问题现象

M9000配置NAT后,通过debug aspf信息发现,业务流量的反方向报文引流至与正方向报文不同的Blade板卡,进而因匹配不到已有会话表项,被ASPF策略丢弃。

告警信息

不涉及。

原因分析

M9000同一条会话的双向报文,必须被牵引至同一块Blade板卡处理,因此可通过以下步骤进行排查,以检查是否正在异常。

第一步:查看NAT配置是否下刷成功

[M9000]display nat all 

NAT outbound port block group information:                                                                                         

  Totally 8 outbound port block group items.                                                                                        

  Interface: GigabitEthernet1/5/0/24                                                                                               

    port-block-group: 1                                                                                                             

    Config status   : Active                                                                                                       

    Global flow-table status: Active                                                                                               

    Local flow-table status: Active                                                                                                

                                                                                                                                    

  Interface: GigabitEthernet1/5/0/24                                                                                               

    port-block-group: 2                                                                                                            

    Config status   : Active                                                                                                       

    Global flow-table status: Active                                                                                               

Local flow-table status: Active       

确认是否存在, Local 或者是Global 方向的 Inactive状态。

 

Global flow-table status

针对Global地址下发流表的状态

Active:生效

Inactive:不生效

该字段的支持情况与设备的型号有关,请以设备的实际情况为准

Local  flow-table status

针对Local地址下发流表的状态

Active:生效

Inactive:不生效

该字段的支持情况与设备的型号有关,请以设备的实际情况为准

Reasons for flow-table inactive status

当下发流表的状态为Inactive时,显示流表不生效的原因

其中,Not enough resources are available to complete the operation表示因为资源不足导致下发流表失败

该字段的支持情况与设备的型号有关,请以设备的实际情况为准

                                                                                        

第二步:查看openflow 表象是否下发成功。

display system internal openflow instance inner-redirect flow-table 

     确认openflow表是否存在.

[M9000-probe]display system internal openflow instance inner-redirect flow-table                                                                                  

Instance 4097 flow table information:                                                                                              

                                                                                                                                   

Table 200 information:                                                                                                              

 Table type: Extensibility, flow entry count: 40, total flow entry count: 40                                                       

                                                                                                                                    

Flow entry 206 information:                                                                                                        

 cookie: 0x0, priority: 5525, hard time: 0, idle time: 0, flags: check_overlap                                                     

 |reset_counts|no_pkt_counts|no_byte_counts, byte count: --, packet count: --                                                      

Match information:                                                                                                                  

 Input interface: XGE1/5/0/25                                                                                                      

 Ethernet destination MAC address: 7425-8a7b-0612                                                                                  

 Ethernet destination MAC address mask: ffff-ffff-ffff                                                                             

 VLAN ID: 3000, mask: 0xfff                                                                                                        

 IP Range: IPv4 destination address from 140.243.0.1 to 140.243.8.49                                                               

Instruction information:                                                                                                           

 Write actions:                                                                                                                     

  Output interface: Blade1/4/0/1

通过表项可以确认引流规则是否存在,同时确认指定的出接口,是否对应正确的Blade板卡或备份组。

                                     

第三步:查看设备上是否有qacl资源,只要是有一块接口卡资源不足,就有可能因为资源不足的问题导致nat 配置下发失败。 因为有些资源是要求全局下刷。会把策略添加到所有的接口板。

 

nat static/ nat server的私网地址的规则不区分接口,要求全局下发

逻辑口上的配置,策略下发的时候会全局下发。

查看qacl资源的方法,请参考其它相关资料。

第四步:确认是否有接口上的MQC 引流策略,导致被MQC策略引走。接口下和全局的qos策略优先与openflow规则。

解决办法

不涉及

建议与总结

不涉及

案例信息

案例类型:经验案例
案例号:201609100006
创建时间:2016年9月10日
更新时间:2016年9月12日
发布时间:2016/9/12 15:43:56
文章密级:游客可见
有效期:长期有效
发布者:金山【技术大咖】 [j06566]
点击次数:1835
评论平均得分:0
关键词:M9000,NAT,OpenFlow
产品线:安全产品
产品系列:M9000系列
产品版本:
故障类型:

常用操作
收藏