HCL 实验 防火墙IRF，配置NAT后连接不正常，何解？？（估计为会话不同步导致）

2台路由器、防火墙、交换机均做IRF，三者之间的4条线路均做三层链路聚合，配置NAT后无法正常连接【HCL配置文件在附件中】

防火墙上已配置下面的会话相关命令：

 session dual-active enable

 session synchronization enable asymmetric 

 session synchronization dns http

 session state-machine mode loose

（1）在防火墙上做出接口IP 192.168.1.2 的PAT地址转换，交换机无法ping 通 2.1.1.1和20.1.1.1；

acl basic 2000

 rule 0 permit

#

interface Route-Aggregation1

 ip address 192.168.1.2 255.255.255.0

 nat outbound 2000

在防火墙上debug ip packet，信息如下（完整参考附件debug-pat.log）

[Firewall]*May  8 16:09:53:239 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1;   【从防火墙 IRF主接收】

Receiving, interface = Route-Aggregation2

checksum = 39007, s = 10.1.1.1, d = 20.1.1.1

prompt: Receiving IP packet from interface Route-Aggregation2.

Payload: ICMP

*May  8 16:09:53:239 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1; 

Sending, interface = Route-Aggregation1

checksum = 58038, s = 192.168.1.2, d = 20.1.1.1

prompt: Sending IP packet received from interface Route-Aggregation2 at interface Route-Aggregation1.

Payload: ICMP

*May  8 16:09:53:083 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1-Slot=2;   【从防火墙 IRF备返回】

Receiving, interface = Route-Aggregation1

checksum = 57782, s = 20.1.1.1, d = 192.168.1.2

prompt: Receiving IP packet from interface Route-Aggregation1.

Payload: ICMP

*May  8 16:09:53:083 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1-Slot=2; 

Delivering, interface = Route-Aggregation1

checksum = 57782, s = 20.1.1.1, d = 192.168.1.2

prompt: Forwarding IP packet to upper layer. 【转发到上层到哪了？】

Payload: ICMP

（2）在防火墙上做IP地址组 192.168.1.3 的PAT地址转换，交换机无法ping 通 20.1.1.1，但是可以ping 通2.1.1.1；

nat address-group 1 name outip

 address 192.168.1.3 192.168.1.3

#

interface Route-Aggregation1

 ip address 192.168.1.2 255.255.255.0

  nat outbound address-group name outip

在防火墙上debug ip packet，信息如下（完整参考附件debug-nat.3.log）

<Firewall>*May  8 16:02:59:642 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1;  【从防火墙 IRF主接收】

Receiving, interface = Route-Aggregation2

checksum = 39027, s = 10.1.1.1, d = 20.1.1.1

prompt: Receiving IP packet from interface Route-Aggregation2.

Payload: ICMP

*May  8 16:02:59:642 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1; 

Sending, interface = Route-Aggregation1

checksum = 58057, s = 192.168.1.3, d = 20.1.1.1

prompt: Sending IP packet received from interface Route-Aggregation2 at interface Route-Aggregation1.

Payload: ICMP

*May  8 16:02:58:843 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1-Slot=2;   【从防火墙 IRF备返回】

Receiving, interface = Route-Aggregation1

checksum = 57801, s = 20.1.1.1, d = 192.168.1.3

prompt: Receiving IP packet from interface Route-Aggregation1.

Payload: ICMP

*May  8 16:02:58:843 2024 Firewall IPFW/7/IPFW_PACKET: -COntext=1-Slot=2; 

Discarding, interface = Route-Aggregation1

checksum = 58057, s = 20.1.1.1, d = 192.168.1.3

prompt: FIB BLACKHOLE.           【转发黑洞丢弃了！！！】

Payload: ICMP

（3）在防火墙上做IP地址组 192.168.1.4 的PAT地址转换，交换机可以ping 通 20.1.1.1和2.1.1.1；

nat address-group 1 name outip

 address 192.168.1.3 192.168.1.4

#

interface Route-Aggregation1

 ip address 192.168.1.2 255.255.255.0

  nat outbound address-group name outip

在防火墙上debug ip packet，信息参考附件debug-nat.4.log