Диагностику многих проблем на маршрутизаторе Cisco с операционной системой IOS XE можно начать с Packet Trace. Это трассировка обработки пакета внутри маршрутизатора, появившаяся не так давно. Ранее такой функционала был доступен только на межсетевых экранах ASA. Кто использовал packet-tracer на ASA, согласится – очень удобный инструмент. Теперь его аналог появился и на современных маршрутизаторах (ISR 4000, ASR, CRS).
Заметку я построю на живых примерах. Так проще получить представление о IOS-XE Packet Trace. Детали всегда можно найти на сайте вендора. Жаль, что там пока не много информации на этот счёт. По ходу нашего погружения вы поймёте, о чём я.
В качестве подопытного имеем маршрутизатор ISR 4000 (про специфику работы ISR 4000 и IOS XE я уже писал на Хабре). На нём настроен ряд технологий: статическая маршрутизация, PfR, PBR, трансляция адресов (NAT), межсетевой экран ZFW, ACL на интерфейсах, Flexible NetFlow, NBAR2, IPSec, GRE, VTI и прочее. Всё это сделает трассировку более насыщенной и приближённой к реальной эксплуатации.
Есть множество технологий и у каждой свой метод отладки. Чтобы не тратить время и сразу определить, где искать причину проблемы, как раз и пригодится Packet Trace.
Наблюдать будем за ICMP пакетом (echo request), отправленным с адреса 192.168.20.8 на 8.8.8.8.
Активация трассировки состоит из двух частей. Для начала запускаем условный отладчик (conditional debug). Именно в нём мы указываем, какие пакеты нас интересуют. В нашем случае это трафик, описываемый ACL 199 и поступающий на маршрутизатор через интерфейс GigabitEthernet0/0/0:
access-list 199 permit icmp host 192.168.20.8 host 8.8.8.8
debug platform condition interf GigabitEthernet0/0/0 ipv4 access-list 199 ingress
debug platform condition startУсловный отладчик используется не только для работы packet trace. Этот инструмент позволяет эффективно фильтровать лог-сообщения и сообщения отладчика (debug) на этапе их генерации. Мы можем задать условия и видеть записи, касающиеся только того, что нам нужно.
Далее включаем непосредственно packet trace. Указываем буфер и глубину трассировки. Минимально – 16 пакетов. Глубина: базовая (path-trace) или расширенная (fia-trace). В случае расширенной мы получим детальный вывод работы всех функций внутри процесса QFP. Именно он отвечает за передачу пакетов (datapath).
debug platform packet-trace packet 16 fia-trace
debug platform packet-trace enableПо сравнению с ASA packet-tracer синтаксис, конечно, не такой удобный.
ASA packet-tracer может сам генерировать пакеты для дальнейшей трассировки. IOS-XE Packet Trace этого делать не умеет. Для его работы, необходимо, чтобы пакет откуда-нибудь пришёл.
Команды для чистки хвостов. Пригодятся, когда со всем закончим.
no debug platform packet-trace enable
clear platform packet-trace statistics
clear platform condition all
Всё настроено. Запускаем пинг, чтобы нужный нам пакет прошёл через маршрутизатор.
Смотрим общий вывод по пакетам, попавшим в packet trace.
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 Gi0/0/1.5 FWD Он у нас один. Пришёл через интерфейс Gi0/0/0 и был передан дальше (состояние FWD) через Gi0/0/1.5.
Смотрим трассировку его обработки
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 8
Summary
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
State : FWD
Timestamp
Start : 6495209991683323 ns (02/18/2017 11:59:43.176192 UTC)
Stop : 6495209991814307 ns (02/18/2017 11:59:43.176323 UTC)
Path Trace
Feature: IPV4 <=================
Input : GigabitEthernet0/0/0 <=================
Output : GigabitEthernet0/0/0 <=================
Source : 192.168.20.8 <=================
Destination : 8.8.8.8 <=================
Protocol : 1 (ICMP) <=================
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 4960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 5280 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL
Lapsed time : 40160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e88 - IPV4_INPUT_SRC_LOOKUP_CONSUME
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e68 - IPV4_INPUT_FOR_US_MARTIAN
Lapsed time : 1440 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 236
cft_bucket_number : 566799
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8 <=================
tuple.dst_ip : 8.8.8.8 <=================
tuple.src_port : 61609 <=================
tuple.dst_port : 161 <=================
tuple.vrfid : 0
tuple.l4_protocol : ICMP <=================
tuple.l3_protocol : IPV4 <=================
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 236
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d83558 - IPV4_INPUT_STILE_LEGACY
Lapsed time : 226240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b508 - IPV4_INGRESS_MMA_LOOKUP
Lapsed time : 66880 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d59618 - IPV4_INPUT_FME_PROCESS
Lapsed time : 2560 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000084
input vrf_idx : 0
calling feature : FNF
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 236
cft_bucket_number : 566799
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 61609
tuple.dst_port : 161
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 236
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc84 - IPV4_INPUT_FNF_AOR_FIRST
Lapsed time : 21120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6d9d4 - IPV4_INPUT_FNF_FIRST
Lapsed time : 119520 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e8c - IPV4_INPUT_VFR
Lapsed time : 1280 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b660 - IPV4_INPUT_CENT_SMP_PROCESS
Lapsed time : 3840 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000080
input vrf_idx : 0
calling feature : CENT
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 236
cft_bucket_number : 566799
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 61609
tuple.dst_port : 161
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 236
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b62c - IPV4_INPUT_CENT_RC_PROCESS
