄʱ³½ÊÇmac3->mac1[pc1->pc2] £¬ÕâÖÖÊý¾Ý°üÒ²ÊÇÓÐÎÊÌâµÄ·À»ðǽ²»»áÔÊÐí¹ýµÄ ¡£
ÄÇ¿ÉÄܸ÷ÈË»áÎÊÓ×Èñ £¬Ò첽·Óɲé³Äܹ»¹Ø¹ØÂ𠣬ÏÖʵҵÎñ³¡¾°²»½¨Òé¹Ø¹ØµÄ £¬×ö·¨ÊÇÕÒµ½µ¼ÖÂÀ´»Øõ辶²»Ò»ÖµÄÔÒò £¬½«Òì²½ÎÊÌâÖÕ½áµô £¬ÓÉÓÚ·À»ðǽ¹Ø¹ØÒì²½²é³ºó £¬¶àÁ´Â·³ö¿ÚµÄ³¡¾°Ô´½øÔ´³öÖ°Äܽ«²»ÉúЧ £¬´úÀí·À»¤ÀàutmÖ°Äܽ«ÎÞ·¨Õý³£¹¤×÷ ¡£
²½ÖèÊÇ£º
#config system settings
#set asymroute enable
#end
´ËºÅÁî¾ÍÊÇÔÊÐí·À»ðǽ´æÔÚÒì²½ £¬ÕâÑù·À»ðǽÄܹ»²»²é³Êý¾Ý°üµÄÏνÓÆëÈ«ÐÔÁË ¡£
#config system settings
#set tcp-session-without-syn enable (ĬÈÏdisable)
#end
´ËºÅÁîÊÇ֪ͨ·À»ðǽÈôÊDz»ÊÇsynµÄ±¨ÎÄÒ»ÑùÒ²Äܹ»´´½¨»á»° ¡£
Êý¾Ý°ü´©Ô½·À»ðǽ´¦Öùý³ÌÏê½â
Õý³£µÄÊý¾Ý°ü´©Ô½·À»ðǽ £¬±ØÒª¾¹ýÄÄЩ¹ý³ÌÄØ£¿Äܹ»Í¨¹ýdebug flowºÅÁî²é¿´Õû¸öÆëÈ«¹ý³Ì ¡£
#diagnose debug enable //¿ªÆôdebug
#diagnose debug flow show console enable //ÆôÓÃdebug flowÏÔʾ´òÓ¡ £¬ÓÐЩ°æ±¾²»±ØÒªÇÃ
#diagnose debug flow show function-name enable //ÏÔʾdebug flow Ö°ÄÜÃû³Æ £¬±ãÓÚ´òÓ¡ÐÅÏ¢Êä³ö £¬ÓÐЩ°æ±¾Äܹ»²»ÓÃÇÃ
#diagnose debug flow filter addr 192.168.1.110 //¹ýÂËÇ°Ìá £¬Ô¤·À×¥°üÎÞÓÃÐÅÏ¢¹ý¶à £¬ÕâÀï¹ýÂ˵ØÖ· £¬filter £¿Äܹ»²é¿´¹ýÂËÄÄЩǰÌá
#diagnose debug flow trace start 100 //ÆðÍ·×¥100ÌõÊý¾ÝÁ÷
ÏÂÃæÊÇÊý¾Ý°ü´©Ô½·À»ðǽµÄÈ«Êý¹ý³Ì £¬ÎÒÃÇһ·À´¿´¿´
id=36871 trace_id=1 msg="vd-root received a packet(proto=6, 192.168.
