M9000 NAT 引流相关问题基本排查思路

M9000配置NAT后，通过debug aspf信息发现，业务流量的反方向报文引流至与正方向报文不同的Blade板卡，进而因匹配不到已有会话表项，被ASPF策略丢弃。

无。

M9000同一条会话的双向报文，必须被牵引至同一块Blade板卡处理，因此可通过以下步骤进行排查，以检查是否正在异常。

第一步：查看NAT配置是否下刷成功

[M9000]display nat all 

NAT outbound port block group information:                                                                                         

  Totally 8 outbound port block group items.                                                                                        

  Interface: GigabitEthernet1/5/0/24                                                                                               

    port-block-group: 1                                                                                                             

    Config status   : Active                                                                                                       

    Global flow-table status: Active                                                                                               

    Local flow-table status: Active                                                                                                

  Interface: GigabitEthernet1/5/0/24                                                                                               

    port-block-group: 2                                                                                                            

    Config status   : Active                                                                                                       

    Global flow-table status: Active                                                                                               

Local flow-table status: Active       

确认是否存在， Local 或者是Global 方向的 Inactive状态。

第二步：查看openflow 表象是否下发成功。

display system internal openflow instance inner-redirect flow-table 

     确认openflow表是否存在.

[M9000-probe]display system internal openflow instance inner-redirect flow-table                                                                                  

Instance 4097 flow table information:                                                                                              

Table 200 information:                                                                                                              

 Table type: Extensibility, flow entry count: 40, total flow entry count: 40                                                       

Flow entry 206 information:                                                                                                        

 cookie: 0x0, priority: 5525, hard time: 0, idle time: 0, flags: check_overlap                                                     

 |reset_counts|no_pkt_counts|no_byte_counts, byte count: --, packet count: --                                                      

Match information:                                                                                                                  

 Input interface: XGE1/5/0/25                                                                                                      

 Ethernet destination MAC address: 7425-8a7b-0612                                                                                  

 Ethernet destination MAC address mask: ffff-ffff-ffff                                                                             

 VLAN ID: 3000, mask: 0xfff                                                                                                        

 IP Range: IPv4 destination address from 140.243.0.1 to 140.243.8.49                                                               

Instruction information:                                                                                                           

 Write actions:                                                                                                                     

  Output interface: Blade1/4/0/1

通过表项可以确认引流规则是否存在，同时确认指定的出接口，是否对应正确的Blade板卡或备份组。

第三步：查看设备上是否有qacl资源，只要是有一块接口卡资源不足，就有可能因为资源不足的问题导致nat 配置下发失败。 因为有些资源是要求全局下刷。会把策略添加到所有的接口板。

nat static/ nat server的私网地址的规则不区分接口，要求全局下发

逻辑口上的配置，策略下发的时候会全局下发。

查看qacl资源的方法，请参考其它相关资料。

第四步：确认是否有接口上的MQC 引流策略，导致被MQC策略引走。接口下和全局的qos策略优先与openflow规则。

无

无