Version ：AR2200 V200R006C10SPC300PWE
Issue Description： The intranet users can’t connect to internet.
Problem Analysis :
1. The intranet terminal ping router AR2220 is normal, intranet terminal ping WAN gateway is not normal.
2. On the egress router AR2220 ping the WAN-side gateway is normal.
As a result, it may be speculated that the NAT table may be generated abnormally.
3. Check out the router's NAT session entry to 110,000, while viewing the memory, there is no memory available for establishing a NAT session.
4. View the contents of the NAT session, there are many port entries for the 445.
5. After the NAT session entry is reset, the number of NAT session entries rapidly increases. The entry with 445 port takes up a lot of resources.
From this we can conclude that the user's service does use port 445 or that the user does not use the port and that the port with the port 445 is sent by the uncontrollable terminal.
6. Configure the traffic policy on the egress router AR2220 to disable port 445
After communicating with the user, it is learned that the user does not use port 445. After the port policy is disabled on port 445 in the router's intranet port. Intranet terminal can be normal Internet access. Check the NAT entry is normal.
Root Cause: The NAT session table has many port 445 sessions that cost the most of forwarding resources, it lead to the forwarding resource is not enough and the new session do not be NAT transited.
Corrective Action : No prohibit port 445 may bring the following risks:
1.Port 445 is a mixed port with which users can easily access various shared folders or shared printers on a local area network, but it is precisely because of this that hackers have an advantage.
2. A large number of packets for the 445 port will quickly occupy a large number of items on the router resources, the router can’t be used in serious cases.
In order to avoid the harm caused by the packet whose port is 445, we suggest the following measures:
1. In the router's internal network port configuration flow policy prohibit the use of 445 ports. After the traffic policy is configured on the router device interface, the device no longer processes packets with destination port 445 and no NAT entries are generated.
The traffic policy configuration is below:
acl number 3333
rule 5 permit tcp destination-port eq 445
rule 10 permit udp destination-port eq 445
#
traffic classifier virus operator or
if-match acl 3333
#
traffic behavior virus
deny
#
traffic policy virus
classifier virus behavior virus
traffic policy 3334
classifier 3334 behavior 3334
#
interface GigabitEthernet0/0/0
traffic-policy virus inbound
traffic-policy virus outbound
#
interface GigabitEthernet0/0/1
traffic-policy virus inbound
traffic-policy virus outbound
#
2. Troubleshooting network terminal poisoning
Although you can use the traffic policy on the router to circumvent this policy, such packets still occupy the intranet bandwidth, which may cause other unpredictable problems. It is recommended that the network terminal anti-virus and turn off port 445.
3. Upgrade the version of AR
The version of AR is V200R006 and no patch, so suggest update the patch or upgrade the version to V200R007C00SPCb00.
If you have any problems, please post them in our Community. We are happy to solve them for you!
