华为数通操作手册-VRP全系列-VRP故障处理手册-路由器-04-第4章-ACL故障处理

通用路由平台VRP 故障处理手册TCP/IP篇目 录目 录第4章 ACL故障处理4-14.1 ACL简介4-14.2 ACL故障处理4-14.2.1 典型组网环境4-14.2.2 配置注意事项4-24.2.3 故障诊断流程4-24.2.4 故障处理步骤4-34.3 故障处理案例4-44.3.1 ACL分片选项的规则没有匹配计数4-44.3.2 ACL6的规则匹配顺序不正确4-84.4 FAQ4-134.5 故障诊断工具4-144.5.1 display命令4-144.5.2 debugging命令4-174.5.3 告警4-224.5.4 日志4-26i通用路由平台VRP 故障处理手册TCP/IP篇Error! Reference source not found.ACL故障处理第4章 ACL故障处理本章包含以下内容：l ACL简介介绍ACL的基本概念。l ACL故障处理针对典型的ACL组网环境，配置注意事项，故障处理的流程和详细的故障处理步骤。l 故障处理案例介绍了2个典型的故障处理案例。l FAQ列出了用户常问的问题，并给出了相应的解答。l 故障诊断工具介绍了进行故障处理所需要的故障诊断工具，包括display命令和debugging命令、告警信息、日志信息等。4.1 ACL简介路由器使用访问控制列表ACL（Access Control List）定义过滤数据包的规则。访问控制列表是由permit和deny语句组成的一系列有顺序的规则，这些规则根据数据包的源地址、目的地址、端口号等来定义。ACL通过这些规则对数据包分类。ACL应用到路由器接口上，路由器根据ACL中的规则判断哪些数据包可以接收，哪些数据包需要拒绝。ACL包含对IPv4报文过滤的ACL4和对IPv6报文过滤的ACL6。4.2 ACL故障处理4.2.1 典型组网环境ACL组网环境如Error! Reference source not found.所示。某公司通过一台路由器的接口Serial1/0/0访问Internet，路由器与内部网通过以太网接口Ethernet1/0/0连接。公司内部对外提供WWW、FTP和Telnet服务，公司内部子网为，其中，内部FTP服务器地址为，内部Telnet服务器地址为，内部WWW服务器地址为，公司对外地址为。图4-1 ACL组网环境通过配置ACL及防火墙，可以实现以下功能：l 外部网络只有特定用户可以访问内部服务器。l 内部网络只有特定主机可以访问外部网络。4.2.2 配置注意事项配置项子项注意事项配置ACL组创建访问控制列表一定要根据组网的需求来选择号合适的ACL的类型配置ACL组下的规则创建规则根据需求描述规则，一定要考虑清楚组网的应用其他的模块引用配置好的ACL各个模块会不一致见各个模块查看ACL的匹配状态可以查看到被引用了的ACL组下的各个规则有多少个报文被匹配到无4.2.3 故障诊断流程故障诊断流程如所示：图4-2 ACL故障处理流程4.2.4 故障处理步骤概要的故障处理步骤如下：步骤操作1检查引用ACL的模块的配置信息是否正确2检查路由器接收到的报文是否是用户所期望的3引用的ACL的类型是否合理4引用的ACL组下的规则是否合理详细的故障处理步骤如下：1. 检查引用ACL的模块的配置信息是否正确首先应该从最上层检查找问题的原因。确定引用ACL的模块的设置是否正确，相应使能开关应该处于打开或关闭状态，如分片检测开关是否打开。2. 引用的ACL的类型是否合理然后再检查使用的ACL的类型能否满足用户的需求。ACL分为基本ACL（取值范围是20002999）、高级ACL（取值范围是30003999）、基于接口的ACL（取值范围是10001999）。不同类型的ACL有不同的应用场景，所以，必须根据具体的应用场景选择使用合适的ACL。例如在路由策略中，用ACL对路由进行过滤时，由于高级ACL的选项比较多，配置复杂，有可能达不到预期效果，因此推荐使用编号为20002999的基本ACL。3. 检查路由器接收到的报文是否是用户所期望的如果引用ACL的模块配置上没有问题，但是ACL的匹配不是用户所期望的，这时可以利用ACL提供的过滤功能来将路由器上收发的报文打印出来，以便做进一步的分析定位问题。4. 引用的ACL组下的规则是否合理根据上步得到的报文的数据，分析ACL的规则匹配是否正确，用户是否正确获取到所期望的报文。如果有问题则进行修改。当经过以上的各项检查后ACL还是无法正常工作，可以登陆网站联系华为的技术支持工程师。4.3 故障处理案例4.3.1 ACL分片选项的规则没有匹配计数1. 网络环境图4-3 ACL配置的组网环境RouterA的配置：#interface Ethernet4/2/0 ip address #RouterB的配置：# firewall enable slot 1 firewall enable slot 2 firewall enable slot 3 firewall enable slot 4 firewall enable slot 5 firewall enable slot 7 #acl number 2000 rule 5 permit source 0 fragment rule 10 deny#interface Ethernet4/2/0 ip address firewall packet-filter 2000 inbound firewall packet-filter 2000 outbound #2. 故障分析RouterA的Ethernet 4/2/0接口MTU值为1500。从RouterA的Ethernet 4/2/0接口向RouterB的Ethernet 4/2/0接口ping大小为8100字节的大包，ping不通，并且RouterB的接口Ethernet 4/2/0上引用的ACL 2000的规则5的匹配计数为零。(1) 首先在RouterB上执行命令display current-configuration，查看防火墙的使能开关是否打开 display current-configuration# firewall enable slot 2 firewall enable slot 3 firewall enable slot 4 firewall enable slot 5 firewall fragments-inspect slot 2#4号槽的防火墙开关已经打开，排除这个原因。