知

某局点 msr3600 ipsec视频丢包

2025-02-05 发表

1关注
0收藏 809浏览

王听宇

王听宇五段

粉丝：3人关注：16人

组网及说明

摄像头192.168.1.4------0/1分支设备0/0----运营商-------0/9总部设备0/2------总部服务器11.11.11.11

告警信息

无

问题描述

总部从分支拉视频

总部同时从同一个分支拉两个摄像头的流量就卡

过程分析

视频卡顿，怀疑是丢包导致

如何确认丢包位置

1. ipsec流量统计

IPsec隧道正常建立，IPsec业务丢包 - 知了社区

2 出口镜像，看identification

3，隧道两边查看看ipsec隧道统计

# 显示所有IPsec隧道的简要信息。

<Sysname> display ipsec tunnel brief

----------------------------------------------------------------------------

Tunn-id Src Address Dst Address Inbound SPI Outbound SPI Status

----------------------------------------------------------------------------

0 192.168.0.61 192.168.0.64 54321 12345 --

# 显示ID为1的IPsec隧道处理的报文统计信息。

<Sysname> display ipsec statistics tunnel-id 0

IPsec packet statistics:

Received/sent packets: 5124/8231

Received/sent bytes: 52348/643561

Dropped packets (received/sent): 0/0

Dropped packets statistics

No available SA: 0

Wrong SA: 0

Invalid length: 0

Authentication failure: 0

Encapsulation failure: 0

Decapsulation failure: 0

Replayed packets: 0

ACL check failure: 0

MTU check failure: 0

Loopback limit exceeded: 0

清除IPsec的所有报文统计信息。

<Sysname> reset ipsec statistics

解决方法

发现丢在运营商，排查运营商

该案例对您是否有帮助：

您的评价：1

若您有关于案例的建议，请反馈：

2 个评论

王听宇

王听宇五段

粉丝：3人关注：16人

debugging ipsec all 中可以看到，类似如下回显

outbound IPsec processing: src Ip = 192.168.1.5, dst IP = 10.2.2.254, SPI = 2013677202

天天查案例的小王

天天查案例的小王知了小白

粉丝：0人关注：0人

思路：通过感兴趣流看ipsce sa的spi，通过spi找对应的tunnel编号，通过tunnl编号看统计

第一步如下：

查看感兴趣流

<FW>display acl 3104

Advanced IPv4 ACL 3104, 3 rules,

ACL's step is 5

rule 0 permit ip source 192.168.12.0 0.0.0.255 destination 192.168.6.0 0.0.0.255 (96654 times matched)

rule 5 permit ip source 192.168.12.0 0.0.0.255 destination 192.168.216.0 0.0.0.255 (192 times matched)

rule 10 permit ip source 192.168.12.0 0.0.0.255 destination 192.168.217.0 0.0.0.255

第二步如下：通过感兴趣流看对应sa的spi （一个rule对应一个ipsec sa，所有rule共用一个ike sa）

<FW>display ipsec sa

-------------------------------

Interface: GigabitEthernet1/0/10

-------------------------------

-----------------------------

IPsec policy: map1

Sequence number: 10

Mode: ISAKMP

-----------------------------

Tunnel id: 2

Encapsulation mode: tunnel

Perfect Forward Secrecy:

Inside VPN:

Extended Sequence Numbers enable: N

Traffic Flow Confidentiality enable: N

Transmitting entity: Responder

Path MTU: 1424

Tunnel:

local address: 120.86.184.129

remote address: 183.47.54.218

Flow:

sour addr: 192.168.12.0/255.255.255.0 port: 0 protocol: ip acl里一个rule 对应一个ipsec sa的flow

dest addr: 192.168.6.0/255.255.255.0 port: 0 protocol: ip

[Inbound ESP SAs]

SPI: 3494636767 (0xd04becdf)

Connection ID: 253403070465

Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256

SA duration (kilobytes/sec): 1843200/3600

SA remaining duration (kilobytes/sec): 1843178/3301

Max received sequence-number: 230

Anti-replay check enable: Y

Anti-replay window size: 64

UDP encapsulation used for NAT traversal: N

Status: Active

[Outbound ESP SAs]

SPI: 442940909 (0x1a66bded)