Lapsed time : 40640 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7ff70 - IPV4_INPUT_PBR <=================
Lapsed time : 34720 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d858d0 - IPV4_INPUT_TCP_ADJUST_MSS <=================
Lapsed time : 2560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0 <=================
Output : GigabitEthernet0/0/1.5 <=================
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS <=================
Lapsed time : 4160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6dc88 - IPV4_INPUT_FNF_AOR_FINAL
Lapsed time : 1280 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6d974 - IPV4_INPUT_FNF_FINAL
Lapsed time : 218880 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6dc8c - IPV4_INPUT_FNF_AOR_RELEASE
Lapsed time : 2560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e94 - IPV4_INPUT_IPOPTIONS_PROCESS
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac44 - IPV4_INPUT_GOTO_OUTPUT_FEATURE
Lapsed time : 4480 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e98 - IPV4_OUTPUT_VFR
Lapsed time : 1920 ns
Feature: ZBFW <=================
Action : Fwd <=================
Zone-pair name : in-out1 <=================
Class-map name : CM-FW_in-out <=================
Input interface : GigabitEthernet0/0/0 <=================
Egress interface: GigabitEthernet0/0/1.5 <=================
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT
Lapsed time : 721760 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d77188 - MC_OUTPUT_GEN_RECYCLE
Lapsed time : 3680 ns
Feature: NAT <=================
Direction : IN to OUT <=================
Action : Translate Source <=================
Old Address : 192.168.20.8 00001 <=================
New Address : 87.87.87.87 00033 <=================
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d7c390 - IPV4_NAT_OUTPUT_FIA
Lapsed time : 54880 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d85d30 - IPV4_OUTPUT_THREAT_DEFENSE
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e9c - IPV4_VFR_REFRAG
Lapsed time : 960 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Output
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 238
cft_bucket_number : 566799
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 87.87.87.87
tuple.dst_ip : 8.8.8.8
tuple.src_port : 61609
tuple.dst_port : 161
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 238
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d8359c - IPV4_OUTPUT_STILE_CLR_TXT
Lapsed time : 137600 ns
Feature: IPSec <=================
Result : IPSEC_RESULT_DENY <=================
Action : SEND_CLEAR <=================
SA Handle : 0
Peer Addr : 8.8.8.8 <=================
Local Addr: 87.87.87.87 <=================
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d761ac - IPV4_OUTPUT_IPSEC_CLASSIFY
Lapsed time : 50560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e70 - IPV4_OUTPUT_SRC_LOOKUP_ISSUE
Lapsed time : 7040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81128eb0 - IPV4_OUTPUT_L2_REWRITE
Lapsed time : 7040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e74 - IPV4_OUTPUT_SRC_LOOKUP_CONSUME
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131ec4 - IPV4_OUTPUT_FRAG
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81133e50 - IPV4_OUTPUT_DROP_POLICY
Lapsed time : 13600 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6d914 - IPV4_OUTPUT_FNF_FINAL
Lapsed time : 112800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113bb40 - MARMOT_SPA_D_TRANSMIT_PKT
Lapsed time : 41440 nsОбъём трассировки напрямую зависит от настроенных функций. Если бы у нас была только маршрутизация, данных было бы существенно меньше.
Часть названий понятна. Но присутствуют этапы, декодировать которые достаточно непросто. Документация вендора пока в этом плане не сильно помогает.
Выделим наиболее интересные моменты
1. Информация, идентифицирующая наш поток (flow) данных:
Feature: CFT
…
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 61609
tuple.dst_port : 161
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
Данные хранят в таблице CFT (Common Flow Table). Их используют технологии, которые оперируют в своей работе информацией о каждом потоке (Netflow, NBAR, PfR и пр.). Таблица CFT необходима, чтобы не хранить избыточную информацию.
2. Определение исходящего интерфейса:
Когда пакет только попал на маршрутизатор, исходящий интерфейс не определён. Подставляется входящий:
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 8.8.8.8
Protocol : 1 (ICMP)После того как определено, куда дальше слать пакет (выполнена функция маршрутизации), исходящий интерфейс меняется:
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS
Lapsed time : 4160 ns3. Данные об обработке пакета межсетевым экраном ZFW:
Feature: ZBFW
Action : Fwd
Zone-pair name : in-out1
Class-map name : CM-FW_in-out
Input interface : GigabitEthernet0/0/0
Egress interface: GigabitEthernet0/0/1.5Мы сразу видим, между какими зонами проходил пакет, и в какой класс он попал. Это достаточно удобно, так как конфигурация ZFW зачастую очень запутана.
4. Информация о трансляции адресов:
Feature: NAT
Direction : IN to OUT
Action : Translate Source
Old Address : 192.168.20.8 00001
New Address : 87.87.87.87 00033Адрес назначения в пакете был заменён на 87.87.87.87.
5. Так как на нашем маршрутизаторе настроен IPSec, будет отмечено, попал ли в него пакет:
Feature: IPSec
Result : IPSEC_RESULT_DENY
Action : SEND_CLEAR
SA Handle : 0
Peer Addr : 8.8.8.8
Local Addr: 87.87.87.87Нет, не попал.
В трейсах представлено достаточно много дополнительной информации. Например, IPV4_INPUT_PBR сигнализирует о том, что пакет прошёл через PBR. Но информации, был ли применен PBR или пакет передан на обработку стандартным правилам маршрутизации, в этом разделе мы не найдём. В нашем случае пакет не попал под правила PBR. Запись IPV4_INPUT_TCP_ADJUST_MSS говорит о том, что на интерфейсе настроена команда ip tcp adjust-mss. При этом, как и в предыдущем примере, никаких деталей мы не получаем.
