Juniper防火墙日常维护

《Juniper防火墙日常维护》由会员分享，可在线阅读，更多相关《Juniper防火墙日常维护（59页珍藏版）》请在装配图网上搜索。

1、 Juniper 防火墙日常维护手册（v 20131112）作者 毅 审核 分类 其他 子类 指导手册 更新时间 2013-11-12 关键字 Juniper、NetScreen、防火墙、日常维护、ScreenOS、JunOS、NS、ISG、SSG、SRX 摘要 此手册用于指导 Juniper 防火墙驻场工程师常规操作，驻场工程师可以按照日常工作容从文档中选取相应的命令。此手册基本涵盖了常规操作、巡检操作等驻场维护工作所需要的操作指导，各工程师也可根据自身驻场项目特点确定日常巡检的容。主 要 适用环境 Juniper 防火墙运维工作 Juniper ScreenOS 防火墙包括产品型号有：NS

2、 系列、ISG 系列、SSG 系列 Juniper JunOS 防火墙包括产品型号有：SRX 系列（SRX Branch 系列包含 SRX650 及以下型号，SRX High-end 系列包含 SRX1K、3K 和 SRX5K）版本说明 版本号 拟制/修改责任人 拟制/修改日期 修改容/理由 V20131112 毅 2013-11-12 新建 目 录 版本说明.2 目 录.3 1.日常操作.5 1.1 查看硬件信息.5 1.2 查看 OS 信息.6 1.3 查看 CPU/SPU 使用率信息.7 1.3.1 查看 CPU/SPU 使用率信息.7 1.3.2 查看每秒 CPU 使用率.9 1.4

3、查看存使用率.12 1.5 SRX RE CPU 使用率/存使用率信息（仅 JunOS 适用）.14 1.6 查看 Session 会话信息.16 1.6.1 查看会话总数.16 1.6.2 查看每秒新建会话数量.18 1.6.3 查看防火墙所有会话条目.20 1.6.4 按过滤条件查看会话.21 1.6.5 查看会话详细容.23 1.6.6 保存防火墙所有会话条目.25 1.7 查看警告日志.26 1.8 查看事件日志 ScreenOS.27 1.8.1 查看所有事件日志（仅 ScreenOS 适用）.27 1.8.2 按事件级别过滤查看事件日志（仅 ScreenOS 适用）.27 1.8.

4、3 按时间过滤查看事件日志（仅 ScreenOS 适用）.28 1.9 查看事件日志 JunOS.29 1.10 查看策略流量日志.30 1.11 查看/备份配置.32 1.12 查看接口状态.34 1.12.1 查看所有接口状态.34 1.12.2 查看单一接口详情.36 1.13 查看 ARP 表.38 1.14 查看路由.39 1.14.1 查看全部路由.39 1.14.2 查看特定目标地址的路由.40 1.15 查看策略.41 1.15.1 查看所有策略.41 1.15.2 查看单条策略的详细容.42 1.16 查看防火墙主备状态.43 1.17 查看集群接口状态（仅 JunOS 适用

5、）.44 1.18 查看配置同步状态（仅 ScreenOS 适用）.45 1.19 常用排错命令.46 1.19.1 ping.46 1.19.2 telnet.48 1.19.3 trace route.49 1.19.4 收集 support 信息.50 1.20 按过滤条件查看各类信息.52 2.应急操作.53 2.1 清除指定 IP 的 ARP 记录.53 2.2 清除指定源 IP/目的 IP 的会话记录.53 2.3 关闭和开启端口.54 2.3.1 关闭端口.54 2.3.2 开启端口.54 2.4 防火墙主备状态切换.55 2.5 同步会话（仅 ScreenOS 适用）.56 2

6、.6 重启设备.56 3.日常维护周期策略.57 3.1 日巡检维护建议.57 3.2 周巡检维护建议.58 3.3 月巡检维护建议.58 3.4 不定期维护建议.59 1.日常操作 1.1 查看硬件信息（1）ScreenOS 在 CLI 下命令为：get chassis 示例：JP1000A-get chassis Chassis Environment:Power Supply:Good Fan Status:Good CPU Temperature:98F(37C)Slot Information:Slot Type S/N Assembly-No Version Temperature

