F1005系统日志会话什么都正常,但是监控里面看不到流量日志,哪位大佬知道怎么回事 下面配上配置文件
[NBXS-FW-10.156.160.254]dis cu
#
version 7.1.064, Release 9524P41
#
sysname NBXS-FW-10.156.160.254
#
clock timezone Beijing add 08:00:00
#
context Admin id 1
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
ip unreachables enable
ip ttl-expires enable
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 500 to 516
#
object-group ip address DNS&NTP????
security-zone ToNanKou
0 network host address 10.19.3.8
10 network host address 10.0.3.6
20 network host address 172.16.9.4
30 network host address 10.0.18.250
#
object-group ip address ??AP
security-zone Trust
0 network subnet 10.156.162.0 255.255.255.0
#
object-group ip address ???AP
security-zone Trust
0 network subnet 10.156.164.0 255.255.255.0
#
object-group ip address ?????
security-zone ToNanKou
0 network host address 10.19.202.81
#
object-group ip address ????ISC
security-zone ToNanKou
0 network host address 10.0.18.250
#
object-group ip address ??????
security-zone Trust
0 network subnet 10.156.165.0 255.255.255.0
#
object-group ip address ??????
security-zone Trust
0 network subnet 10.156.160.0 255.255.255.0
#
object-group ip address ?????
security-zone Trust
0 network host address 10.156.165.31
10 network host address 10.156.165.32
#
object-group ip address ???ISC
security-zone ToNanKou
0 network host address 10.193.159.2
#
object-group ip address ????AC
security-zone ToNanKou
0 network host address 10.19.25.2
#
object-group ip address ?????AC
security-zone ToNanKou
0 network host address 10.19.25.3
#
object-group ip address ???????????
security-zone ToNanKou
0 network host address 10.193.168.15
10 network host address 10.195.193.2
20 network host address 10.193.130.8
#
object-group ip address ?????
security-zone Trust
0 network subnet 10.156.161.0 255.255.255.0
#
object-group ip address ?????
security-zone ToNanKou
0 network host address 10.19.120.238
10 network host address 10.0.12.184
20 network host address 10.0.12.183
#
object-group ip address ????????
security-zone ToNanKou
0 network subnet 10.19.12.0 255.255.255.0
10 network subnet 10.19.120.0 255.255.255.0
20 network subnet 10.75.87.0 255.255.255.0
#
object-group service 161
0 service udp destination eq 161
#
object-group service 8000
0 service tcp destination eq 8000
#
object-group service 8443
0 service tcp destination eq 8443
#
object-group service AC???
0 service tcp destination eq 6633
10 service udp destination range 5246 5247
#
controller Cellular1/0/0
#
interface NULL0
#
interface LoopBack0
ip address 10.156.160.254 255.255.255.255
#
interface Vlan-interface500
description Mgt
ip address 10.156.160.253 255.255.255.0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
description To_DianXin
combo enable copper
ip address 122.227.183.251 255.255.255.248
tcp mss 1200
ipsec apply policy To-NanKou
gateway 122.227.183.249
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
#
interface GigabitEthernet1/0/11
port link-mode route
#
interface GigabitEthernet1/0/3
port link-mode bridge
port access vlan 500
#
interface Tunnel0 mode gre
ip address 169.254.225.1 255.255.255.252
tcp mss 1200
source 122.227.183.251
destination 223.71.25.99
#
security-zone name Local
#
security-zone name Trust
import interface LoopBack0
import interface Vlan-interface500
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
#
security-zone name Management
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
#
security-zone name ToNanKou
import interface Tunnel0
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
set authentication password hash $h$6$dzBMZARge81bEekI$hWruW7KgK45uIRjVcIxBrcIUtLnwnevzX+k75ovkSA5QUnrP5yiWGJhBTfQSRog9EUJvjBo/GRVK9NbIdu3mPg==
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
command authorization
command accounting
#
ip route-static 10.0.0.0 8 169.254.225.2
ip route-static 10.156.160.0 20 10.156.160.1
ip route-static 172.16.0.0 12 169.254.225.2
ip route-static 192.103.96.0 24 169.254.225.2
#
info-center loghost source Vlan-interface500
info-center loghost 10.0.12.183
info-center loghost 10.0.12.184
info-center source FILTER logfile deny
#
snmp-agent
snmp-agent local-engineid 800063A28030B0375B5FD800000001
snmp-agent community read sanywljk
snmp-agent sys-info version v2c v3
snmp-agent target-host trap address udp-domain 10.0.12.183 params securityname sanywljk v2c
snmp-agent target-host trap address udp-domain 10.0.12.184 params securityname sanywljk v2c
snmp-agent mib-view included iso-view iso
snmp-agent trap enable arp
snmp-agent trap enable ike
snmp-agent trap enable ipsec
snmp-agent trap enable radius
snmp-agent trap enable syslog
snmp-agent trap source Vlan-interface500
#
ssh server enable
#
ntp-service enable
ntp-service source Vlan-interface500
ntp-service unicast-server 10.0.3.6
ntp-service unicast-server 172.16.9.4
#
acl advanced 3001
rule 1 permit ip source 122.227.183.251 0 destination 223.71.25.99 0
#
hwtacacs scheme sany
primary authentication 10.0.164.142
primary authorization 10.0.164.142
primary accounting 10.0.164.142
secondary authentication 10.0.164.143