Большая часть информации, выводимой устройством, не представляет интереса. Однако ситуация будет меняться, когда с пакетом что-то пойдёт не так.
Ситуация №1. Пакет отброшен ACL на входном интерфейсе
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 Gi0/0/0 DROP 8 (Ipv4Acl)Пакет был отброшен (DROP), так как сработал ACL (Ipv4Acl).
Трассировка обработки пакета
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 35
Summary
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
State : DROP 8 (Ipv4Acl)
Timestamp
Start : 6515970748260480 ns (02/18/2017 17:45:43.568889 UTC)
Stop : 6515970748313558 ns (02/18/2017 17:45:43.568942 UTC)
Path Trace
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 8.8.8.8
Protocol : 1 (ICMP)
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 6560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 5920 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d8375c - STILE_LEGACY_DROP_EXT
Lapsed time : 3680 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b554 - INGRESS_MMA_LOOKUP_DROP_EXT
Lapsed time : 63040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6e0f8 - INPUT_DROP_FNF_AOR_EXT
Lapsed time : 8320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc44 - INPUT_FNF_DROP_EXT
Lapsed time : 324800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6e6c8 - INPUT_DROP_FNF_AOR_RELEASE_EXT
Lapsed time : 8320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81128ebc - INPUT_DROP_EXT <=================
Lapsed time : 1920 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL <=================
Lapsed time : 794240 nsINPUT_DROP_EXT и IPV4_INPUT_ACL сообщают, что пакет был отброшен именно на входящем интерфейсе. Трейсы получились короткими, как жизнь пакета.
Ситуация №2. Пакет отброшен ACL на исходящем интерфейсе
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 Gi0/0/1.5 DROP 8 (Ipv4Acl)И снова пакет не был передан (DROP) из-за ACL (Ipv4Acl). Теперь, правда, в качестве исходящего интерфейса фигурирует Gi0/0/1.5.
Трассировка обработки пакета
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 33
Summary
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
State : DROP 8 (Ipv4Acl)
Timestamp
Start : 6515547984424423 ns (02/18/2017 17:38:40.479689 UTC)
Stop : 6515547984571057 ns (02/18/2017 17:38:40.479835 UTC)
Path Trace
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 8.8.8.8
Protocol : 1 (ICMP)
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 8320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 4320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 3520 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL
Lapsed time : 43360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e88 - IPV4_INPUT_SRC_LOOKUP_CONSUME
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e68 - IPV4_INPUT_FOR_US_MARTIAN
Lapsed time : 1280 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 5
cft_bucket_number : 1591662
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 443
tuple.dst_port : 57521
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 5
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d83558 - IPV4_INPUT_STILE_LEGACY
Lapsed time : 222240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b508 - IPV4_INGRESS_MMA_LOOKUP
Lapsed time : 67200 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d59618 - IPV4_INPUT_FME_PROCESS
Lapsed time : 2240 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000084
input vrf_idx : 0
calling feature : FNF
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 5
cft_bucket_number : 1591662
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 443
tuple.dst_port : 57521
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 5
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc84 - IPV4_INPUT_FNF_AOR_FIRST
Lapsed time : 22080 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6d9d4 - IPV4_INPUT_FNF_FIRST
Lapsed time : 136320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e8c - IPV4_INPUT_VFR
Lapsed time : 1280 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b660 - IPV4_INPUT_CENT_SMP_PROCESS
Lapsed time : 2560 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000080
input vrf_idx : 0
calling feature : CENT
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 5
cft_bucket_number : 1591662
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 443
tuple.dst_port : 57521
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 5
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b62c - IPV4_INPUT_CENT_RC_PROCESS
Lapsed time : 40160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7ff70 - IPV4_INPUT_PBR
Lapsed time : 39520 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d858d0 - IPV4_INPUT_TCP_ADJUST_MSS
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS
Lapsed time : 4320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6dc88 - IPV4_INPUT_FNF_AOR_FINAL
Lapsed time : 1920 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6d974 - IPV4_INPUT_FNF_FINAL
Lapsed time : 274240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6dc8c - IPV4_INPUT_FNF_AOR_RELEASE
Lapsed time : 2400 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e94 - IPV4_INPUT_IPOPTIONS_PROCESS
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac44 - IPV4_INPUT_GOTO_OUTPUT_FEATURE
Lapsed time : 2880 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e98 - IPV4_OUTPUT_VFR
Lapsed time : 1600 ns
Feature: ZBFW
Action : Fwd
Zone-pair name : in-out1
Class-map name : CM-FW_in-out
Input interface : GigabitEthernet0/0/0
Egress interface: GigabitEthernet0/0/1.5
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT
Lapsed time : 989760 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d77188 - MC_OUTPUT_GEN_RECYCLE
Lapsed time : 2720 ns
Feature: NAT
Direction : IN to OUT
Action : Translate Source
Old Address : 192.168.20.8 00001
New Address : 87.87.87.87 00036
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d7c390 - IPV4_NAT_OUTPUT_FIA
Lapsed time : 36800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d85d30 - IPV4_OUTPUT_THREAT_DEFENSE
Lapsed time : 3200 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e9c - IPV4_VFR_REFRAG
Lapsed time : 1120 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Output
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 7
cft_bucket_number : 1591662
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 87.87.87.87
tuple.dst_ip : 8.8.8.8
tuple.src_port : 443
tuple.dst_port : 57521
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 7
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d8359c - IPV4_OUTPUT_STILE_CLR_TXT
Lapsed time : 141920 ns
Feature: IPSec
Result : IPSEC_RESULT_DENY
Action : SEND_CLEAR
SA Handle : 0
Peer Addr : 8.8.8.8
Local Addr: 87.87.87.87
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d761ac - IPV4_OUTPUT_IPSEC_CLASSIFY
Lapsed time : 46080 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e70 - IPV4_OUTPUT_SRC_LOOKUP_ISSUE
Lapsed time : 2560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81128eb8 - OUTPUT_DROP_EXT <=================
Lapsed time : 3360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d4a144 - IPV4_OUTPUT_ACL <=================
Lapsed time : 121760 nsВ трейсах в самом конце мы обнаружим информацию о судьбе пакета: OUTPUT_DROP_EXT и IPV4_OUTPUT_ACL. Пакет практически вырвался из лап маршрутизатора, о чём свидетельствует прохождение большинства стадий обработки.
