防火墙策略

只是代表策略放通，先dis session table xxx verbose查看下会话状态，另如果想通过debug判断是否被防火墙拦截，可以按如下思路排查：

<H3C>debugging ip info acl 3500

<H3C>debugging packet-filter  packet ip acl 3500

<H3C>debugging object-policy packet ip acl 3500

<H3C>debugging security-policy packet ip acl 3500

<H3C>debug aspf packet acl 3500

<H3C>terminal debugging

<H3C>terminal monitor

[H3C]info-center enable

开启debug调试后，在客户端上执行ping操作，查看防火墙弹出的会话信息，排查报文被哪些模块过滤，具体如下：

（1）IP转发debug：

<H3C>debugging ip info acl 3500   

<H3C>*Nov  2 14:49:51:678 2019 H3C IPFW/7/IPFW_INFO: -COntext=1;

MBUF was intercepted! Phase Num is 1(pre routing), Service ID is 24(lb), Bitmap is 9000000000, return 1(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/3,

s= 192.168.1.2, d= 192.168.10.2, protocol= 1, pktid = 9028.

根据以上信息可判断出报文匹配上负载均衡策略被丢弃，排查负载均衡配置。

（2）域间策略debug：

<H3C>debugging  packet-filter  packet ip acl 3500

*Mar 22 10:12:25:381 2011 Sysname pflt/7/Event: -MDC=1; The packet is permitted. Interface=Ten-GigabitEthernet7/0/18, Direction=OUTBOUND; Packet Info: Src-IP=1.1.1.1, Dst-IP=2.2.2.2, VPN-Instance=vpn1, Src-Port=1024, Dst-Port=1025, Protocol=icmp(1), ACL=3500, Rule-ID=0.

（3）对象策略debug：

<H3C>debugging object-policy packet ip acl 3500   

*Mar 22 10:12:25:381 2011 Sysname pflt/7/Event: -MDC=1; The packet is permitted. Src-ZOne= DMZ, Dst-ZOne=TRUST; Match Info: Src-IP=1.1.1.1, Dst-IP=2.2.2.2, VPN-Instance=vpn1, Src-Port=1024, Dst-Port=1025, Protocol=icmp(1), ObjectPolicy=policy1.

（4）安全策略debug：

<H3C>debugging security-policy packet ip acl 3500

*Nov  2 14:54:50:184 2019 H3C FILTER/7/PACKET: -COntext=1; The packet is permitted. Src-ZOne=Trust, Dst-ZOne=Untrust;If-In=GigabitEthernet1/0/3(4), If-Out=GigabitEthernet1/0/1(2); Packet Info:Src-IP=192.168.1.2, Dst-IP=192.168.10.2, VPN-Instance=, Src-MacAddr=3417-eb7d-3176,Src-Port=8, Dst-Port=0, Protocol=ICMP(1), Application=ICMP(22742), SecurityPolicy=1, Rule-ID=0.

域间策略、对象策略、安全策略三者有其一即可，观察动作是permit还是denied，若为denied，查看命中哪条策略，并在对应配置中排查。若一条策略也没命中，说明防火墙未放通此流量（缺省deny），需手动增加策略放通。

注：vpn instance和ipv6流量需另外增加策略放通，无法和普通IPV4策略混用。

vpn instance策略：

[H3C]security-policy ip

[H3C-security-policy-ip]rule name 1

[H3C-security-policy-ip-0-cs]vrf cs

IPV6策略:

[H3C]security-policy ipv6

（5）ASPF debug

<H3C>debug aspf packet acl 3500

<H3C> debugging aspf packet

*Aut 28 12:09:44:309 2011 Sysname ASPF/7/PACKET: -MDC=1; The packet of no session was dropped by ASPF, because the TCP SYN checking failed. Interface=GigabitEthernet1/0/2, Diretion=INBOUND; Packet Info: Src-IP=1.1.1.1, Dst-IP=1.1.1.2, VPN-Instance=none, Src-Port=12345, Dst-Port=21, Protocol=tcp（6）.

排查流量是否被ASPF阻断。