SecBlade IV NGFW(IM-NGFWX-IV）升级版本后出现丢包

现场两个防火墙模块插在两台SR8804X上，做的IRF加冗余组，从8560p40升级至 9660p51，发现模块直连PING路由器有丢包

让现场写ACLweb页面抓包，然后ping测试

测试Ping34个包，命令行上显示有丢包，但是抓包文件里34个包有发有收

在防火墙上debug ip packet和aspf，发现只有IPFW_PACKET，没有aspf的debug回显

查看驱动丢包和单核cpu使用情况：

dis process cpu slot 1 | in kdr

       486 0.0% 0.0% 0.0% [kdrvBoardTsk0]

       487 0.0% 0.0% 0.0% [kdrvdp0]

       488 0.0% 0.0% 0.0% [kdrvdp1]

       489 0.0% 0.0% 0.0% [kdrvdp2]

       490 0.0% 0.0% 0.0% [kdrvdp3]

       491 0.0% 0.0% 0.0% [kdrvdp4]

       492 0.0% 0.0% 0.0% [kdrvdp5]

       493 0.0% 0.0% 0.0% [kdrvdp6]

       494 0.0% 0.0% 0.0% [kdrvdp7]

       495 0.0% 0.0% 0.0% [kdrvdp8]

       496 0.0% 0.0% 0.0% [kdrvdp9]

       497 0.0% 0.0% 0.0% [kdrvdp10]

       498 0.0% 0.0% 0.0% [kdrvdp11]

       499 0.0% 0.0% 0.0% [kdrvdp12]

       500 0.0% 0.0% 0.0% [kdrvdp13]

       501 0.0% 0.0% 0.0% [kdrvdp14]

       502 0.0% 0.0% 0.0% [kdrvdp15]

       503 0.0% 0.0% 0.0% [kdrvdp16]

       504 0.0% 0.0% 0.0% [kdrvdp17]

       505 0.0% 0.0% 0.0% [kdrvdp18]

       506 0.0% 0.0% 0.0% [kdrvdp19]

       507 0.0% 0.0% 0.0% [kdrvdp20]

       508 0.0% 0.0% 0.0% [kdrvdp21]

       509 0.0% 0.0% 0.0% [kdrvdp22]

       510 0.0% 0.0% 0.0% [kdrvdp23]

       511 0.0% 0.0% 0.0% [kdrvdp24]

       512 0.0% 0.0% 0.0% [kdrvdp25]

       513 0.0% 0.0% 0.0% [kdrvdp26]

       514 0.0% 0.0% 0.0% [kdrvdp27]

       515 0.0% 0.0% 0.0% [kdrvdp28]

       516 0.0% 0.0% 0.0% [kdrvdp29]

       517 0.0% 0.0% 0.0% [kdrvdp30]

       518 0.0% 0.0% 0.0% [kdrvdp31]

       519 0.0% 0.0% 0.0% [kdrvdp32]

       520 0.0% 0.0% 0.0% [kdrvdp33]

       521 0.0% 0.0% 0.0% [kdrvdp34]

       522 0.0% 0.0% 0.0% [kdrvdp35]

       523 0.0% 0.0% 0.0% [kdrvdp36]

       524 0.0% 0.0% 0.0% [kdrvdp37]

       525 0.0% 0.0% 0.0% [kdrvdp38]

       526 0.0% 0.0% 0.0% [kdrvdp39]

       527 0.0% 0.0% 0.0% [kdrvdp40]

       528 0.0% 0.0% 0.0% [kdrvdp41]

       529 0.0% 0.0% 0.0% [kdrvdp42]

       530 0.0% 0.0% 0.0% [kdrvdp43]

       531 0.0% 0.0% 0.0% [kdrvdp44]

       532 0.0% 0.0% 0.0% [kdrvdp45]

       533 0.0% 0.0% 0.0% [kdrvdp46]

       534 0.0% 0.0% 0.0% [kdrvdp47]

       535 0.0% 0.0% 0.0% [kdrvDataSync0]

       542 0.0% 0.0% 0.0% [kdrvtxtemp0]

       544 0.0% 0.0% 0.0% [kdrvlink0]

现场主备倒换和重启测试，问题依旧

在路由器侧ping防火墙，同时抓包和debug，发现防火墙少回了几个包

现场回退版本后就没有问题

升级版本后ping丢包是因为copp限速导致，P51版本合入了copp限速功能，但是因为限速控制存在优化差异导致现场出现copp限速丢包，可以在升级版本后开启一个traffic qos策略。

Traffic class test

if-match control-plane protocol arp icmp http  

Traff behave test

  Packet-rate 10000(pps)

Qos policy test

 Class test behavior test

Control-plane slot 1 

  Qos apply policy test inbound

也可以等一下后面的100分支版本再进行升级

可以在升级版本后开启一个traffic qos策略。

Traffic class test

if-match control-plane protocol arp icmp http  

Traff behave test

  Packet-rate 10000(pps)

Qos policy test

 Class test behavior test

Control-plane slot 1 

  Qos apply policy test inbound

也可以等一下后面的100分支版本再进行升级