Ситуация №3. Пакет отброшен межсетевым экраном
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 Gi0/0/1.5 DROP 184 (FirewallPolicy)Пакет отброшен (DROP). Причина – политики межсетевого экрана (FirewallPolicy).
Трассировка обработки пакета
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 36
Summary
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
State : DROP 184 (FirewallPolicy)
Timestamp
Start : 6516783739710881 ns (02/18/2017 17:59:16.560339 UTC)
Stop : 6516783739809427 ns (02/18/2017 17:59:16.560438 UTC)
Path Trace
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 8.8.8.8
Protocol : 1 (ICMP)
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 8800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 5440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL
Lapsed time : 47360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e88 - IPV4_INPUT_SRC_LOOKUP_CONSUME
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e68 - IPV4_INPUT_FOR_US_MARTIAN
Lapsed time : 1440 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 135
cft_bucket_number : 875224
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 56789
tuple.dst_port : 514
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 135
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d83558 - IPV4_INPUT_STILE_LEGACY
Lapsed time : 202560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b508 - IPV4_INGRESS_MMA_LOOKUP
Lapsed time : 63360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d59618 - IPV4_INPUT_FME_PROCESS
Lapsed time : 4640 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000084
input vrf_idx : 0
calling feature : FNF
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 135
cft_bucket_number : 875224
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 56789
tuple.dst_port : 514
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 135
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc84 - IPV4_INPUT_FNF_AOR_FIRST
Lapsed time : 20640 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6d9d4 - IPV4_INPUT_FNF_FIRST
Lapsed time : 127360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e8c - IPV4_INPUT_VFR
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b660 - IPV4_INPUT_CENT_SMP_PROCESS
Lapsed time : 2720 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000080
input vrf_idx : 0
calling feature : CENT
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 135
cft_bucket_number : 875224
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 56789
tuple.dst_port : 514
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 135
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b62c - IPV4_INPUT_CENT_RC_PROCESS
Lapsed time : 43840 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7ff70 - IPV4_INPUT_PBR
Lapsed time : 37120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d858d0 - IPV4_INPUT_TCP_ADJUST_MSS
Lapsed time : 1280 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS
Lapsed time : 4800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6dc88 - IPV4_INPUT_FNF_AOR_FINAL
Lapsed time : 1760 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6d974 - IPV4_INPUT_FNF_FINAL
Lapsed time : 255680 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6dc8c - IPV4_INPUT_FNF_AOR_RELEASE
Lapsed time : 2240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e94 - IPV4_INPUT_IPOPTIONS_PROCESS
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac44 - IPV4_INPUT_GOTO_OUTPUT_FEATURE
Lapsed time : 4160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e98 - IPV4_OUTPUT_VFR
Lapsed time : 1760 ns
Feature: ZBFW <=================
Action : Drop <=================
Reason : ICMP policy drop:classify result <=================
Zone-pair name : in-out1 <=================
Class-map name : class-default <=================
Input interface : GigabitEthernet0/0/0 <=================
Egress interface: GigabitEthernet0/0/1.5 <=================
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x81128eb8 - OUTPUT_DROP_EXT <=================
Lapsed time : 640 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT <=================
Lapsed time : 639200 nsНаличие сообщений OUTPUT_DROP_EXT и IPV4_OUTPUT_INSPECT показывает, что пакет отброшен политиками инспектирования, которое выполняется как раз МСЭ. Детали находим в информации по ZFW:
Feature: ZBFW
Action : Drop
Reason : ICMP policy drop:classify result
Zone-pair name : in-out1
Class-map name : class-default
Input interface : GigabitEthernet0/0/0
Egress interface: GigabitEthernet0/0/1.5Reason сообщает о том, что пакет был классифицирован, как ICMP. Класс, в который попал пакет и где он был отброшен, — class-default.
Ситуация №4. Пакет маршрутизируется правилами PBR
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 Gi0/0/1.6 FWDПакет передан (FWD). Теперь исходящий интерфейс Gi0/0/1.6.