7、 0 System Board 00999 0066-004 F01 86F(30C),87F(31C)4 Management 00999 0049-004 D19 98F(37C)5 ASIC Board 002079351g110017 0065-002 B00 Marin FPGA version 9,Jupiter ASIC version 1,Fresno FPGA version 110 I/O Board Slot Type S/N Version FPGA version 2 4 port miniGBIC(0 x3)00999 B02 26 1 4 port 10/100/

8、1000T 38 Alarm Control Information:Power failure audible alarm:disabled Fan failure audible alarm:disabled Low battery audible alarm:disabled Temperature audible alarm:disabled Normal alarm temperature is 132F(56C)Severe alarm temperature is 150F(66C)（2）JunOS 在 CLI-操作模式下命令为：show chassis hardware 示例：

9、syroJP650A show chassis hardware Hardware inventory:Item Version Part number Serial number Description Chassis AJ4309AA0999 SRX650 Midplane REV 08 710-023875 AAAS7310 System IO REV 08 710-023209 AAAS9446 SRXSME System IO Routing Engine REV 14 750-023223 AAAW4729 RE-SRXSME-SRE6 FPC 0 FPC PIC 0 4x GE

10、Base PIC FPC 2 REV 07 750-026182 AAAS7999 FPC PIC 0 16x GE gPIM Power Supply 0 Rev 03 740-024283 TH01999 PS 645W AC Power Supply 1 Rev 03 740-024283 TH01099 PS 645W AC 1.2 查看 OS 信息（1）ScreenOS 在 CLI 下命令为：get system 示例：JP1000A-get system Product Name:NetScreen-ISG1000 Serial Number:00999,Control Numbe

11、r:00000000 Hardware Version:3010(0)-(04),FPGA checksum:00000000,VLAN1 IP(0.0.0.0)Software Version:6.1.0r7-cu12.0,Type:Firewall+VPN OS Loader Version:1.0.2 Compiled by build_master at:Wed Apr 28 23:08:24 PDT 2010 Base Mac:0026.889b.fa80 File Name:default(screenos_image),Checksum:de317771,Total Memory

12、:1024MB Date 01/01/2013 11:50:43,Daylight Saving Time disabled The Network Time Protocol is Enabled Up 3286 hours 23 minutes 35 seconds Since 17Aug2012:13:27:08 Total Device Resets:0 （2）JunOS 在 CLI-操作模式下命令为：show system software 示例：syroJP650A show system software Information for junos:Comment:JUNOS S

13、oftware Release 10.4R10.7 1.3 查看 CPU/SPU 使用率信息 1.3.1 查看 CPU/SPU 使用率信息（1）ScreenOS CPU 在 CLI 下命令为：get performance cpu 示例：JP1000A-get performance cpu Average System Utilization:1%Last 1 minute:2%,Last 5 minutes:2%,Last 15 minutes:2%（2）JunOS SPU 当 SPU 使用率达到 60%就要引起关注，可能网络或设备有异常。在 CLI-操作模式下查看 SRX Branch

14、防火墙的 SPU 使用率命令为：show security monitoring fpc 0 示例：syroJP650A show security monitoring fpc 0 FPC 0 PIC 0 CPU utilization :0%Memory utilization :67%Current flow session:16 Max flow session :524288 SRX Hign-end 防火墙为分布式架构，需要根据 SPC 卡的槽位来确定查看命令。例如 SRX3600 配备 2 块 SPC，分别插在 7 槽 和 8 槽中，需要分别查看其 SPU 使用率。另，SRX36