1.110:51661->119.253.62.131:80) from internal. "id=36871 trace_id=1 msg="allocate a new session-00016920" //internal¿ÚÊÕµ½Êý¾Ý £¬³ÉÁ¢Ð»Ự
id=36871 trace_id=1 msg="find a route: gw-192.168.118.1 via wan1" //²éÕÒµ½Â·Óɱí
id=36871 trace_id=1 msg="find SNAT: IP-192.168.118.28, port-43333" //¼ì²â´æÔÚNATÅäÖÃ
id=36871 trace_id=1 msg="Allowed by Policy-1: SNAT" //Æ¥ÅäÕ½Êõ,ID1
id=36871 trace_id=1 msg="SNAT 192.168.1.110->192.168.118.28:43333"//×öNAT
id=36871 trace_id=3 msg="vd-root received a packet(proto=6,
119.253.62.131:80->192.168.118.28:43333) from wan1." // Wan1¿ÚÊÕµ½·µ»ØÊý¾Ý°ü
id=36871 trace_id=3 msg="Find an existing session, id-00016920, reply direction"¡¡//Êý¾Ý°üÆ¥Åä»á»°id-0001692
id=36871 trace_id=3 msg="DNAT 192.168.118.28:43333->192.168.1.110:51661" //×ö·´ÏòµÄDNAT
id=36871 trace_id=3 msg="find a route: gw-192.168.1.110 via internal" //²éÕÒ·ÓÉ £¬·¢Ë͵½internal¿Ú
id=36871 trace_id=5 msg="vd-root received a packet(proto=6,192.168.1.110:51661->119.253.62.131:80) frominternal." //internal¿ÚÊÕµ½ºóÐøÊý¾Ý°ü
id=36871 trace_id=5 msg="Find an existing session, id-00016920, original direction" //Æ¥Åä»á»°id-0001692¡¡¡¡
id=36871 trace_id=5 msg="enter fast path" //Ö±½Óת·¢
id=36871 trace_id=5 msg="SNAT 192.168.1.110->192.168.118.28:43333" //NAT
×¥ÍêÊý¾ÝÁ÷ºóÄܹ»Í¨¹ýÒÔϺÅÁî¹Ø¹Ø ¡£
#diagnose debug flow trace stop //ÖÕ³¡
#diagnose debug disable //¹Ø¹Ø
