不涉及
不涉及
背景:某局点版本老旧依旧使用的是传统的包过滤策略,后续客户要求替换为更为先进的安全策略。现场在安全策略使能的情况下,发现新增rule之后,OSPF邻居中断,业务异常。
日志记录如下:
%Apr 12 21:18:05:804 2023 M9006 SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=10.107.239.237-User=dnt; Command is security-policy ip
%Apr 12 21:18:09:883 2023 M9006 SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=10.107.239.237-User=dnt; Command is display this
%Apr 12 21:19:00:307 2023 M9006 SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=10.107.239.237-User=dnt; Command is rule name 20210605_local-SERVER ----防火墙安全策略动作缺省为drop,匹配条件为空,ospf报文匹配到该策略,被丢弃
%Apr 12 21:19:07:157 2023 M9006 OSPF/6/OSPF_LAST_NBR_DOWN: OSPF 1 Last neighbor down event: Router ID: 10.101.34.2 Local address: 10.101.39.118 Remote address: 10.101.39.117 Reason: DeadInterval timer expired.
%Apr 12 21:19:07:157 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.117(Route-Aggregation20.4033) changed from FULL to DOWN.
%Apr 12 21:19:08:157 2023 M9006 OSPF/6/OSPF_LAST_NBR_DOWN: OSPF 1 Last neighbor down event: Router ID: 10.101.34.45 Local address: 10.101.39.102 Remote address: 10.101.39.101 Reason: DeadInterval timer expired.
%Apr 12 21:19:08:157 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.101(Route-Aggregation1) changed from FULL to DOWN.
%Apr 12 21:19:08:157 2023 M9006 OSPF/6/OSPF_LAST_NBR_DOWN: OSPF 1 Last neighbor down event: Router ID: 10.101.34.1 Local address: 10.101.39.114 Remote address: 10.101.39.113 Reason: DeadInterval timer expired.
%Apr 12 21:19:08:157 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.113(Route-Aggregation10.4032) changed from FULL to DOWN.
%Apr 12 21:19:08:158 2023 M9006 OSPF/6/OSPF_LAST_NBR_DOWN: OSPF 1 Last neighbor down event: Router ID: 10.101.34.46 Local address: 10.101.39.106 Remote address: 10.101.39.105 Reason: DeadInterval timer expired.
%Apr 12 21:19:08:158 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.105(Route-Aggregation2) changed from FULL to DOWN.
%Apr 12 21:21:02:415 2023 M9006 SSHS/6/SSHS_DISCONNECT: SSH user dnt (IP: 10.107.239.237) disconnected from the server.
%Apr 12 21:21:02:425 2023 M9006 SHELL/5/SHELL_LOGOUT: dnt logged out from 10.107.239.237.
%Apr 12 21:21:05:586 2023 M9006 SHELL/6/SHELL_CMD: -Line=-IPAddr=**-User=**; Command is undo debugging all
%Apr 12 21:23:49:123 2023 M9006 SHELL/5/SHELL_LOGIN: dnt logged in from con1/0.
%Apr 12 21:23:51:505 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is sys
%Apr 12 21:23:55:980 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is display interface Reth 1
%Apr 12 21:24:18:901 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is security-policy ip
%Apr 12 21:24:20:128 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is display this
%Apr 12 21:24:25:541 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is rule 0
%Apr 12 21:24:31:737 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is display this
%Apr 12 21:24:38:146 2023 M9006 CFGMAN/5/CFGMAN_CFGCHANGED: -EventIndex=12-CommandSource=snmp-COnfigSource=startup-COnfigDestination=running; Configuration changed.
%Apr 12 21:24:40:957 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is source-zone local
%Apr 12 21:24:52:734 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is source-zone SERVER
%Apr 12 21:24:59:889 2023 M9006 SHELL/6/SHELL_CMD: -Line=con1/0-IPAddr=**-User=dnt; Command is destination-zone SERVER ---添加匹配条件后,ospf报文可以正常匹配包过滤测试
%Apr 12 21:25:06:540 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.105(Route-Aggregation2) changed from LOADING to FULL.
%Apr 12 21:25:07:194 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.113(Route-Aggregation10.4032) changed from LOADING to FULL.
%Apr 12 21:25:07:205 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.117(Route-Aggregation20.4033) changed from LOADING to FULL.
%Apr 12 21:25:08:032 2023 M9006 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 10.101.39.101(Route-Aggregation1) changed from LOADING to FULL.
首先,需要明确的的是当安全策略与包过滤策略同时配置时,因为安全策略对报文的处理在包过滤之前,报文与安全策略规则匹配成功后,不再进行包过滤处理,所以请合理配置安全策略和包过滤策略,否则可能会导致配置的包过滤策略不生效。
根据日志记录可以看出,新增安全策略后,OSPF立即中断。分析原因应该是防火墙安全策略缺省动作为drop,匹配条件为空(即所有流量均能匹配到该规则),OSPF报文匹配到该策略,被丢弃导致邻居中断。后续再安全策略中添加匹配条件后,OSPF报文无法匹配安全策略,继续匹配原来的包过滤策略,邻居状态变为FULL状态。
解决方案:先disable安全策略,等安全策略的配置完成后,重新使能安全策略。
此外,还需要注意:安全策略功能与对象策略功能在设备上不能同时使用,首次进入安全策略视图后,对象策略功能立即失效。这一点要和包过滤策略做区分。安全策略缺省动作为拒绝,使用对象策略的场景下使能安全策略后有业务全部中断的风险!
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作