终端—公网—MSR5620—内网
无
终端通过SSL VPN拨号后,无法通过MSR 5620的内网口地址登录设备WEB或者telnet,通过公网口地址登录正常。
终端SSL VPN拨号之后,ping内网口地址能通,说明网络正常,通过公网口地址telnet设备或者登录WEB正常,说明设备的服务是开启的。
终端ping设备内网口地址时,debug信息收发均正常
<MSR5620>*Apr 24 15:16:14:193 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Receiving, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 60, pktid = 44283, offset = 0, ttl = 64, protocol = 1
checksum = 12853, s = 1.1.1.1, d = 1.1.1.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Receiving IP packet from interface SSLVPN-AC1.
Payload: ICMP
type = 8, code = 0, checksum = 0x4c99.
*Apr 24 15:16:14:193 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Delivering, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 60, pktid = 44283, offset = 0, ttl = 64, protocol = 1
checksum = 12853, s = 1.1.1.1, d = 1.1.1.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Forwarding IP packet to upper layer.
Payload: ICMP
type = 8, code = 0, checksum = 0x4c99.
*Apr 24 15:16:14:193 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Sending, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 60, pktid = 56115, offset = 0, ttl = 255, protocol = 1
checksum = 17660, s = 1.1.1.2, d = 1.1.1.1
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Sending IP packet from local at interface SSLVPN-AC1.
Payload: ICMP
type = 0, code = 0, checksum = 0x5499.
通过内网口地址telnet登录时,debug看到设备只有收,没有发
*Apr 24 15:16:24:562 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Receiving, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 52, pktid = 44287, offset = 0, ttl = 128, protocol = 6
checksum = 45619, s = 1.1.1.1, d = 1.1.1.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Receiving IP packet from interface SSLVPN-AC1.
Payload: TCP
source port = 30822, destination port = 23
sequence num = 0x8b536aeb, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0x69d2, header length = 32.
*Apr 24 15:16:24:562 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Delivering, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 52, pktid = 44287, offset = 0, ttl = 128, protocol = 6
checksum = 45619, s = 1.1.1.1, d = 1.1.1.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Forwarding IP packet to upper layer.
Payload: TCP
source port = 30822, destination port = 23
sequence num = 0x8b536aeb, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0x69d2, header length = 32.
*Apr 24 15:16:25:572 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Delivering, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 52, pktid = 44288, offset = 0, ttl = 128, protocol = 6
checksum = 45618, s = 1.1.1.1, d = 1.1.1.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Forwarding IP packet to upper layer from FastForward.
Payload: TCP
source port = 30822, destination port = 23
sequence num = 0x8b536aeb, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0x69d2,
header length = 32.
*Apr 24 15:16:27:586 2022 MSR5620 IPFW/7/IPFW_PACKET: -Slot=2;
Delivering, interface = SSLVPN-AC1
version = 4, headlen = 20, tos = 0
pktlen = 52, pktid = 44289, offset = 0, ttl = 128, protocol = 6
checksum = 45617, s = 1.1.1.1, d = 1.1.1.2
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Forwarding IP packet to upper layer from FastForward.
Payload: TCP
source port = 30822, destination port = 23
sequence num = 0x8b536aeb, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0x69d2, header length = 32.
后续确认本地登录(包括telnet和WEB)会话需要走slot 0,而根据debug信息可以看到SSL VPN会话发生在slot 2上,所以出现了无法登录设备的情况。
对于SSL VPN场景在分布式设备和IRF环境下会出现部分流量不通的情况,原因在于SSL VPN的流量不支持跨框和跨板转发,来回流量只能在一个转发板卡上,所以部署SSL VPN时,需要保证流量在一个转发板上。
现场使用的MSR 5620设备转控分离,从而触发了SSL VPN流量登录本机不通的问题,如果通过SSL VPN访问内网设备,此时会话不走slot 0,所以访问内网没有问题。
MSR 56设备不支持这种场景的使用。
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作