问

防火墙外部ping 内部服务器丢包严重

设备部署方式

2024-04-29提问

0关注
0收藏，269浏览

今天

今天零段

粉丝：0人关注：0人

问题描述：

使用 F100-C-G5 防火墙的路由模式部署，3口是Trust 区域，连接服务器，大概12台左右；2口是Management区域，连接办公网络，大概150人左右，服务器作为测试环境使用，现在新增了一台服务器，从办公区域ping 有33%的丢包，ping 其他服务器没有丢包；在服务器上互ping 也没有丢包；从防火墙上ping 新增的这台服务器，也存在丢包。

4 个回答

按时间按赞数

叫我靓仔

叫我靓仔九段

粉丝：207人关注：1人

F100是百兆墙，看下流量，带宽利用率多少

丢包无非是因为链路拥塞或者物理问题引起的，小概率系统问题，或者网卡问题

GigabitEthernet1/0/3 Current state: UP Line protocol state: UP Description: GuideLan Interface Bandwidth: 1000000 kbps Maximum transmission unit: 1500 Allow jumbo frames to pass Broadcast max-ratio: 100% Multicast max-ratio: 100% Unicast max-ratio: 100% Internet address: 192.178.10.1/24 (Primary) IP packet frame type: Ethernet II, hardware address: b845-f4b8-30db IPv6 packet frame type: Ethernet II, hardware address: b845-f4b8-30db Media type is twisted pair, loopback not set, promiscuous mode not set 1000Mb/s, Full-duplex, link type is autonegotiation Output flow-control is disabled, input flow-control is disabled Last link flapping: 2 weeks 1 days 22 hours 46 minutes Last clearing of counters: Never Current system time:2024-04-29 15:01:48 Last time when physical state changed to up:2024-04-13 16:15:40 Last time when physical state changed to down:2024-04-13 16:15:34 Peak input rate: 102802884 bytes/sec, at 2024-04-16 13:46:14 Peak output rate: 50776974 bytes/sec, at 2024-04-23 09:07:39 Last 300 second input: 1461 packets/sec 1209130 bytes/sec 1% Last 300 second output: 1086 packets/sec 315507 bytes/sec 0% Input (total): 2169738080 packets, 1802953992134 bytes 2168431000 unicasts, 78169 broadcasts, 1228911 multicasts, 0 pauses Input (normal): 2169738080 packets, 1802953992134 bytes 2168431000 unicasts, 78169 broadcasts, 1228911 multicasts, 0 pauses Input: 0 input errors, 0 runts, 0 giants, - throttles 0 CRC, 0 frame, 0 overruns, 0 aborts 0 ignored, - parity errors Output (total): 1485149083 packets, 513172849473 bytes 1485135728 unicasts, 13355 broadcasts, 0 multicasts, 0 pauses Output (normal): 1485149083 packets, 513172849473 bytes 1485135728 unicasts, 13355 broadcasts, 0 multicasts, 0 pauses Output: 0 output errors, 0 underruns, - buffer failures 0 aborts, 0 deferred, 0 collisions, 0 late collisions 0 lost carrier, 0 no carrier 这的丢包的时候采集的，看起来端口带宽利用率不高

今天发表时间：2024-04-29

zhiliao_h907dg

zhiliao_h907dg 九段

粉丝：52人关注：1人

debug 看一下吧

debug ip packet acl 命令产看正向报文是否到达防火墙
debug ip packet acl 可以看 prompt 信息比如有路由黑洞，或者是没有路由
debugging security-policy packet ip acl ， debugging aspf packet acl查看是否被策略阻断
debugging ip info acl 如果有丢包，则打印丢包信息的具体模块，没有丢包不显示