15、00 的双机采用虚拟机箱技术后，node0 为主墙、node1 为备墙。在 CLI-操作模式下查看 SRX3600 防火墙的 spu 命令为：show security monitoring fpc 7 和 show security monitoring fpc 8 示例：syroJP3600A show security monitoring fpc 7 node0:-FPC 7 PIC 0 CPU utilization :2%Memory utilization :64%Current flow session:5265 Max flow session :524288 Current

16、 CP session :16401 Max CP session :2359296 node1:-FPC 7 PIC 0 CPU utilization :0%Memory utilization :64%Current flow session:5582 Max flow session :524288 Current CP session :17131 Max CP session :2359296 primary:node0 syroJP3600A show security monitoring fpc 8 node0:-FPC 8 PIC 0 CPU utilization :3%

17、Memory utilization :66%Current flow session:10977 Max flow session :1048576 Current CP session :0 Max CP session :0 node1:-FPC 8 PIC 0 CPU utilization :0%Memory utilization :66%Current flow session:11382 Max flow session :1048576 Current CP session :0 Max CP session :0 primary:node0 1.3.2 查看每秒 CPU 使

18、用率（1）ScreenOS 在 CLI 下命令为：get performance cpu all detail 示例：JP1000A.GL-IT.SDA(M)-get performance cpu all detail Average System Utilization:1%(flow 1 task 1)Last 60 seconds:59:2(1 1)58:2(1 1)57:2(1 1)56:2(1 1)55:2(1 1)54:2(1 1)53:2(1 1)52:2(1 1)51:2(1 1)50:2(1 1)49:2(1 1)48:2(1 1)47:2(1 1)46:2(1 1)45:

19、2(1 1)44:2(1 1)43:2(1 1)42:2(1 1)41:2(1 1)40:2(1 1)39:2(1 1)38:2(1 1)37:2(1 1)36:2(1 1)35:2(1 1)34:2(1 1)33:2(1 1)32:2(1 1)31:2(1 1)30:2(1 1)29:2(1 1)28:2(1 1)27:2(1 1)26:2(1 1)25:2(1 1)24:2(1 1)23:2(1 1)22:2(1 1)21:2(1 1)20:2(1 1)19:2(1 1)18:2(1 1)17:2(1 1)16:2(1 1)15:2(1 1)14:2(1 1)13:2(1 1)12:2(1

20、 1)11:2(1 1)10:2(1 1)9:2(1 1)8:2(1 1)7:2(1 1)6:2(1 1)5:2(1 1)4:2(1 1)3:2(1 1)2:2(1 1)1:2(1 1)0:2(1 1)Last 60 minutes:59:2(1 1)58:2(1 1)57:2(1 1)56:2(1 1)55:2(1 1)54:2(1 1)53:2(1 1)52:2(1 1)51:2(1 1)50:2(1 1)49:2(1 1)48:2(1 1)47:2(1 1)46:2(1 1)45:2(1 1)44:2(1 1)43:2(1 1)42:2(1 1)41:2(1 1)40:2(1 1)39:

21、2(1 1)38:2(1 1)37:2(1 1)36:2(1 1)35:2(1 1)34:2(1 1)33:2(1 1)32:2(1 1)31:2(1 1)30:2(1 1)29:2(1 1)28:2(1 1)27:2(1 1)26:2(1 1)25:2(1 1)24:2(1 1)23:2(1 1)22:2(1 1)21:2(1 1)20:2(1 1)19:2(1 1)18:2(1 1)17:2(1 1)16:2(1 1)15:2(1 1)14:2(1 1)13:2(1 1)12:2(1 1)11:2(1 1)10:2(1 1)9:2(1 1)8:2(1 1)7:2(1 1)6:2(1 1)5

22、:2(1 1)4:2(1 1)3:2(1 1)2:2(1 1)1:2(1 1)0:2(1 1)Last 24 hours:23:2(1 1)22:2(1 1)21:2(1 1)20:2(1 1)19:2(1 1)18:2(1 1)17:1(1 1)16:2(1 1)15:1(1 1)14:2(1 1)13:1(1 1)12:1(1 1)11:2(1 1)10:2(1 1)9:2(1 1)8:2(1 1)7:2(1 1)6:1(1 1)5:1(1 1)4:2(1 1)3:2(1 1)2:2(1 1)1:2(1 1)0:2(1 1)（2）JunOS 在 CLI-操作模式下命令为：show secu