#diagnose debug reset //³ÁÖÃ
#diagnose debug flow filter clear //Äܹ»Çå¿ÕdebugµÄ¹ýÂËÇ°ÌáÉèÖÃ
ͨ¹ýdebug flowºÅÁîÎÒÃÇÄܹ»¿´µ½Ò»¸öÊý¾Ý°üÁ÷Èë·À»ðǽºó £¬¸÷¸öÄ£¿éµÄ¾ßÌå´¦ÖÃÇé¿ö £¬Õû¶Ù³ÉÊý¾Ý°ü´¦ÖÃÁ÷³ÌͼÈçÏ£º
ÏÂÃæÒ²Ò»²¢½éÉÜһЩÓ×ÈñʱʱÓöµ½µÄdebug flow¹Ø¼üÐÅÏ¢ÌáÐÑ £¬ÏÖ×ܽáÈçÏ£º
ÈôÊÇÊÇÕ½Êõ»Ø¾øÁËÊý¾Ý°ü½Ó¼û £¬»á¿´µ½“Denied by forward policy check” £¬±ØÒª³ÁµãÈ·ÈÏÊÇ·ñÊÇ°²È«Õ½ÊõÀ¹½ØËùÖ ¡£
ÈôÊÇÎÞ·¨Õý³£ÖÎÀí·À»ðǽµÄʱ³½ £¬debug flowÍùÍù»á³öÏÖÌáÐÑ £¬msg="iprope_in_check() check failed, drop" £¬Í¨³£»áÓÐÏÂÁÐÈýÖÖ¿ÉÄÜÔÒòËùÖ£º
1¡¢µ±½Ó¼ûNGFW½øÐÐÔ¶³ÌÖÎÀí£¨ping, telnet, ssh ...£©Ê± £¬ÔÚ½Ó¼ûµÄ·þÎñδÔÚ½Ó¿ÚÉÏÆôÓà ¡£
2¡¢µ±½Ó¼ûNGFW½øÐÐÔ¶³ÌÖÎÀíʱ£¨ping, telnet, ssh ...£© £¬ÔÚ½Ó¼ûµÄ·þÎñÔÚ½Ó¿ÚÉÏÆôÓà £¬µ«ÊÇÅäÖÃÁËÊÜÐÅÀµµÄÖ÷»ú £¬ÕâЩÖ÷»úÓëÈëÕ¾Êý¾Ý°üµÄÔ´IP²»Æ¥Å䣻
3¡¢µ±Í¨¹ýͳһNGFWµÄÁíÒ»¸ö½Ó¿Ú½Ó¼ûÓÃÓÚÔ¶³ÌÖÎÀíµÄNGFW½Ó¿Ú£¨ping £¬telnet £¬ssh ...£©Ê± £¬²»´æÔÚ·À»ðǽսÊõ ¡£
Õ½Êõ×÷Ϊ»Ø¾ø,»òÉäÖÐÒþº¬Õ½Êõ, Êý¾Ý°ü±»»Ø¾ø £¬Í¨³£»áÌáÐÑ£ºmsg="Denied by forward policy check"
ÈôÊÇÉæ¼°ALGÓйػỰ£¨ÕâÀàÁ÷Á¿Í¨³£ÊǶ¯Ì¬¶àͨ·ºÍ̸Èçftp¡¢sipµÈ £¬´ËÀàºÍ̸½Ï¸´ÔÓ £¬Ó×ÈñÏ´ÎÔÙ¸ú¸÷ÈË·ÖÏí £¬ÎûÎû£©½«ËÍÖÁ session-helper Ä£¿é´¦Öà £¬Í¨³£»áÌáÐÑ£ºmsg="run helper-ftp(dir=original)"
¿´µ½ÕâÀï £¬Ó×ÈñÏàÐÅÄúÒ²ºÍÓ×ÈñÒ»Ñùget Á˲»ÉÙ·À»ðǽµÄ×¥°üºÅÁîÁË°É£¿ÄÇô½ÓÏÂÀ´ÎÒÃdzÖÐøÉî¿Ì¿´Ï½ø½×°æ°¸Àý·ÖÎö°É ¡£
½ø½×°¸ÀýչʾһϺÅÁîÓжàôÉñÆæ^-^
ÏÖ³¡·´À¡µÄÍØÆ˵¥Ò»ÃèÊöÈçÏ£º