secondary authorization 10.0.164.143
secondary accounting 10.0.164.143
key authentication cipher $c$3$+HdMShjUL98dUppLRzdRcMBtgWCBA06LHFRxfzbC
key authorization cipher $c$3$KIwQnZQVfpqPs9OV23k2fjxjjFvZg6vDwYTtpaBl
key accounting cipher $c$3$OoZDUaNy/y8YXYrqlVRD+zzPX73miMDa82EQNFtz
timer response-timeout 2
user-name-format without-domain
nas-ip 10.156.160.254
#
domain system
authentication login hwtacacs-scheme sany local
authorization login hwtacacs-scheme sany local
accounting login hwtacacs-scheme sany local
authentication super hwtacacs-scheme sany
authorization command hwtacacs-scheme sany local
accounting command hwtacacs-scheme sany
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$wlsdWA1XISxnU/FO$6QVpyvkrs1+zAdOAeNNLleeSJsRNTZhLqaFJAdPf4lLX0rr8sj0vTnRuzfWWBmsRp+8zthe6zQ0YbTBTOjtllg==
service-type ssh telnet terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user sany_admin class manage
password hash $h$6$cAOT/7PrvukuEBH6$tmNYudVoSrAZKCRgfvwB8iioICUFrQLLBCyZucsUB9TidiuXUZ9/OMjnhHxp7+0lcbXFU+msovuGXE7yikxVRQ==
service-type ssh
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
public-key peer 10.156.160.1
public-key-code begin
30819F300D06092A864886F70D010101050003818D0030818902818100A9ED927110290229
8397AFA5B905990715D9228EE6ED4704091345E9DDBD470A68607D3FB8855FD68488167543
EAF9094B1552B19B494E4560F7C3EB282822438BF1BA2E3C462E52AC0FCBC3C1A97A6A84B9
F58DA6954E5342C4CF6ED66BFEE793EC1D76037786D826833A0DCE19FB419638A21161732E
174982B940F51946DB0203010001
public-key-code end
peer-public-key end
#
session statistics enable
session synchronization enable
session synchronization http
#
ipsec logging negotiation enable
#
ipsec transform-set To-NanKou
esp encryption-algorithm aes-cbc-256
esp authentication-algorithm sha256
#
ipsec policy To-NanKou 10 isakmp
transform-set To-NanKou
security acl 3001
remote-address 223.71.25.99
ike-profile To-NanKou
#
application global statistics enable
#
ike logging negotiation enable
#
ike profile To-NanKou
keychain To-NanKou
match remote identity address 223.71.25.99 255.255.255.255
proposal 1
#
ike proposal 1
encryption-algorithm aes-cbc-256
authentication-algorithm sha256
#
ike keychain To-NanKou
pre-shared-key address 223.71.25.99 255.255.255.255 key cipher $c$3$oRpdKL2X3/ALV6vIycq/Xi7kKYNn4hEARDoS
#
ip https enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
security-policy ip
rule 14 name ??????-To-??????
action pass
logging enable
counting enable
source-zone Trust
destination-zone ToNanKou
source-ip ??????
destination-ip ?????
service snmp-trap
service syslog
rule 13 name Ping-Any
action pass
logging enable
counting enable
service ping
rule 12 name ?????-To-Any
action pass
logging enable
counting enable
source-zone ToNanKou
source-ip ?????
rule 11 name ?????-To-??????
action pass
logging enable
counting enable
source-zone ToNanKou
destination-zone Trust
source-ip ?????
destination-ip ??????
service 161
rule 10 name ?????-To-??????
action pass
logging enable
counting enable
source-zone Trust
destination-zone ToNanKou
source-ip ?????
destination-ip ????????
service https
service 8443
rule 9 name ??????-To-??
action pass
logging enable
counting enable
source-zone ToNanKou
destination-zone Trust
source-ip ???????????
destination-ip ?????
service 8000
rule 8 name ????ISC-To-???????
action pass
logging enable
counting enable
source-zone ToNanKou
destination-zone Trust
source-ip ????ISC
destination-ip ??????
service 8000
rule 7 name Any-To-DNS
action pass
logging enable
counting enable
source-zone Trust
destination-zone ToNanKou
destination-ip DNS&NTP????
service ntp
service dns-tcp
service dns-udp
rule 6 name ???ISC-To-???
action pass
logging enable
counting enable
source-zone ToNanKou
destination-zone Trust
source-ip ???ISC
destination-ip ??????
service 8000
rule 5 name ???AP-To-AC
action pass
logging enable
counting enable
source-zone Trust
destination-zone ToNanKou
source-ip ???AP
destination-ip ?????AC
service AC???
rule 4 name AP-To-AC
action pass
logging enable
counting enable
source-zone Trust
destination-zone ToNanKou
source-ip ??AP
destination-ip ????AC
service AC???
rule 0 name local-Untrust
action pass
logging enable
counting enable
source-zone Untrust
source-zone Local
destination-zone Local
destination-zone Untrust
rule 2 name local-NanKou
action pass
logging enable
counting enable
source-zone ToNanKou
source-zone Local
destination-zone Local
destination-zone ToNanKou
rule 1 name test
action pass
counting enable
source-zone Trust
destination-zone ToNanKou
rule 3 name Any_To_Any
action pass
logging enable
counting enable
#
return
[NBXS-FW-10.156.160.254]
最佳答案
在命令下打开试试,之后再看看
session statistics enable
session top-statistics enable
application global statistics enable
如果application global statistics enable命令敲不上,使用下面命令试试
dac traffic-statistic user enable verbose
dac traffic-statistic application enable verbose
也可参考案例 F1000系列防火墙上看不到流量日志 - 知了社区
application global statistics enable 这个可以 下面两个不支持 但是还是看不到流量日志
时间正确吗?看一下防火墙的时间
时间是正确的
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
时间是正确的