No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>


To have a better experience, please upgrade your IE browser.


FAQ-How to debug packet loss on a NGFW V5R1

Publication Date:  2016-11-30 Views:  829 Downloads:  0
Issue Description

Packets are discarded on the firewall and a session cannot be established.


In order to identify why packets are discarded on the firewall, we can make use of the debugging dataplane trace command which enables the debugging function of packet tracing on the data plane and can provide information about the discard cause.

The command can be used in the user view in order to trace how the packets are processed at the data plane or to specificaly trace the discarded packets.  The command also provides the possibility to select the traffic of interest by making use of an ACL.


debugging dataplane trace [ discard [ type ] ] acl acl-number [ number num ] [ slot slot-id cpu cpu-id ]

undo debugging dataplane trace [ slot slot-id cpu cpu-id]


Enable debugging function of packet tracing on the data plane to identify why packets sourced from  are not reaching the firewall.

1.  Define an ACL to select the traffic sourced from the IP address

acl 3002

 rule permit ip source 0

2.Enable debugging to trace the discarded packets that match the acl

<USG>terminal monitor

Info: Current terminal monitor is on.

<USG>terminal debugging

Info: Current terminal debugging is on.

<USG>debugging dataplane trace discard  acl 3002

# <4:3> 254878077
interface:Vlanif5 zone:untrust VRF:public -> public TCP  flag:SYN -> pkt-id:63604

 packet filter process

 DROP: packet filter default deny  //traffic is dropped by the default deny rule of the security policy