Трассировка обработки пакета
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 36
Summary
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
State : FWD
Timestamp
Start : 6517659109765260 ns (02/18/2017 18:13:51.930393 UTC)
Stop : 6517659109927732 ns (02/18/2017 18:13:51.930556 UTC)
Path Trace
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 8.8.8.8
Protocol : 1 (ICMP)
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 10400 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 5440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL
Lapsed time : 265600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e88 - IPV4_INPUT_SRC_LOOKUP_CONSUME
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e68 - IPV4_INPUT_FOR_US_MARTIAN
Lapsed time : 3680 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 69
cft_bucket_number : 2000178
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 57521
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 69
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d83558 - IPV4_INPUT_STILE_LEGACY
Lapsed time : 223360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b508 - IPV4_INGRESS_MMA_LOOKUP
Lapsed time : 85440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d59618 - IPV4_INPUT_FME_PROCESS
Lapsed time : 3040 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000084
input vrf_idx : 0
calling feature : FNF
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 69
cft_bucket_number : 2000178
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 57521
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 69
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc84 - IPV4_INPUT_FNF_AOR_FIRST
Lapsed time : 19680 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6d9d4 - IPV4_INPUT_FNF_FIRST
Lapsed time : 153600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e8c - IPV4_INPUT_VFR
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b660 - IPV4_INPUT_CENT_SMP_PROCESS
Lapsed time : 2560 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000080
input vrf_idx : 0
calling feature : CENT
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 69
cft_bucket_number : 2000178
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 57521
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 69
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b62c - IPV4_INPUT_CENT_RC_PROCESS
Lapsed time : 49600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7ff70 - IPV4_INPUT_PBR <=================
Lapsed time : 69760 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d858d0 - IPV4_INPUT_TCP_ADJUST_MSS
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0 <=================
Output : GigabitEthernet0/0/1.6 <=================
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS
Lapsed time : 7840 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d6dc88 - IPV4_INPUT_FNF_AOR_FINAL
Lapsed time : 1600 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d6d974 - IPV4_INPUT_FNF_FINAL
Lapsed time : 280480 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d6dc8c - IPV4_INPUT_FNF_AOR_RELEASE
Lapsed time : 3840 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81131e94 - IPV4_INPUT_IPOPTIONS_PROCESS
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x8113ac44 - IPV4_INPUT_GOTO_OUTPUT_FEATURE
Lapsed time : 3840 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81131e98 - IPV4_OUTPUT_VFR
Lapsed time : 5440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d858a0 - IPV4_OUTPUT_TCP_ADJUST_MSS
Lapsed time : 1280 ns
Feature: ZBFW
Action : Fwd
Zone-pair name : in-out2
Class-map name : CM-FW_in-out
Input interface : GigabitEthernet0/0/0
Egress interface: GigabitEthernet0/0/1.6
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT
Lapsed time : 789120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d77188 - MC_OUTPUT_GEN_RECYCLE
Lapsed time : 11200 ns
Feature: NAT
Direction : IN to OUT
Action : Translate Source
Old Address : 192.168.20.8
New Address : 62.62.62.62
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d7c390 - IPV4_NAT_OUTPUT_FIA
Lapsed time : 38400 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d85d30 - IPV4_OUTPUT_THREAT_DEFENSE
Lapsed time : 4000 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81131e9c - IPV4_VFR_REFRAG
Lapsed time : 800 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Output
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 71
cft_bucket_number : 2000178
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 62.62.62.62
tuple.dst_ip : 8.8.8.8
tuple.src_port : 57521
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 71
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d8359c - IPV4_OUTPUT_STILE_CLR_TXT
Lapsed time : 140160 ns
Feature: IPSec
Result : IPSEC_RESULT_DENY
Action : SEND_CLEAR
SA Handle : 0
Peer Addr : 8.8.8.8
Local Addr: 62.62.62.62
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d761ac - IPV4_OUTPUT_IPSEC_CLASSIFY
Lapsed time : 66400 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81131e70 - IPV4_OUTPUT_SRC_LOOKUP_ISSUE
Lapsed time : 3840 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81128eb0 - IPV4_OUTPUT_L2_REWRITE
Lapsed time : 13440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81131e74 - IPV4_OUTPUT_SRC_LOOKUP_CONSUME
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81131ec4 - IPV4_OUTPUT_FRAG
Lapsed time : 2240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x81133e50 - IPV4_OUTPUT_DROP_POLICY
Lapsed time : 18720 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x80d6d914 - IPV4_OUTPUT_FNF_FINAL
Lapsed time : 113440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.6
Entry : 0x8113bb40 - MARMOT_SPA_D_TRANSMIT_PKT
Lapsed time : 43680 nsЕсли мы сравним трассировку пакета при маршрутизации стандартными правилами (статическая маршрутизация) и при маршрутизации правилами PBR, мы не увидим разницы. Изменятся только исходящий интерфейс, и адрес, подставляемый в NAT’е.
Ситуация №5. Пакет передаётся через VTI интерфейс
В этом примере пингуем адрес 172.28.0.1.
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 Gi0/0/1.5 FWDПакет передан (FWD). Исходящий интерфейс Gi0/0/1.5.
