How to debug packet loss on a NGFW V5R1

rayma2010 · Created Apr 1, 2017 09:16:47

In order to identify why packets are discarded on the firewall, we can make use of the debugging dataplane trace command which enables the debugging function of packet tracing on the data plane and can provide information about the discard cause.

The command can be used in the user view in order to trace how the packets are processed at the data plane or to specificaly trace the discarded packets. The command also provides the possibility to select the traffic of interest by making use of an ACL.

Format

debugging dataplane trace [ discard [ type ] ] acl acl-number [ number num ] [ slot slot-id cpu cpu-id ]

undo debugging dataplane trace [ slot slot-id cpu cpu-id]

Example

Enable debugging function of packet tracing on the data plane to identify why packets sourced from 192.168.100.228 are not reaching the firewall.

1. Define an ACL to select the traffic sourced from the 192.168.100.228 IP address

acl 3002

rule permit ip source 192.168.100.228 0

2.Enable debugging to trace the discarded packets that match the acl

<USG>terminal monitor

Info: Current terminal monitor is on.

<USG>terminal debugging

Info: Current terminal debugging is on.

<USG>debugging dataplane trace discard acl 3002

# <4:3> 254878077
interface:Vlanif5 zone:untrust VRF:public -> public TCP flag:SYN 192.168.100.228:42602 -> 10.10.10.10:7547 pkt-id:63604

packet filter process

DROP: packet filter default deny //traffic is dropped by the default deny rule of the security policy

How to debug packet loss on a NGFW V5R1

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

How to debug packet loss on a NGFW V5R1

Third Party’s Trade Secret

My Followers