23、rity monitoring performance spu 示例：syroJP650A show security monitoring performance spu fpc 0 pic 0 Last 60 seconds:0:0 1:0 2:0 3:0 4:0 5:0 6:0 7:0 8:0 9:0 10:0 11:0 12:0 13:0 14:0 15:0 16:0 17:0 18:0 19:0 20:0 21:0 22:0 23:0 24:0 25:0 26:0 27:0 28:0 29:0 30:0 31:0 32:0 33:0 34:0 35:0 36:0 37:0 38:0

24、39:0 40:0 41:0 42:0 43:0 44:0 45:0 46:0 47:0 48:0 49:0 50:0 51:0 52:0 53:0 54:0 55:0 56:0 57:0 58:0 59:0 syroJP3600A show security monitoring performance spu node0:-fpc 7 pic 0 Last 60 seconds:0:0 1:0 2:0 3:0 4:0 5:0 6:0 7:0 8:0 9:0 10:0 11:0 12:0 13:0 14:0 15:0 16:0 17:0 18:0 19:0 20:0 21:0 22:0 23

25、:0 24:0 25:0 26:0 27:0 28:0 29:0 30:0 31:0 32:0 33:0 34:0 35:0 36:0 37:0 38:0 39:0 40:0 41:0 42:0 43:0 44:0 45:0 46:0 47:0 48:0 49:0 50:0 51:0 52:0 53:0 54:0 55:0 56:0 57:0 58:0 59:0 fpc 8 pic 0 Last 60 seconds:0:0 1:0 2:0 3:0 4:0 5:0 6:0 7:0 8:0 9:0 10:0 11:0 12:0 13:0 14:0 15:0 16:0 17:0 18:0 19:0

26、 20:0 21:0 22:0 23:0 24:0 25:0 26:0 27:0 28:0 29:0 30:0 31:0 32:0 33:0 34:0 35:0 36:0 37:0 38:0 39:0 40:0 41:0 42:0 43:0 44:0 45:0 46:0 47:0 48:0 49:0 50:0 51:0 52:0 53:0 54:0 55:0 56:0 57:0 58:0 59:0 node1:-fpc 7 pic 0 Last 60 seconds:0:0 1:0 2:0 3:0 4:0 5:0 6:0 7:0 8:0 9:0 10:0 11:0 12:0 13:0 14:0

27、 15:0 16:0 17:0 18:0 19:0 20:0 21:0 22:0 23:0 24:0 25:0 26:0 27:0 28:0 29:0 30:0 31:0 32:0 33:0 34:0 35:0 36:0 37:0 38:0 39:0 40:0 41:0 42:0 43:0 44:0 45:0 46:0 47:0 48:0 49:0 50:0 51:0 52:0 53:0 54:0 55:0 56:0 57:0 58:0 59:0 fpc 8 pic 0 Last 60 seconds:0:0 1:0 2:0 3:0 4:0 5:0 6:0 7:0 8:0 9:0 10:0 1

28、1:0 12:0 13:0 14:0 15:0 16:0 17:0 18:0 19:0 20:0 21:0 22:0 23:0 24:0 25:0 26:0 27:0 28:0 29:0 30:0 31:0 32:0 33:0 34:0 35:0 36:0 37:0 38:0 39:0 40:0 41:0 42:0 43:0 44:0 45:0 46:0 47:0 48:0 49:0 50:0 51:0 52:0 53:0 54:0 55:0 56:0 57:0 58:0 59:0 primary:node0 1.4 查看存使用率（1）ScreenOS ScreenOS 平台的存使用率一般不会