Трассировка обработки пакета
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 50
Summary
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1.5
State : FWD
Timestamp
Start : 6665377802839987 ns (02/20/2017 11:15:48.257340 UTC)
Stop : 6665377803172303 ns (02/20/2017 11:15:48.257673 UTC)
Path Trace
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 172.28.0.1
Protocol : 1 (ICMP)
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 5600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 4160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 3040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL
Lapsed time : 19840 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e88 - IPV4_INPUT_SRC_LOOKUP_CONSUME
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e68 - IPV4_INPUT_FOR_US_MARTIAN
Lapsed time : 1280 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 186
cft_bucket_number : 407373
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 172.28.0.1
tuple.src_port : 6603
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 186
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d83558 - IPV4_INPUT_STILE_LEGACY
Lapsed time : 296480 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b508 - IPV4_INGRESS_MMA_LOOKUP
Lapsed time : 43040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d59618 - IPV4_INPUT_FME_PROCESS
Lapsed time : 2560 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000084
input vrf_idx : 0
calling feature : FNF
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 186
cft_bucket_number : 407373
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 172.28.0.1
tuple.src_port : 6603
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 186
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc84 - IPV4_INPUT_FNF_AOR_FIRST
Lapsed time : 20160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6d9d4 - IPV4_INPUT_FNF_FIRST
Lapsed time : 134400 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e8c - IPV4_INPUT_VFR
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b660 - IPV4_INPUT_CENT_SMP_PROCESS
Lapsed time : 3840 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000080
input vrf_idx : 0
calling feature : CENT
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 186
cft_bucket_number : 407373
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 172.28.0.1
tuple.src_port : 6603
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 186
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b62c - IPV4_INPUT_CENT_RC_PROCESS
Lapsed time : 45440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7ff70 - IPV4_INPUT_PBR
Lapsed time : 14080 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d858d0 - IPV4_INPUT_TCP_ADJUST_MSS
Lapsed time : 1280 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0 <=================
Output : Tunnel1 <=================
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS <=================
Lapsed time : 5920 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d6dc88 - IPV4_INPUT_FNF_AOR_FINAL
Lapsed time : 1600 ns
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: OCE_TRACE
Type : OCE_ADJ_IPV4
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d6d974 - IPV4_INPUT_FNF_FINAL
Lapsed time : 245440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d6dc8c - IPV4_INPUT_FNF_AOR_RELEASE
Lapsed time : 1760 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x81131e94 - IPV4_INPUT_IPOPTIONS_PROCESS
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x8113ac44 - IPV4_INPUT_GOTO_OUTPUT_FEATURE
Lapsed time : 4160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x81131e98 - IPV4_OUTPUT_VFR
Lapsed time : 3040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d858a0 - IPV4_OUTPUT_TCP_ADJUST_MSS
Lapsed time : 1280 ns
Feature: ZBFW <=================
Action : Fwd <=================
Zone-pair name : N/A <=================
Class-map name : N/A <=================
Input interface : GigabitEthernet0/0/0 <=================
Egress interface: Tunnel1 <=================
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT
Lapsed time : 30080 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d77188 - MC_OUTPUT_GEN_RECYCLE
Lapsed time : 2560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d85d30 - IPV4_OUTPUT_THREAT_DEFENSE
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x81131e9c - IPV4_VFR_REFRAG
Lapsed time : 800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x81128eb0 - IPV4_OUTPUT_L2_REWRITE
Lapsed time : 7360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x81131ec4 - IPV4_OUTPUT_FRAG
Lapsed time : 640 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d6e1b8 - IPV4_TUNNEL_OUTPUT_FNF_AOR
Lapsed time : 3520 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d6d8e4 - IPV4_TUNNEL_OUTPUT_FNF_FINAL
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x80d6e640 - IPV4_TUNNEL_OUTPUT_FNF_AOR_RELEASE
Lapsed time : 800 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d86ce8 - IPV4_TUNNEL_OUTPUT_FINAL
Lapsed time : 20640 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d86d30 - IPV4_OUTPUT_TUNNEL_PROTECTION_ENCRYPT <=================
Lapsed time : 7200 ns
Feature: IPSec <=================
Result : IPSEC_RESULT_SA <=================
Action : ENCRYPT <=================
SA Handle : 98 <=================
Peer Addr : 188.188.188.188 <=================
Local Addr: 87.87.87.87 <=================
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d761ac - IPV4_OUTPUT_IPSEC_CLASSIFY_EXT
Lapsed time : 44480 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d7641c - IPV4_OUTPUT_IPSEC_DOUBLE_ACL_EXT
Lapsed time : 11200 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d763ec - IPV4_IPSEC_FEATURE_RETURN_EXT
Lapsed time : 4960 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x8113ac50 - IPV4_OUTPUT_IPSEC_INLINE_FRAG_CHK_EXT
Lapsed time : 7680 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d7635c - IPV4_OUTPUT_IPSEC_TUNNEL_RERUN_JUMP_EXT
Lapsed time : 4480 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d764ac - IPV4_OUTPUT_IPSEC_POST_PROCESS_EXT
Lapsed time : 12160 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d763ec - IPV4_IPSEC_FEATURE_RETURN_EXT
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d763ec - IPV4_IPSEC_FEATURE_RETURN_EXT
