各位大佬，我想要一个防火墙查会话的案例，谢谢

有的

华三防火墙会话处理机制简述

       我们把数据通信的基本单位叫做报文，然后把五元组相同的报文放到一起，称作流。更进一步讲，把两条对应的流称为一个会话。这里“对应的流”是指通信双方为完成一个特定功能发送的请求报文流，以及对应的应答报文流。

       会话是个双向的概念，它基于应用，区分应用的发起方和响应方，明确两条流的方向，并维护它们的通信状态。目前设备支持对如下协议建立单播会话：

  dccp      Datagram Congestion Control Protocol (DCCP)

  icmp      Internet Control Message Protocol (ICMP)

  raw-ip    RAW IP

  sctp      Stream Control Transmission Protocol (SCTP)

  tcp       Transmission Control Protocol (TCP)

  udp       User Datagram Protocol (UDP)

  udp-lite  Lightweight User Datagram Protocol (UDP-Lite)

首先看一下设备对报文的处理流程，如下图所示：

首包到达设备会进入创建会话流程（这并不是最终的会话，而只是一个临时的会话，所以debug的打印叫session entry），它只用来处理首包的会话业务。如果所有业务都处理正常，临时会话会在报文发送前正式化，形成用户可见的会话表项，为后续报文提供服务。这个正式化的阶段叫做Session-end，它作为会话创建的结束点固化在转发流程中。

为保证正式化时会话拥有全部业务的信息，要求所有会话业务的处理都注册到Session-end之前。当然，如果中途有业务把报文丢弃的话，临时会话就会删除，不会再走到Session-end阶段进行正式化了。示例如下：

因此可以联想到，如果安全策略阻断某条业务流，查看对应会话是看不到的。原因就在于会话在正式化之前就已经被删除。示例如下：

*Jan 18 18:58:38:766 2024 F5080D_1 IPFW/7/IPFW_PACKET: -Chassis=1-Slot=2; 

Receiving, interface = Route-Aggregation1.10

version = 4, headlen = 20, tos = 0

pktlen = 84, pktid = 52628, offset = 0, ttl = 255, protocol = 1

checksum = 54724, s = 10.158.1.10, d = 10.158.2.10

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Receiving IP packet from interface Route-Aggregation1.10.

Payload: ICMP

  type = 8, code = 0, checksum = 0xb32f.

 

 

*Jan 18 18:58:38:766 2024 F5080D_1 SESSION/7/TABLE: -Chassis=1-Slot=2; 

 Tuple5(EVENT): 10.158.1.10/38201-->10.158.2.10/2048(ICMP(1))

 Session entry was created.   ----新建会话流程

*Jan 18 18:58:38:766 2024 F5080D_1 FILTER/7/PACKET: -Chassis=1-Slot=2; The packet is denied. Src-ZOne=Trust, Dst-ZOne=DMZ;If-In=Route-Aggregation1.10(334), If-Out=Route-Aggregation1.20(336); Packet Info:Src-IP=10.158.1.10, Dst-IP=10.158.2.10, VPN-Instance=, Src-MacAddr=b0f9-63b3-c46e,Src-Port=8, Dst-Port=0, Protocol=ICMP(1), Application=ICMP(22742),Terminal=invalid(0), Url-category=invalid(65535), SecurityPolicy=icmp_deny, Rule-ID=2.  ----被安全策略阻断

 

*Jan 18 18:58:38:767 2024 F5080D_1 SESSION/7/TABLE: -Chassis=1-Slot=2; 

 Tuple5(EVENT): 10.158.1.10/38201-->10.158.2.10/2048(ICMP(1))

 Session entry was created.

*Jan 18 18:58:38:766 2024 F5080D_1 ASPF/7/PACKET: -Chassis=1-Slot=2; The first packet was dropped by packet filter or object-policy. Src-ZOne=Trust, Dst-ZOne=DMZ;If-In=Route-Aggregation1.10(334), If-Out=Route-Aggregation1.20(336); Packet Info:Src-IP=10.158.1.10, Dst-IP=10.158.2.10, VPN-Instance=none, Src-Port=38201, Dst-Port=2048. Protocol=ICMP(1).

 

*Jan 18 18:58:38:766 2024 F5080D_1 SESSION/7/TABLE: -Chassis=1-Slot=2; 

 Tuple5(EVENT): 10.158.1.10/38201-->10.158.2.10/2048(ICMP(1))

 Session entry was deleted.       ---策略阻断，会话被删除

*Jan 18 18:58:41:771 2024 F5080D_1 SESSION/7/TABLE: -Chassis=1-Slot=2; 

 Tuple5(EVENT): 10.158.1.10/38201-->10.158.2.10/2048(ICMP(1))

 Session entry was deleted.

同样，如果报文转发找不到出接口，会话同样会被删除。

*Jan 18 19:02:43:955 2024 F5080D_1 IPFW/7/IPFW_PACKET: -Chassis=1-Slot=2; 

Receiving, interface = Route-Aggregation1.10

version = 4, headlen = 20, tos = 0

pktlen = 84, pktid = 52791, offset = 0, ttl = 255, protocol = 1

checksum = 54049, s = 10.158.1.10, d = 10.158.4.10

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Receiving IP packet from interface Route-Aggregation1.10.

Payload: ICMP

  type = 8, code = 0, checksum = 0x1cff.

 

 

*Jan 18 19:02:43:955 2024 F5080D_1 IPFW/7/IPFW_PACKET: -Chassis=1-Slot=2; 

Discarding, interface = Route-Aggregation1.10

version = 4, headlen = 20, tos = 0

pktlen = 84, pktid = 52791, offset = 0, ttl = 254, protocol = 1

checksum = 54305, s = 10.158.1.10, d = 10.158.4.10

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Destination is unreachable.

Payload: ICMP

  type = 8, code = 0, checksum = 0x1cff.

 

 

*Jan 18 19:02:43:955 2024 F5080D_1 SESSION/7/TABLE: -Chassis=1-Slot=2; 

 Tuple5(EVENT): 10.158.1.10/38270-->10.158.4.10/2048(ICMP(1))

 Session entry was created.

*Jan 18 19:02:43:955 2024 F5080D_1 SESSION/7/TABLE: -Chassis=1-Slot=2; 

 Tuple5(EVENT): 10.158.1.10/38270-->10.158.4.10/2048(ICMP(1))

 Session entry was deleted.

透明部署情况丢包案例分析：防火墙ASPF丢包典型案例分析

除了以上列举的情况外，会话被删除的原因还有很多，比如会话冲突无法新建会话，命中路由黑洞，命中攻击防范策略等，上述的每个处理模块都有可能导致会话流程终止，在此不一一列举。