29、变化。在 CLI 下命令为：get memory 示例：JP1000A-get memory Memory:allocated 536091296,left 238802224,frag 68,fail 0 （2）JunOS 当 SPU 存使用率达到 70%就要引起关注，可能网络或设备有异常。在 CLI-操作模式下查看 SRX Branch 防火墙的 spc 存使用率命令为：show security monitoring fpc 0 示例：syroJP650A show security monitoring fpc 0 FPC 0 PIC 0 CPU utilization :0%Memo

30、ry utilization :67%Current flow session:16 Max flow session :524288 SRX Hign-end 防火墙为分布式架构，需要根据 SPC 卡的槽位来确定查看命令。例如 SRX3600配备 2 块 SPC，插在 7 槽 和 8 槽中，需要分别查看其 SPU 存使用率。另，SRX3600 的双机采用虚拟机箱技术，node0 为主墙、node1 为备墙。在 CLI-操作模式下查看 SRX3600防火墙的 SPU 存使用率命令为：show security monitoring fpc 7 和 show security monitorin

31、g fpc 8 示例：syroJP3600A show security monitoring fpc 7 node0:-FPC 7 PIC 0 CPU utilization :2%Memory utilization :64%Current flow session:5265 Max flow session :524288 Current CP session :16401 Max CP session :2359296 node1:-FPC 7 PIC 0 CPU utilization :0%Memory utilization :64%Current flow session:55

32、82 Max flow session :524288 Current CP session :17131 Max CP session :2359296 primary:node0 syroJP3600A show security monitoring fpc 8 node0:-FPC 8 PIC 0 CPU utilization :3%Memory utilization :66%Current flow session:10977 Max flow session :1048576 Current CP session :0 Max CP session :0 node1:-FPC

33、8 PIC 0 CPU utilization :0%Memory utilization :66%Current flow session:11382 Max flow session :1048576 Current CP session :0 Max CP session :0 1.5 SRX RE CPU使用率/存使用率信息（仅 JunOS 适用）SRX 系列防火墙 RE 的 CPU 主要做管理设备用，其 CPU 波动会比较大，出现瞬时 100%也是正常的。当 RE 的 CPU 使用率长时间都在 45%以上时，引起关注；当 RE 的存使用率长时间都在 60%以上时，注意查看当前的 RE

34、 运行负载。在 CLI-操作模式下命令为：show chassis routing-engine 示例：syroJP650A show chassis routing-engine Routing Engine status:Temperature 31 degrees C/87 degrees F CPU temperature 31 degrees C/87 degrees F Total memory 2048 MB Max 1065 MB used(52 percent)Control plane memory 1104 MB Max 442 MB used(40 percent)Da

35、ta plane memory 944 MB Max 632 MB used(67 percent)CPU utilization:User 6 percent Background 0 percent Kernel 1 percent Interrupt 0 percent Idle 93 percent Model RE-SRXSME-SRE6 Serial ID AAAW4729 Start time 2012-07-12 17:54:51 CST Uptime 177 days,15 hours,50 minutes,35 seconds Last reboot reason 0 x2

36、00:chassis control reset Load averages:1 minute 5 minute 15 minute 0.41 0.26 0.19 syroJP3600A show chassis routing-engine node0:-Routing Engine status:Slot 0:Current state Master Election priority Master(default)DRAM 1023 MB Memory utilization 39 percent CPU utilization:User 0 percent Background 0 p

37、ercent Kernel 5 percent Interrupt 0 percent Idle 94 percent Model RE-PPC-1200-A Start time 2012-07-13 10:06:41 CST Uptime 176 days,23 hours,40 minutes,35 seconds Last reboot reason 0 x1:power cycle/failure Load averages:1 minute 5 minute 15 minute 0.12 0.10 0.08 node1:-Routing Engine status:Slot 0:C

38、urrent state Master Election priority Master(default)DRAM 1023 MB Memory utilization 34 percent CPU utilization:User 0 percent Background 0 percent Kernel 5 percent Interrupt 0 percent Idle 95 percent Model RE-PPC-1200-A Start time 2012-07-16 14:39:07 CST Uptime 173 days,19 hours,6 minutes,11 second