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d86cec - IPV4_TUNNEL_GOTO_OUTPUT
Lapsed time : 11680 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d86d98 - IPV4_TUNNEL_FW_CHECK_EXT
Lapsed time : 15040 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x81131e60 - IPV4_INPUT_DST_LOOKUP_ISSUE_EXT
Lapsed time : 8480 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x81131eb8 - IPV4_INPUT_ARL_EXT
Lapsed time : 5760 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x81131e6c - IPV4_INTERNAL_DST_LOOKUP_CONSUME_EXT
Lapsed time : 2880 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : Tunnel1
Entry : 0x80d86dc8 - IPV4_TUNNEL_ENCAP_FOR_US_EXT
Lapsed time : 5600 ns
Feature: FIA_TRACE
Input : Tunnel1 <=================
Output : GigabitEthernet0/0/1.5 <=================
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS_EXT <=================
Lapsed time : 4000 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81131f20 - IPV4_TUNNEL_ENCAP_GOTO_OUTPUT_FEATURE_EXT
Lapsed time : 11520 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e98 - IPV4_OUTPUT_VFR
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT
Lapsed time : 5120 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d77188 - MC_OUTPUT_GEN_RECYCLE
Lapsed time : 2240 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d7c390 - IPV4_NAT_OUTPUT_FIA
Lapsed time : 6400 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d85d30 - IPV4_OUTPUT_THREAT_DEFENSE
Lapsed time : 1440 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e9c - IPV4_VFR_REFRAG
Lapsed time : 800 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Output
triplet.vrf_idx : 0
triplet.network_start : 0x01004104
triplet.triplet_flags : 0x00000000
triplet.counter : 186
cft_bucket_number : 407373
cft_l3_payload_size : 100
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 87.87.87.87
tuple.dst_ip : 188.188.188.188
tuple.src_port : 6603
tuple.dst_port : 443
tuple.vrfid : 0
tuple.l4_protocol : 50
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 186
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ipsec
Classification ID: [CANA-L7:9]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d8359c - IPV4_OUTPUT_STILE_CLR_TXT
Lapsed time : 138080 ns
Feature: IPSec <=================
Result : IPSEC_RESULT_DENY <=================
Action : SEND_CLEAR <=================
SA Handle : 0
Peer Addr : 188.188.188.188 <=================
Local Addr: 87.87.87.87 <=================
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d761ac - IPV4_OUTPUT_IPSEC_CLASSIFY
Lapsed time : 27840 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e70 - IPV4_OUTPUT_SRC_LOOKUP_ISSUE
Lapsed time : 2880 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81128eb0 - IPV4_OUTPUT_L2_REWRITE
Lapsed time : 7520 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81131e74 - IPV4_OUTPUT_SRC_LOOKUP_CONSUME
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81131ec4 - IPV4_OUTPUT_FRAG
Lapsed time : 16800 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x8111ea94 - L2_REWRITE_AFTER_FRAG_WITHOUT_CLIP_EXT
Lapsed time : 11520 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x81133e50 - IPV4_OUTPUT_DROP_POLICY
Lapsed time : 12000 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x80d6d914 - IPV4_OUTPUT_FNF_FINAL
Lapsed time : 108320 ns
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x8113bb40 - MARMOT_SPA_D_TRANSMIT_PKT
Lapsed time : 49120 nsТрейсы изменились, так как маршрутизация пакета усложнилась. Сначала он передаётся на туннельный интерфейс:
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : Tunnel1
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS
Lapsed time : 5920 nsДалее срабатывают правила межсетевого экрана. Так как у нас входящий и туннельный интерфейсы находятся в одной зоне, проверки трафика не происходит (мы не попадаем ни в один из zone-pair):
Feature: ZBFW
Action : Fwd
Zone-pair name : N/A
Class-map name : N/A
Input interface : GigabitEthernet0/0/0
Egress interface: Tunnel1После того как пакет попал в туннельный интерфейс, его необходимо зашифровать.
IPV4_OUTPUT_TUNNEL_PROTECTION_ENCRYPT
Feature: IPSec
Result : IPSEC_RESULT_SA
Action : ENCRYPT
SA Handle : 98
Peer Addr : 188.188.188.188
Local Addr: 87.87.87.87Ещё раз происходит маршрутизация пакета, уже зашифрованного.
Feature: FIA_TRACE
Input : Tunnel1
Output : GigabitEthernet0/0/1.5
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS_EXT
Lapsed time : 4000 nsПакет проходит через внешний интерфейс, где настроен IPSec (висит crypto-map). Хоть пакет уже зашифрован, система проверяет не попадает ли он в IPSec на исходящем интерфейсе.
Feature: IPSec
Result : IPSEC_RESULT_DENY
Action : SEND_CLEAR
SA Handle : 0
Peer Addr : 188.188.188.188
Local Addr: 87.87.87.87Ситуация №6. Пакет передаётся на несуществующий next-hop (или отказавший)
cbs-4000#show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/0 internal0/0/rp:0 PUNT 10 (Incomplete adjacency)Статус PUNT означает, что пакет не может быть обработан CEF'ом и передаётся на обработку процессором (process switching). Причина – маршрутизатор не обнаружил нужной записи в таблице adjacency для передачи пакета на соседний next-hop (Incomplete adjacency). Что логично, так как его нет.
Трассировка обработки пакета
cbs-4000#show platform packet-trace packet 0
Packet: 0 CBUG ID: 55
Summary
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
State : PUNT 10 (Incomplete adjacency)
Timestamp
Start : 6668916530895154 ns (02/20/2017 12:14:46.985396 UTC)
Stop : 6668916530979351 ns (02/20/2017 12:14:46.985480 UTC)
Path Trace
Feature: IPV4
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Source : 192.168.20.8
Destination : 8.8.8.8
Protocol : 1 (ICMP)
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x8112bfbc - DEBUG_COND_INPUT_PKT
Lapsed time : 9760 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e84 - IPV4_INPUT_SRC_LOOKUP_ISSUE
Lapsed time : 5920 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e64 - IPV4_INPUT_DST_LOOKUP_CONSUME
Lapsed time : 3200 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4a140 - IPV4_INPUT_ACL
Lapsed time : 15040 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e88 - IPV4_INPUT_SRC_LOOKUP_CONSUME
Lapsed time : 960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e68 - IPV4_INPUT_FOR_US_MARTIAN