È«ÐÂÏÂÒ»´ú·À»ðǽ×ö¶Ë¿ÚÓ³Éä £¬²¿ÃÅISPרÍøIP½Ó¼û¶Ë¿ÚÓ³ÉäµÄÒµÎñ²»Í¨ ¡£»ù´¡µÄÅäÖòé³Ò²Ã»Óп´³öÎÊÌâµØµã £¬ÄǽÓÏÂÀ´Ê¹ÓÃ׳´óµÄdebug flow¶ÔÆäÊý¾ÝÁ÷½øÐⶻñ £¬ÔÚÐÅÏ¢Êä³öÖз¢ÏÖ·À»ðǽ±¾µØ»Ø¸´ÁËRST±¨ÎÄ£¨Ò²¾ÍÊÇͼÖеÄ...from local. flag [R]£© £¬ÕâµãÉõÊÇ¿ÉÒÉ £¬×¢Ã÷ÎÊÌ⻹ÊdzöÔÚ·À»ðǽµÄÄĸöÄ£¿é´¦Öû·½ÚÉÏ ¡£
ÄÇÎÒÃÇһ·¿ª¶¯ÄÔ½î˼ÂÇÒ»ÏÂʲôÇé¿öÏ·À»ðǽ»á×Ô¶¯·¢ËÍRST°ü£¿
´ÓÊý¾Ý°üת·¢ÉÏÎÒÃÇ°ÑÎȵ½tcp syn½«Í¨¹ý·À»ðǽ £¬µ«Êǵ±½Ó¹Üµ½tcp syn / ackʱ £¬NGFW»á½«tcp rst·¢ËÍ»Øtcp syn / ackµÄʼ·¢Õß ¡£
¼´±ã´æÔÚÔÊÐíÁ÷Á¿Í¨¹ýNGFWµÄÕ½Êõ £¬ÅäÖÃÃýÎóµÄIPpool»òVIP[l7] Ò²»áΪTCPÏνÓÔì³ÉÏνÓÎÊÌâ ¡££¨Ãû´ÊÚ¹ÊÍ£ºÕâÀïµÄippoolͨ³£ÊÇÓÃÔÚÉÏÍø×öÔ´µØַת»»µÄʱ³½ £¬Ò»¸öµØÖ·²»¹»Óà £¬Äܹ»°ÑÄÚÍøµÄÔ´µØַת»»³ÉÒ»¸öµØÖ·¶ÎÁìÓòÄڵĵØÖ· £¬VIPÊÇ·À»ðǽµÄ¶Ë¿ÚÓ³Éä £¬Ò²¾ÍÊǸ÷È˳£ËµµÄÖ÷ÕŵØַת»»¹Øϵ£©
ͨ³£ÕâÖÖÎÊÌâµÄ¿ÉÄÜÐÔÊÇ£º±¾µØÓÐÏàÓ¦µÄIPµØÖ·£¨ºÃ±ÈÊÇÔ´µØÖ·£©ÁË £¬ÓÉÓÚûÓжÔÓ¦µÄ·þÎñÔÚ¼àÌý £¬»áÈ¥ÏìÓ¦RST±¨ÎÄ £¬ÒÀÕÕÕâÖÖÅŲé˼·ȥ²é³ÅäÖà ¡£
ÄÇÎÒÃÇ°ÑÎÊÌâµãËø¶¨ÔÚIPPool»òVIPÉϳÁµãÅÅ²é £¬Í¨¹ýÅäÖò鿴ÕÒµ½ÁËÕâ¸öʼ×÷Ù¸Õß ¡£½«¶ÔÓ¦ÃýÎóµÄÕ½ÊõÅäÖÃɾ³ýÎÊÌâ½â¾ö ¡£
¾È·ÈÏÏÖ³¡Ô´µØÖ·10.85.40.3Ò²¼Óµ½ÁËÐé¹¹ipÓ³ÉäÀïÁË ¡£¶ÔÓÚ·À»ðǽÅäÖò»Ì«ÊìϤµÄÍùÍù¿ÉÄÜ»á³öÏÖÕâÖÔìæ¹ÖµÄÅäÖà £¬ÓÐʱ³½Õ½ÊõÒ»¶àÕæµÄÓÃÈâÑۺܲ»ºÃ¿´³öÎÊÌâ³öÔÚÄĶù ¡£
ͨ³£³öÏÖ·À»ðǽ»Ø¸´...from local. flag [R]µÄÇé¿öÓÐÈçÏÂÈýÖÖ:
1¡¢½«·þÎñÆ÷µØÖ·ÅäÖõ½ÁËIPpoolÀ
2¡¢½«¿Í»§¶ËIPµØÖ·ÅäÖõ½ÁËIPpoolÀ
3¡¢½«¿Í»§¶ËIPµØÖ·ÅäÖõ½ÁËVIPÀï ¡£
×ܽá
Debug flowºÅÁîÊÇ·À»ðǽִÐв¿Êð¹ý³ÌÖÐʹÓÃƵÂʼ«¸ß £¬²¢ÇÒ¹ÊÕÏÕï¶ÏÎÊÌⶨλÂÊ¿É´ï80%×óÓÒ £¬ÕæµÄÊÇËãÉÏÊÇ°®Ëµ´óÕæ»°µÄºÅÁîÁË £¬ÌáÐÑʲôÔÒòͨ³£¹ÊÕϾͶ¨Î»³öÀ´ ÁË £¬ÊÇÓ×ÈñÁ¦¼öÐè°ÑÎյĺÅÁî £¬Ñ§»áÁ˾ÍÊÇ°ÑÎÕÁËÉϳËÎ书ÁËŶ £¬Ò»Â·½¨Á¶ÆðÀ´°É ¡£
ÎĵµÆÀ¼Û