39、s Last reboot reason Router rebooted after a normal shutdown.Load averages:1 minute 5 minute 15 minute 0.14 0.06 0.01 1.6 查看 Session 会话信息 1.6.1 查看会话总数（1）ScreenOS 当前会话总数达到平时峰值的 2 倍 或 设备最大会话数的 70%，需要关注、报警。在 CLI 下命令为：get session info 示例：JP1000A-get session info alloc 730/max 524288,alloc failed 0,mcast

40、 alloc 0,di alloc failed 0 total reserved 0,free sessions in shared pool 523558 slot 2:hw0 alloc 730/max 524287 （2）JunOS 当前会话总数达到平时峰值的 2 倍 或 设备最大会话数的 70%，需要关注、报警。在 CLI-操作模式下命令为：show security flow session summary 示例：syroJP650A show security flow session summary Unicast-sessions:14 Multicast-sessions:

41、0 Failed-sessions:0 Sessions-in-use:17 Valid sessions:14 Pending sessions:0 Invalidated sessions:3 Sessions in other states:0 Maximum-sessions:524288 syroJP3600A show security flow session summary node0:-Flow Sessions on FPC7 PIC0:Unicast-sessions:0 Multicast-sessions:0 Failed-sessions:0 Sessions-in

42、-use:0 Valid sessions:0 Pending sessions:0 Invalidated sessions:0 Sessions in other states:0 Maximum-sessions:524288 Flow Sessions on FPC8 PIC0:Unicast-sessions:0 Multicast-sessions:0 Failed-sessions:0 Sessions-in-use:0 Valid sessions:0 Pending sessions:0 Invalidated sessions:0 Sessions in other sta

43、tes:0 Maximum-sessions:1048576 node1:-Flow Sessions on FPC7 PIC0:Unicast-sessions:0 Multicast-sessions:0 Failed-sessions:0 Sessions-in-use:0 Valid sessions:0 Pending sessions:0 Invalidated sessions:0 Sessions in other states:0 Maximum-sessions:524288 Flow Sessions on FPC8 PIC0:Unicast-sessions:0 Mul

44、ticast-sessions:0 Failed-sessions:0 Sessions-in-use:0 Valid sessions:0 Pending sessions:0 Invalidated sessions:0 Sessions in other states:0 Maximum-sessions:1048576 1.6.2 查看每秒新建会话数量（1）ScreenOS 在 CLI 下命令为：get performance session detail 示例：JP1000A-get performance session detail Last 60 seconds:0:26 1:

45、12 2:19 3:21 4:23 5:20 6:27 7:20 8:32 9:30 10:36 11:29 12:35 13:34 14:13 15:26 16:31 17:34 18:20 19:25 20:24 21:19 22:20 23:24 24:21 25:22 26:24 27:23 28:34 29:24 30:35 31:35 32:34 33:21 34:15 35:26 36:37 37:32 38:36 39:27 40:20 41:32 42:24 43:25 44:21 45:19 46:17 47:16 48:15 49:14 50:17 51:19 52:26

46、 53:38 54:32 55:41 56:11 57:13 58:15 59:11 （2）JunOS 对于 JunOS11.4 及其以后版本，可以直接查看每秒新建会话数，在 CLI-操作模式下查看SRX Branch 防火墙的每秒新建命令为：show security monitoring fpc 0 示例：root show security monitoring fpc 0 FPC 0 PIC 0 CPU utilization :0%Memory utilization :69%Current flow session :6 Current flow session IPv4:0 Cu

47、rrent flow session IPv6:0 Max flow session :262144 Total Session Creation Per Second(for last 96 seconds on average):0 IPv4 Session Creation Per Second(for last 96 seconds on average):0 IPv6 Session Creation Per Second(for last 96 seconds on average):0 对于 JunOS11.4 之前的版本，只能查看每秒会话数，在 CLI-操作模式下命令为：sec