(2) 在RouterB上执行命令display current-configuration，查看防火墙的分片检测开关是否打开 display current-configuration# firewall enable slot 2 firewall enable slot 3 firewall enable slot 4 firewall enable slot 5 firewall fragments-inspect slot 2#4号槽的防火墙分片检测开关没有打开，排除这个原因。(3) 在RouterB上对与RouterA间的ping报文进行调试 system-viewRouterB acl 3000RouterB-acl-adv-3000 rule 5 permit icmp source 0 destination 0RouterB-acl-adv-3000 rule 10 permit icmp source 0 destination 0RouterB-acl-adv-3000 rule 15 deny icmp在用户视图下执行如下命令，打开调试开关，查看调试信息。 debugging ip packet acl 3000 terminal debuggingInfo:Current terminal debugging is on terminal monitorInfo:Current terminal monitor is on *0. Quidway IP/8/debug_case:Slot=4; Receiving, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 722, offset = 0, ttl = 255, protocol = 1, checksum = 40658, s = , d = prompt: Receiving IP packet from Ethernet4/2/0 *0. Quidway IP/8/debug_case:Slot=4; Discarding, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 722, offset = 0, ttl = 255, protocol = 1, checksum = 40658, s = , d = prompt: Droped by firewall sec! *0. Quidway IP/8/debug_case:Slot=4; Receiving, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 724, offset = 0, ttl = 255, protocol = 1, checksum = 40656, s = , d = prompt: Receiving IP packet from Ethernet4/2/0 *0. Quidway IP/8/debug_case:Slot=4; Discarding, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 724, offset = 0, ttl = 255, protocol = 1, checksum = 40656, s = , d = prompt: Droped by firewall sec! *0. Quidway IP/8/debug_case:Slot=4; Receiving, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0,pktlen = 84, pktid = 726, offset = 0, ttl = 255, protocol = 1, checksum = 40654, s = , d = prompt: Receiving IP packet from Ethernet4/2/0 *0. Quidway IP/8/debug_case:Slot=4; Discarding, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 726, offset = 0, ttl = 255, protocol = 1, checksum = 40654, s = , d = prompt: Droped by firewall sec! *0. Quidway IP/8/debug_case:Slot=4; Receiving, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 728, offset = 0, ttl = 255, protocol = 1, checksum = 40652, s = , d = prompt: Receiving IP packet from Ethernet4/2/0 *0. Quidway IP/8/debug_case:Slot=4; Discarding, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 728, offset = 0, ttl = 255, protocol = 1, checksum = 40652, s = , d = prompt: Droped by firewall sec! *0. Quidway IP/8/debug_case:Slot=4; Receiving, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 730, offset = 0, ttl = 255, protocol = 1, checksum = 40650, s = , d = prompt: Receiving IP packet from Ethernet4/2/0 *0. Quidway IP/8/debug_case:Slot=4; Discarding, interface = Ethernet4/2/0, version = 4, headlen = 20, tos = 0, pktlen = 84, pktid = 730, offset = 0, ttl = 255, protocol = 1, checksum = 40650, s = , d = prompt: Droped by firewall sec!从调试信息中可以看到：RouterB上收到了源地址为的分片报文。