FAQ-How to debug packet loss on a NGFW V5R1

Publication Date:  2016-11-30 Views:  425 Downloads:  0
Issue Description

Packets are discarded on the firewall and a session cannot be established.



Solution

In order to identify why packets are discarded on the firewall, we can make use of the debugging dataplane trace command which enables the debugging function of packet tracing on the data plane and can provide information about the discard cause.

The command can be used in the user view in order to trace how the packets are processed at the data plane or to specificaly trace the discarded packets.  The command also provides the possibility to select the traffic of interest by making use of an ACL.

Format

debugging dataplane trace [ discard [ type ] ] acl acl-number [ number num ] [ slot slot-id cpu cpu-id ]

undo debugging dataplane trace [ slot slot-id cpu cpu-id]


Example

Enable debugging function of packet tracing on the data plane to identify why packets sourced from  192.168.100.228  are not reaching the firewall.


1.  Define an ACL to select the traffic sourced from the 192.168.100.228 IP address

acl 3002

 rule permit ip source 192.168.100.228 0



2.Enable debugging to trace the discarded packets that match the acl


<USG>terminal monitor

Info: Current terminal monitor is on.

<USG>terminal debugging

Info: Current terminal debugging is on.

<USG>debugging dataplane trace discard  acl 3002


# <4:3> 254878077
interface:Vlanif5 zone:untrust VRF:public -> public TCP  flag:SYN 192.168.100.228:42602 -> 10.10.10.10:7547 pkt-id:63604

 packet filter process

 DROP: packet filter default deny  //traffic is dropped by the default deny rule of the security policy



END