某局点 SecPath F5030-6GW-G(V7) SSLVPN不通

SecPath F5030-6GW-G(V7)，Version 7.1.064, Release 8160P47

现场两台F5030-6GW-G防火墙RBM主备+VRRP组网，VRRP虚地址与接口地址不在一个网段，做了SSLVPN不通，iNode登录SSLVPN提示，查询网关参数失败

（以下敏感信息已做脱敏处理）

公网地址：100.252.15.38    SSLVPN端口号：50000

查看现场SSLVPN配置，没有发现问题，查看会话，每次iNode登录，dis session table ipv4 destination-ip 100.252.15.38 destination-port 50000 verbose查看是有会话的，防火墙上是有会话产生的，进一步debug查看

先写一个到防火墙公网地址的ACL

#

acl advanced 3003

 rule 0 permit tcp destination 100.252.15.38 0 destination-port eq 50000

 rule 6 permit tcp source 100.252.15.38 0 source-port eq 50000

#

然后开启debug

debugging ip packet acl 3XXX

debugging ip info acl 3XXX

debugging aspf packet acl 3XXX

debugging security-policy packet ip acl 3XXX

 IPFW/7/IPFW_PACKET: -COntext=1;

Sending, interface = GigabitEthernet1/0/1

version = 4, headlen = 20, tos = 0

pktlen = 60, pktid = 1182, offset = 0, ttl = 255, protocol = 6

checksum = 39113, s = 100.252.15.38, d = 33.170.47.136

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Sending IP packet from local at interface GigabitEthernet1/0/1.

Payload: TCP

  source port = 50000, destination port = 32268

  sequence num = 0xa3f2617c, acknowledgement num = 0x450ac2c1, flags = 0x12

  window size = 65535, checksum = 0x2e53, header length = 40.

 IPFW/7/IPFW_PACKET: -COntext=1;

Delivering, interface = GigabitEthernet1/0/4

version = 4, headlen = 20, tos = 116

pktlen = 60, pktid = 28230, offset = 0, ttl = 56, protocol = 6

checksum = 46509, s = 33.170.47.136, d = 100.252.15.38

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Forwarding IP packet to upper layer from FastForward.

Payload: TCP

  source port = 32268, destination port = 50000

  sequence num = 0x450ac2c0, acknowledgement num = 0x00000000, flags = 0x2

  window size = 64240, checksum = 0x121f, header length = 40.

从上述debug可以看到，进防火墙的接口和出防火墙的接口不一致，在进来的端口配置ip last-hop hold保持上一跳使流量出去走同一个接口之后解决