D.display firewall server-map
https://support.huawei.com/enterprise/fr/doc/EDOC1000057173?section=j00m
19.3.2 display firewall server-map
Function
Using the display firewall server-map command, you can view information about the server map table.
Parameters
| Parameter | Description | Value |
|---|
| dynamic | Displays server map table entries that are dynamically generated. | - |
| ip-address | Displays server map table entries that include the specified IP address. | The value is in dotted decimal notation. |
| static | Displays server map table entries that are manually generated. | - |
| no-pat | Displays server map table entries that are generated in NO-PAT mode. | - |
| slb | Displays server map table entries that are generated in SLB mode. | - |
| vpn-instance vpn-instance-name | Specifies the VPN instance name . | The value is a string in the range of 1 character to 31 characters. |
| public | Displays the server map entries of the public VPN instance. | - |
Usage Guidelines
In the case of the user-defined ASPF, information about server map table entries is generated only when actual traffic exists.
Example
# Displays the server map table.
<sysname> display firewall server-mapserver-map 6 item(s)
------------------------------------------------------------------------------
ASPF: 10.0.0.5 -> 10.0.0.10:2165 , Zone: ---
Protocol: tcp(Appro: ftp-data), Left-Time: 00:00:05, Addr-Pool: ---
VPN: public --> public
STUN : any -> 10.0.0.10:4967, Zone: ---
Protocol: udp(Appro: ---), Left-Time: 00:00:05,Addr-Pool: ---
VPN: public --> public
Nat Server, any -> 10.10.1.100:21[10.1.1.2:21], Zone:---
Protocol: tcp(Appro: ftp), Left-Time:---, AddrPool: ---
VPN: public --> public
Nat Server Reverse, 10.1.1.2[10.10.1.100] -> any, Zone:---
Protocol: any(Appro: ---), Left-Time:---, AddrPool: ---
VPN: public --> public
No-Pat: 10.1.1.2[10.10.1.100] -> any, Zone: untrust
Protocol: any(Appro: ---), Left-Time: 00:00:03, Addr-Pool: 61
VPN: public --> public
No-Pat Reverse, any -> 10.10.1.100[10.1.1.2], Zone: untrust
Protocol: any(Appro: ---), Left-Time: 00:00:03, Addr-Pool: ---
VPN: public --> public
# The format of the server map entry is as following:
TYPE: SRCADDR -> DSTADDR, Zone: ZONE-NAME
Protocol: PROTOCOL(Appro: APPPRO), Left-Time: HH:MM:SS, Addr-Pool: POOLID
Vpn: SRCVPN -> DSTVPN
Table 19-11 Description of the display firewall server-map command output
Item | Description |
|---|
| TYPE | There are the following types of server map entries: ASPF: Indicates the entry generated when the ASPF function is adopted to forward the traffic of multi-channel protocols. STUN: Indicates the forward entry generated when the ASPF function is adopted to forward the traffic of STUN protocols. STUN Reverse: Indicates the reverse entry generated when the ASPF function is adopted to forward the traffic of STUN protocols. NAT Server: Indicates the forward entry generated when the NAT policy server mapping function is adopted. NAT Server Reverse: Indicates the reverse entry generated when the NAT policy server mapping function is adopted. No-Pat: Indicates the forward entry generated when the NAT No-PAT function is adopted. No-Pat Reverse: Indicates the reverse entry generated when the NAT No-PAT function is adopted. SLB: Indicates the entry generated when the server load balancing function is adopted. SLB Reverse: Indicates the reverse entry generated when the server load balancing function is adopted. Unknown: Indicates the entry of an unknown type.
|
| SRCADDR -> DSTADDR | Specifies the source and destination IP addresses of the entry. If this parameter is not specified, any is displayed. The IP address format is x.x.x.x:portx[y.y.y.y:porty]. portx and porty
indicate the source
and destination port numbers respectively. Content in square brackets
indicates the IP address after NAT. If no NAT is implemented, the
content in square brackets is not displayed. If the port is not required
or translated, :port is not displayed. NOTE: For
the entry of the SLB type, a destination IP address may be translated
into multiple addresses. Therefore, obverse entries generated when the
server load balancing function is enabled do not display the post-NAT
addresses.
And the format of destination IP address is x.x.x.x:port[---]. |
| Zone: ZONE-NAME | Indicates
the name of the security zone, which is specified for the global IP
address of NAT policy server mapping, for the entry of the NAT policy
server mapping. For the entry of the NAT No-PAT type, the name of the security zone
where the destination IP address is displayed. For the server map entry of another type, the name of the security zone is displayed as ---. |
| Protocol: PROTOCOL(Appro: APPPRO) | Indicates the protocol adopted by the entry. PROTOCOL specifies the transport-layer protocol, and APPPRO specifies the application-layer protocol. If no protocol is specified, any is displayed. |
| Left-Time: HH:MM:SS | Indicates the remained aging time of the entry. The entry that does not age is displayed as ---. |
| Addr-Pool: POOLID | Indicates the ID of the address pool adopted during NAT. The ID is displayed in the forward entry of the NAT No-PAT type, and --- are displayed in the entries of other types. |
| Vpn: SRCVPN -> DSTVPN | Indicates the names of the source and destination VPN instances for NAT. |