但被RouterB的Ethernet 4/2/0接口上的ACL规则过滤掉。因此，故障的实际原因是RouterB上的过滤规则错误。正确的配置应该如下。 system-viewRouterB acl 2000RouterBacl-basic-2000 rule 5 permit source 0 fragmentRouterBacl-basic-2000 rule 10 permit source 0 fragmentRouterBacl-basic-2000 rule 15 permit source 0RouterBacl-basic-2000 rule 20 permit source 0RouterBacl-basic-2000 rule 25 deny这样就可以ping大报文，并且匹配计数正确显示。3. 处理步骤步骤操作1确定RouterB上的防火墙使能开关是否打开。正确情况下是打开的。2确定RouterB上的防火墙的分片检测开关是否关闭。正确情况下是关闭的。3利用ACL的过滤功能，打开调试开关，确认RouterB上收到和发出的报文，确定ACL规则配置是否正确4. 案例总结对于ACL的故障，可以按照下面的步骤进行检查。(1) 首先需要分析应用的场景，确定规则是否合理。(2) 然后再用ACL的过滤功能来查看路由器上的接收和发送的报文的详细信息，如果和以前设想的不一致，就需要重新配置规则。(3) 最后检查其他的模块在使用ACL时的设置是否正确。4.3.2 ACL6的规则匹配顺序不正确1. 网络环境图4-4 ACL6组网图(1) RouterA的配置# ipv6#interface Ethernet4/2/0 ipv6 address 10:20:152/64#(2) RouterB的配置# firewall enable slot 1 firewall enable slot 2 firewall enable slot 3 firewall enable slot 4 firewall enable slot 5 firewall enable slot 7# ipv6#acl ipv6 number 3000 rule 0 permit icmpv6 source 10:20:151/128 destination 10:20:152/128 rule 1 permit icmpv6 source 10:20:152/128 destination 10:20:151/128 rule 2 deny icmpv6#interface Ethernet4/2/0 firewall packet-filter ipv6 3000 inbound firewall packet-filter ipv6 3000 outbound ipv6 address 10:20:151/64 #2. 故障分析从RouterA上ping RouterB不通。首先查看ACL的匹配计数，发现匹配的都是规则2，ping的报文都被过滤掉了。另外，匹配计数不正确，只ping了5个报文，匹配计数却增加了9个。根据配置命令，发出报文的源地址应该是10:20:151或10:20:152，即，应该匹配规则0或者规则1，不应该匹配规则2。防火墙的开关在所有的接口板上都打开了，所以不是它的问题。利用ACL的Debug过滤报文的功能，查看RouterB上Ethernet 4/2/0入接口和出接口的报文收发情况。配置如下：RouterB acl ipv6 3002RouterB-acl6-adv-3002 rule permit icmpv6 source 10:20:151 128 destination 10:20:152 128 RouterB-acl6-adv-3002 rule permit icmpv6 source 10:20:152 128 destination 10:20:151 128RouterB-acl6-adv-3002 rule deny icmpv6RouterB-acl6-adv-3002 quit RouterB quit debugging ipv6 packet acl 3002 terminal debuggingInfo:Current terminal debugging is on terminal monitor Info:Current terminal monitor is on从RouterA上ping RouterB，在RouterB上并没有输出任何调试信息。调整ACL的规则，去掉对目的地址的匹配：RouterB-acl6-adv-3002 undo rule 0 destinationRouterB-acl6-adv-3002 undo rule 1 destination再次从RouterA上ping RouterB，RouterB上输出如下调试信息：*0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited! *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Receiving, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: IPv6 packet received *0. RouterB IPV6PP/8/debug_ipv6:Slot=4; Discarding, interface = Ethernet4/2/0, version = 6, traffic class = 0, flow label = 0, payload length = 32, protocol = 58, hop limit = 255, Src = 10:20:152, Dst = FF02:1:FF00:151, prompt: Administratively prohibited!从以上调试信息看出，RouterA发来的ping报文（ICMP报文）目的IP地址是FF02:1:FF00:151，而不是RouterB的地址，所以ACL IPv6 3000的规则0和规则1没有被匹配，报文都匹配了规则2，因此被过滤了。查阅IPv6的资料可知，这种报文是为了探测对端的MAC地址而发出的ARP请求报文，是IPv6定时发出的。每次ping之前，IPv6会先发出此种类型的报文来探测对端的MAC地址。如果收到回应，系统才会发出正常的ICMP6的报文。但是配置的规则把探测报文给过滤了，所以就会造成ping不通的现象。3. 