48、urity monitoring performance session 示例：syroJP650A show security monitoring performance session fpc 0 pic 0 Last 60 seconds:0:18 1:18 2:17 3:18 4:17 5:14 6:14 7:17 8:16 9:17 10:16 11:17 12:17 13:18 14:16 15:16 16:15 17:15 18:14 19:15 20:13 21:14 22:12 23:27 24:27 25:56 26:55 27:78 28:61 29:79 30:59

49、31:75 32:59 33:81 34:64 35:78 36:61 37:75 38:60 39:51 40:40 41:50 42:47 43:69 44:60 45:69 46:56 47:76 48:67 49:78 50:57 51:74 52:55 53:78 54:60 55:70 56:51 57:62 58:48 59:29 syroJP3600A show security monitoring performance session node0:-fpc 7 pic 0 Last 60 seconds:0:9761 1:9987 2:9713 3:9965 4:9692

50、 5:9989 6:9703 7:9958 8:9653 9:9878 10:9616 11:9940 12:9691 13:10065 14:9814 15:10010 16:9731 17:9887 18:9610 19:9857 20:9636 21:9910 22:9649 23:9938 24:9686 25:9952 26:9704 27:9988 28:9735 29:9984 30:9723 31:10009 32:9758 33:10105 34:9878 35:10155 36:9881 37:10107 38:9798 39:10032 40:9795 41:10068

51、42:9792 43:10073 44:9829 45:10082 46:9813 47:10060 48:9775 49:10061 50:9791 51:10008 52:9732 53:9963 54:9721 55:9935 56:9668 57:9938 58:9696 59:9993 fpc 8 pic 0 Last 60 seconds:0:20252 1:19658 2:20188 3:19608 4:20185 5:19660 6:20164 7:19591 8:20039 9:19492 10:19938 11:19433 12:20098 13:19642 14:2027

52、5 15:19714 16:20013 17:19445 18:19841 19:19325 20:19824 21:19358 22:19880 23:19371 24:19936 25:19429 26:19876 27:19396 28:19938 29:19459 30:19911 31:19369 32:20068 33:19565 34:20332 35:19645 36:20309 37:19657 38:20128 39:19471 40:20010 41:19493 42:20049 43:19536 44:20163 45:19644 46:20132 47:19624 4

53、8:20154 49:19575 50:20097 51:19529 52:20041 53:19525 54:19978 55:19488 56:19899 57:19372 58:19984 59:19500 node1:-fpc 7 pic 0 Last 60 seconds:0:10213 1:10447 2:10172 3:10424 4:10150 5:10432 6:10153 7:10362 8:10078 9:10394 10:10134 11:10472 12:10219 13:10530 14:10279 15:10450 16:10134 17:10347 18:100

54、66 19:10312 20:10093 21:10400 22:10137 23:10384 24:10147 25:10456 26:10193 27:10437 28:10184 29:10507 30:10265 31:10570 32:10314 33:10694 34:10467 35:10659 36:10407 37:10618 38:10315 39:10519 40:10293 41:10561 42:10285 43:10555 44:10300 45:10540 46:10256 47:10573 48:10296 49:10496 50:10234 51:10447

55、52:10169 53:10364 54:10115 55:10406 56:10140 57:10385 58:10155 59:10445 fpc 8 pic 0 Last 60 seconds:0:21893 1:21280 2:21813 3:21250 4:21759 5:21230 6:21668 7:21122 8:21685 9:21176 10:21775 11:21254 12:21735 13:21272 14:21791 15:21155 16:21508 17:20933 18:21439 19:20944 20:21514 21:21026 22:21461 23:

56、20970 24:21540 25:21045 26:21494 27:20991 28:21684 29:21223 30:21909 31:21367 32:22025 33:21539 34:22163 35:21480 36:21933 37:21282 38:21790 39:21194 40:21827 41:21311 42:21793 43:21264 44:21860 45:21300 46:21830 47:21292 48:21762 49:21222 50:21607 51:21063 52:21449 53:20899 54:21527 55:21041 56:215

