F1050防火墙为业务网关，ping测试业务后防火墙回复icmp type3 code 0

设备型号：F1050

设备版本：version: 7.1.064, Release 9313P12

当前拓扑

问题描述：

221.208.164.10 访问 10.160.95.11 访问失败，通过ping测试 ，

当前收集的信息1

<4a-fw02>tracert -a 221.208.164.6 10.160.95.1 traceroute to 10.160.95.1 (10.160.95.1) from 221.208.164.6, 30 hops at most, 52 bytes each packet, press CTRL_C to break 

 1 10.10.40.1 (10.10.40.1) 0.434 ms 0.304 ms 0.315 ms

 2 10.10.20.1 (10.10.20.1) 2.524 ms 0.846 ms 0.722 ms

双方路由没有问题，通过OSPF学习，中间的FW1 的2个接口在相同区域，应该没有问题，使用的测试是域间策略引用ACL的那种；

%Sep 26 12:48:22:193 2021 4a-fw02 FILTER/6/FILTER_ZONE_EXECUTION_ICMP: -COntext=1; SrcZoneName(1025)=IpAsDomain;DstZoneName(1035)=Trust;Type(1067)=ACL;Acl(1068)=2222;RuleID(1078)=0;Protocol(1001)=ICMP;SrcIPAddr(1003)=221.208.164.10;DstIPAddr(1007)=10.160.95.11;IcmpType(1062)=ECHO(8);IcmpCode(1063)=0;MatchCount(1069)=296;Event(1048)=Permit; 

也抓到策略允许通过的提升

但是在FW2上抓debug 发现网关回复icmp type3 code 0 的网络不可达信息 ，通过在221.208.194.11安装抓包软件 发现也是网关回复这个icmp type3 code 0 

*Sep 26 10:00:02:206 2021 4a-fw02 IPFW/7/IPFW_PACKET: -COntext=1; 

 Sending, interface = Vlan-interface611 

version = 4, headlen = 20, tos = 0

 pktlen = 80, pktid = 40076, offset = 0, ttl = 255, protocol = 1 

checksum = 7022, s = 221.208.164.6, d = 221.208.164.10 channelID = 0,

 vpn-InstanceIn = 0, vpn-InstanceOut = 0. prompt: 

Sending IP packet from local at interface Vlan-interface611. Payload: ICMP type = 3, code = 0, checksum = 0x6163.   

这边

但是感觉这边的会话应该是正常的

dis session table ipv4 protocol icmp verbose 

 Slot 1: 

Initiator: 

 Source IP/port: 221.208.164.10/9 

 Destination IP/port: 10.160.95.11/2048 

 DS-Lite tunnel peer: 

- VPN instance/VLAN ID/Inline ID: -/-/- 

 Protocol: ICMP(1) Inbound interface: Vlan-interface611 

 Source security zone: IpAsDomain 

Responder: 

 Source IP/port: 10.160.95.11/9 

 Destination IP/port: 221.208.164.10/0 

 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- 

 Protocol: ICMP(1) Inbound interface: GigabitEthernet1/0/23 

 Source security zone: Trust 

State: ICMP_REPLY Application: ICMP Start time: 2021-09-26 01:22:16 TTL: 29s 

Initiator->Responder: 52876 packets 3172560 bytes 

Responder->Initiator: 52876 packets 3172560 bytes 

相关配置

​***.***/surl_yMAIpPfiNMG (提取码：5f94)​

配置信息在附件里