处理步骤步骤操作1确认防火墙的使能开关是否打开（应该打开）2利用ACL的debug过滤功能查看路由器上接收和发送的报文3分析规则是否合理，如果不合理则进行修改4. 案例总结对于ACL6模块，也是和ACL4一样的，要充分地利用ACL的debug过滤功能来查看真正发送的报文是什么样的，然后再分析ACL6报文的匹配是否正确，规则配置的是否合理，从而解决问题。4.4 FAQ(1) 问：ACL的匹配顺序，以及返回值是什么？答：ACL的匹配顺序是按照ACL中规则的配置顺序来匹配的。如果ACL的match-order为自动（auto），则按照深度优先的规则进行匹配，即在添加新规则时，会按照规则描述的范围由小到大对规则自动排序。如果match-order为配置（config），即规则的匹配顺序完全遵循用户的配置顺序，先配置的规则将被优先匹配。在ACL规则的匹配过程中，如果匹配上一条规则，就会返回此规则的动作（permit或deny），不会再匹配剩余规则。如果检查完所有的规则后，没有匹配上任何规则，就会返回没有找到可以匹配的规则。对于这种情况，其他模块的处理可以不同，或允许，或拒绝。(2) 问：Time range的Active的条件是什么？答：时间段模块中用户可以配置两种类型的时间段，一种为绝对时间段，另一种为周期时间段。这两种时间段都可以配置多条，在每种时间段之间是“或”的逻辑关系，只要有其中的一条匹配上就为真。只有当这两种类型的时间段都为真时（如果都配置了），整个时间段才是Active的状态，否则就是Inactive的状态。(3) 问：ACL的fragment选项和防火墙的fragment-inspect选项之间的有什么关系？答：ACL模块的分片选项是为了过滤非首片的分片报文而设置的。如果某个规则带有分片选项，则只对分片报文起作用。对其他的报文、首片分片报文和非分片报文不起作用。防火墙中的分片检测功能是指在防火墙模块中对分片报文的处理。如果打开此开关，首先对首片的分片报文进行ACL的匹配操作，确定是允许还是拒绝，然后建立分片表，后续的非首片的分片报文不再进行ACL规则的匹配，而是直接查询分片表，首片允许则允许，首片拒绝则拒绝。所以只有将防火墙的分片检测开关关闭，ACL中的分片选项才起作用。(4) 问：各种类型的ACL分别应用于哪些场景？答：下表列出了ACL的类型和相应的应用场景。表4-1 ACL的类型及其应用场合ACL类型ACL应用场景基于接口的ACL适用于按照接口来过滤报文的情况。基本的ACL适用于按照源地址来过滤报文的情况。高级的ACL功能比较全面，可以按照协议号、源地址、目的地址、源端口号和目的端口号来对报文进行全面的过滤。基于以太网的ACL适用于按照MAC地址来进行过滤报文的情况。简单ACL包含了高级ACL的一部分功能的ACL。二层ACL适用于按照二层信息来对报文进行过滤的情况。基于接口的ACL6适用于对IPV6报文按照接口进行过滤的情况。基本的ACL6适用于对IPV6的报文按照源地址进行过滤的情况。高级的ACL6适用于对IPV6的报文按照协议号、源地址、目的地址、源端口号以及目的端口号等来进行全面过滤的情况。简单ACL6包含了高级ACL6一部分功能的ACL。4.5 故障诊断工具4.5.1 display命令命令内容说明display acl all | acl-number 查看配置的访问控制列表规则可以看到每个规则的内容及匹配计数display time-range all | time-name 查看时间段显示时间段的内容及当前状态display acl ipv6 all | acl-number 查看配置的IPV6的访问控制列表规则可以看到每个规则的内容及匹配计数1. 查看配置的访问控制列表规则# 查看所有规则 display acl all Total nonempty acl number is 3 Interface Based ACL 1000, 1 rule Acls step is 5 rule 5 permit interface Serial3/0/0:0 (0 times matched) Basic ACL 2000, 1 rule, match-order is auto Acls step is 5 rule 5 permit source 56 0 (0 times matched) Advanced ACL 3000, 1 rule Acls step is 5 rule 5 permit tcp source 55 source-port range domain pop2 destination 55 destination-port range 5 29 precedence flash tos 14 time-range t1 (0 times matched)(Inactive)# 查看具体规则 display acl 2000 Basic ACL 2000, 1 rule, match-order is autoAcls step is 5 rule 5 permit source 56 0 (0 times matched) 2. 查看时间段# 查看所有的时间段 display time-range allCurrent time is 15:50:05 9-19-2005 MondayTime-range : t1 ( Active ) from 14:00 2005/9/19 to 18:00 2005/9/19Time-range : t2 ( Inactive ) 10:00 to 12:00 daily# 查看某个具体的时间段 display time-range t1 Current time is 15:50:13 9-19-2005 Monday Time-range : t1 ( Active ) from 14:00 2005/9/19 to 18:00 2005/9/19 3. 查看配置的IPv6的访问控制列表规则# 查看所有的IPv6访问控制列表规则 display acl ipv6 all Total nonempty acl6 number is 3 Interface Based IPv6 ACL 1000, 1 rule rule 0 permit interface Ethernet2/2/0 (0 times matched) Basic IPv6 ACL 2000, 1 rule rule 0 permit source 10:20:151/128 (0 times matched) Advanced IPv6 ACL 3000, 2 ru