Lapsed time : 1440 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x0000008c
input vrf_idx : 0
calling feature : STILE
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 74
cft_bucket_number : 769995
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 443
tuple.dst_port : 55391
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 74
returned cft_error : 14
returned fid : 0x00000000
Feature: NBAR
Packet number in flow: N/A
Classification state: Final
Classification name: ping
Classification ID: [CANA-L7:479]
Number of matched sub-classifications: 0
Number of extracted fields: 0
Is PA (split) packet: False
TPH-MQC bitmask value: 0x0
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d83558 - IPV4_INPUT_STILE_LEGACY
Lapsed time : 252800 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7b508 - IPV4_INGRESS_MMA_LOOKUP
Lapsed time : 48960 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d59618 - IPV4_INPUT_FME_PROCESS
Lapsed time : 4000 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000084
input vrf_idx : 0
calling feature : FNF
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 74
cft_bucket_number : 769995
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.8
tuple.src_port : 443
tuple.dst_port : 55391
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 74
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6dc84 - IPV4_INPUT_FNF_AOR_FIRST
Lapsed time : 20640 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d6d9d4 - IPV4_INPUT_FNF_FIRST
Lapsed time : 127520 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x81131e8c - IPV4_INPUT_VFR
Lapsed time : 1280 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b660 - IPV4_INPUT_CENT_SMP_PROCESS
Lapsed time : 2560 ns
Feature: CFT
API : cft_handle_pkt
packet capabilities : 0x00000080
input vrf_idx : 0
calling feature : CENT
direction : Input
triplet.vrf_idx : 0
triplet.network_start : 0x01003f8e
triplet.triplet_flags : 0x00000000
triplet.counter : 74
cft_bucket_number : 769995
cft_l3_payload_size : 40
cft_pkt_ind_flags : 0x00000000
cft_pkt_ind_valid : 0x00000931
tuple.src_ip : 192.168.20.8
tuple.dst_ip : 8.8.8.7
tuple.src_port : 443
tuple.dst_port : 55391
tuple.vrfid : 0
tuple.l4_protocol : ICMP
tuple.l3_protocol : IPV4
pkt_sb_state : 0
pkt_sb.num_flows : 0
pkt_sb.tuple_epoch : 74
returned cft_error : 14
returned fid : 0x00000000
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d4b62c - IPV4_INPUT_CENT_RC_PROCESS
Lapsed time : 39360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d7ff70 - IPV4_INPUT_PBR
Lapsed time : 43680 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/0
Entry : 0x80d858d0 - IPV4_INPUT_TCP_ADJUST_MSS
Lapsed time : 1120 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0 <=================
Output : GigabitEthernet0/0/1 <=================
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS <=================
Lapsed time : 135360 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0 <=================
Output : internal0/0/rp:0 <=================
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS_EXT <=================
Lapsed time : 30240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x80d6dc88 - IPV4_INPUT_FNF_AOR_FINAL_EXT
Lapsed time : 8640 ns
Feature: OCE_TRACE
Type : OCE_ADJ_PUNT
Feature: OCE_TRACE
Type : OCE_ADJ_PUNT
Feature: OCE_TRACE
Type : OCE_ADJ_PUNT
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x80d6d974 - IPV4_INPUT_FNF_FINAL_EXT
Lapsed time : 277600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x80d6dc8c - IPV4_INPUT_FNF_AOR_RELEASE_EXT
Lapsed time : 6720 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x81131e94 - IPV4_INPUT_IPOPTIONS_PROCESS_EXT
Lapsed time : 2560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x8113ac44 - IPV4_INPUT_GOTO_OUTPUT_FEATURE_EXT
Lapsed time : 11200 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x81131ef4 - IPV4_INTERNAL_ARL_SANITY_EXT
Lapsed time : 10560 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x80d70b28 - IPV4_OUTPUT_INSPECT_EXT
Lapsed time : 12160 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x80d85d30 - IPV4_OUTPUT_THREAT_DEFENSE_EXT
Lapsed time : 1600 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x81131e9c - IPV4_VFR_REFRAG_EXT
Lapsed time : 2240 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x81133e50 - IPV4_OUTPUT_DROP_POLICY_EXT
Lapsed time : 24320 ns
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0 <=================
Output : internal0/0/rp:0 <=================
Entry : 0x8112ce90 - INTERNAL_TRANSMIT_PKT_EXT <=================
Lapsed time : 137440 nsДля пакета определён исходящий интерфейс:
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : GigabitEthernet0/0/1
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS
Lapsed time : 135360 nsНо так как в CEF нет нужных записей, он отправляется на обработку процессором (internal0/0/rp:0):
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x8113ac40 - IPV4_INPUT_LOOKUP_PROCESS_EXT
Lapsed time : 30240 nsЗапись, свидетельствующая о факте передаче пакета процессору (INTERNAL_TRANSMIT):
Feature: FIA_TRACE
Input : GigabitEthernet0/0/0
Output : internal0/0/rp:0
Entry : 0x8112ce90 - INTERNAL_TRANSMIT_PKT_EXT
Lapsed time : 137440 nsPacket Trace предоставляет нам данные по обработке пакета в QFP. Это значит, что как только пакет попал в распоряжение ЦПУ, наши трейсы больше не помогут. В этом случае можно попробовать использовать debug ip packet. Но с этим отладчиком нужно быть очень аккуратными.
Заключение
Приведенные примеры наглядно демонстрируют, что IOS XE Packet Trace во многих ситуациях позволит нам достаточно оперативно понять, где засахарилось. Дальше, владея такой информацией, можно уже более детально разбираться с проблемой, жонглируя различными вариациями команд show и debug.
При диагностике не стоит забывать ещё об одном средстве – захвате пакетов (packet capture). На IOS XE этот функционал сделали более удобным по сравнению с обычным IOS.
Packet capture
Активация захвата пакетов:
monitor capture CAP access-list 199
monitor capture CAP interface GigabitEthernet0/0/0 inside
monitor capture CAP startВыключение, выгрузка дампа на внешний ПК, деактивация:
monitor capture CAP stop
monitor capture CAP export tftp://10.0.0.1/CAP.pcap
no monitor capture CAPАвтор: CBS