57、09 57:21017 58:21527 59:21033 primary:node0 1.6.3 查看防火墙所有会话条目（1）ScreenOS 在 CLI 下命令为：get session 示例：JP1000A-get session alloc 2976/max 524288,alloc failed 0,mcast alloc 0,di alloc failed 0 total reserved 0,free sessions in shared pool 521312 slot 2:hw0 alloc 2976/max 524287 id 482707/s0*,vsys 0,flag

58、10200400/4000/0003,policy 20036,time 1302,dip 36 module 0 if 130(nspflag 0805):192.168.12.101/4795-10.1.131.244/8000,6,0,sess token 4,vlan 32,tun 0,vsd 0,route 17,wsf 0 if 128(nspflag 10000800):10.1.94.104/4342210.195.4.41/6002,6,0,sess token 4,vlan 32,tun 0,vsd 0,route 17,wsf 0 if 128(nspflag 10000

59、800):10.1.94.104/60242 show security flow session Session ID:15176,Policy name:self-traffic-policy/1,Timeout:60,Valid In:192.168.117.2/514-10.1.35.11/514;udp,If:.local.0,Pkts:2668507,Bytes:659764260 Out:10.1.35.11/514-192.168.117.2/514;udp,If:ae0.0,Pkts:0,Bytes:0 Session ID:15264,Policy name:self-tr

60、affic-policy/1,Timeout:60,Valid In:192.168.117.2/514-10.1.88.166/514;udp,If:.local.0,Pkts:2769763,Bytes:668172183 Out:10.1.88.166/514-192.168.117.2/514;udp,If:ae0.0,Pkts:0,Bytes:0 Session ID:15267,Policy name:self-traffic-policy/1,Timeout:60,Valid In:192.168.117.2/514-10.1.35.12/514;udp,If:.local.0,

61、Pkts:2668508,Bytes:659764488 Out:10.1.35.12/514-192.168.117.2/514;udp,If:ae0.0,Pkts:0,Bytes:0 1.6.4 按过滤条件查看会话（1）ScreenOS 在 CLI 下使用 get session 命令可以按过滤条件查看会话，有以下命令选项：命令帮助：JP1000A-get session redirect output|match output dst-ip destination ip address dst-mac destination mac address dst-port destinatio

62、n port number or range hardware show hardware sessions only id show sessions with id ike-nat show ike-nat ALG info policy-id policy id protocol protocol number or range rm show sessions for resource management service show sessions with service type src-ip source ip address src-mac source mac addres

63、s src-port source port number or range tunnel show tunnel sessions vsd-id get vsd-id specified sessions 示例：JP1000A-get session src-ip 10.1.3.32 alloc 1366/max 524288,alloc failed 0,mcast alloc 0,di alloc failed 0 total reserved 0,free sessions in shared pool 522922 slot 2:hw0 alloc 1363/max 524287 T

64、otal 448 sessions according filtering criteria.id 517142/s0*,vsys 0,flag 00200450/0000/0081,policy 20026,time 0,dip 0 module 0 if 46(nspflag 800901):10.1.3.32/51602-10.1.8.130/8300,6,00000c07ac21,sess token 4,vlan 0,tun 0,vsd 0,route 8,wsf 0 if 45(nspflag 800900):10.1.3.32/51602 show security flow s

65、ession Possible completions:Execute this command application Application protocol name brief Show brief output(default)destination-port Destination port(1.65535)destination-prefix Destination IP prefix or address extensive Show detailed output family Show session by family idp Show idp sessions inte

66、rface Name of incoming or outgoing interface nat Show sessions with network address translation protocol IP protocol number resource-manager Show sessions with resource manager session-identifier Show session with specified session identifier source-port Source port(1.65535)source-prefix Source IP prefix or address summary Show output summary tunnel Show tunnel sessions|Pipe through a command 示例：syroJP650A show security flow session source-prefix 10.1.35.11 Session ID:168247,Policy name:self-tra