Connection ID: 7932804595712

Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256

SA duration (kilobytes/sec): 1843200/3600

SA remaining duration (kilobytes/sec): 1843178/3301

Max sent sequence-number: 230

UDP encapsulation used for NAT traversal: N

Status: Active

-----------------------------

IPsec policy: map1

Sequence number: 10

Mode: ISAKMP

-----------------------------

Tunnel id: 0

Encapsulation mode: tunnel

Perfect Forward Secrecy:

Inside VPN:

Extended Sequence Numbers enable: N

Traffic Flow Confidentiality enable: N

Transmitting entity: Responder

Path MTU: 1424

Tunnel:

local address: 120.86.184.129

remote address: 183.47.54.218

Flow:

sour addr: 192.168.12.0/255.255.255.0 port: 0 protocol: ip

dest addr: 192.168.216.0/255.255.255.0 port: 0 protocol: ip

[Inbound ESP SAs]

SPI: 4169742112 (0xf8893720)

Connection ID: 4599909974019

Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256

SA duration (kilobytes/sec): 1843200/3600

SA remaining duration (kilobytes/sec): 1843200/3301

Max received sequence-number: 0

Anti-replay check enable: Y

Anti-replay window size: 64

UDP encapsulation used for NAT traversal: N

Status: Active

[Outbound ESP SAs]

SPI: 584202424 (0x22d238b8)

Connection ID: 1000727379970

Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256

SA duration (kilobytes/sec): 1843200/3600

SA remaining duration (kilobytes/sec): 1843195/3301

Max sent sequence-number: 46

UDP encapsulation used for NAT traversal: N

Status: Active

-----------------------------

IPsec policy: map1

Sequence number: 10

Mode: ISAKMP

-----------------------------

Tunnel id: 1

Encapsulation mode: tunnel

Perfect Forward Secrecy:

Inside VPN:

Extended Sequence Numbers enable: N

Traffic Flow Confidentiality enable: N

Transmitting entity: Responder

Path MTU: 1424

Tunnel:

local address: 120.86.184.129

remote address: 183.47.54.218

Flow:

sour addr: 192.168.12.0/255.255.255.0 port: 0 protocol: ip

dest addr: 192.168.217.0/255.255.255.0 port: 0 protocol: ip

[Inbound ESP SAs]

SPI: 4066521980 (0xf262337c)

Connection ID: 313532612614

Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256

SA duration (kilobytes/sec): 1843200/3600

SA remaining duration (kilobytes/sec): 1843200/3301

Max received sequence-number: 0

Anti-replay check enable: Y

Anti-replay window size: 64

UDP encapsulation used for NAT traversal: N

Status: Active

[Outbound ESP SAs]

SPI: 1421458572 (0x54b9bc8c)

Connection ID: 1404454305800

Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256

SA duration (kilobytes/sec): 1843200/3600

SA remaining duration (kilobytes/sec): 1843200/3301

Max sent sequence-number: 0

UDP encapsulation used for NAT traversal: N

Status: Active

第三步：通过spi查看tunn-id

<FW>display ipsec tunnel brief 一个ipsec sa 一个tun-id编号

----------------------------------------------------------------------------

Tunn-id Src Address Dst Address Inbound SPI Outbound SPI Status

----------------------------------------------------------------------------

0 120.86.184.129 183.47.54.218 4169742112 584202424 Active

1 120.86.184.129 183.47.54.218 4066521980 1421458572 Active

2 120.86.184.129 183.47.54.218 3494636767 442940909 Active

第四步：通过tunnel id查看对应sa的统计信息

<FW>display ipsec statistics 默认是tunnel 0

IPsec packet statistics:

Received/sent packets: 0/265

Received/sent bytes: 0/25440

Received/sent packet rate: 0/1 packets/sec

Received/sent byte rate: 0/58 bytes/sec

Dropped packets (received/sent): 0/0

Dropped packets statistics

No available SA: 0

Wrong SA: 0

Invalid length: 0

Authentication failure: 0

Encapsulation failure: 0

Decapsulation failure: 0

Replayed packets: 0

ACL check failure: 0

MTU check failure: 0

Loopback limit exceeded: 0

Crypto speed limit exceeded: 0

<FW>display ipsec statistics tunnel-id 0

IPsec packet statistics:

Received/sent packets: 0/265

Received/sent bytes: 0/25824

Received/sent packet rate: 0/1 packets/sec

Received/sent byte rate: 0/58 bytes/sec

Dropped packets (received/sent): 0/0

Dropped packets statistics

No available SA: 0

Wrong SA: 0

Invalid length: 0

Authentication failure: 0

Encapsulation failure: 0

Decapsulation failure: 0

Replayed packets: 0

ACL check failure: 0

MTU check failure: 0

Loopback limit exceeded: 0

Crypto speed limit exceeded: 0

<FW>

<FW>display ipsec statistics tunnel-id 1

IPsec packet statistics:

Received/sent packets: 0/0

Received/sent bytes: 0/0

Received/sent packet rate: 0/0 packets/sec

Received/sent byte rate: 0/0 bytes/sec

Dropped packets (received/sent): 0/0

Dropped packets statistics

No available SA: 0

Wrong SA: 0

Invalid length: 0

Authentication failure: 0

Encapsulation failure: 0

Decapsulation failure: 0

Replayed packets: 0

ACL check failure: 0

MTU check failure: 0

Loopback limit exceeded: 0

Crypto speed limit exceeded: 0

<FW>

<FW>display ipsec statistics tunnel-id 2

IPsec packet statistics:

Received/sent packets: 0/0

Received/sent bytes: 0/0

Received/sent packet rate: 0/0 packets/sec

Received/sent byte rate: 0/0 bytes/sec

Dropped packets (received/sent): 0/0

Dropped packets statistics

No available SA: 0

Wrong SA: 0

Invalid length: 0

Authentication failure: 0

Encapsulation failure: 0

Decapsulation failure: 0

Replayed packets: 0

ACL check failure: 0

MTU check failure: 0

Loopback limit exceeded: 0

Crypto speed limit exceeded: 0

编辑评论

侵犯我的权益 >

对根叔知了社区有害的内容 >

辱骂、歧视、挑衅等（不友善）

侵犯我的权益

泄露了我的隐私 >

侵犯了我企业的权益 >

抄袭了我的内容 >

诽谤我 >

辱骂、歧视、挑衅等（不友善）

骚扰我

泄露了我的隐私

您好，当您发现根叔知了上有泄漏您隐私的内容时，您可以向根叔知了进行举报。请您把以下内容通过邮件发送到pub.zhiliao@h3c.com 邮箱，我们会尽快处理。

1. 您认为哪些内容泄露了您的隐私？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
2. 您是谁？（身份证明材料，可以是身份证或护照等证件）

侵犯了我企业的权益

您好，当您发现根叔知了上有关于您企业的造谣与诽谤、商业侵权等内容时，您可以向根叔知了进行举报。请您把以下内容通过邮件发送到 pub.zhiliao@h3c.com 邮箱，我们会在审核后尽快给您答复。

1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
3. 是哪家企业？（营业执照，单位登记证明等证件）
4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）

我们认为知名企业应该坦然接受公众讨论，对于答案中不准确的部分，我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

抄袭了我的内容

原文链接或出处

诽谤我

您好，当您发现根叔知了上有诽谤您的内容时，您可以向根叔知了进行举报。请您把以下内容通过邮件发送到pub.zhiliao@h3c.com 邮箱，我们会尽快处理。

1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
2. 您是谁？（身份证明材料，可以是身份证或护照等证件）

我们认为知名企业应该坦然接受公众讨论，对于答案中不准确的部分，我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

对根叔知了社区有害的内容

垃圾广告信息

色情、暴力、血腥等违反法律法规的内容

政治敏感

不规范转载 >

辱骂、歧视、挑衅等（不友善）

骚扰我

诱导投票

不规范转载

举报说明

✖

案例意见反馈

➤

网站相关: 关于我们; 服务条款; 隐私政策; 帮助中心; 经验与权限; 积分规则

联系我们: 联系我们; 建议反馈

常用链接: 标杆的神器下载

关注我们: H3C官网; 新华三服务公众号; 安仔远程运维服务; 新华三商城

内容许可: 除特别说明外，用户内容均可采用知识共享署名-相同方式共享3.0中国大陆许可协议进行许可

本图标版权归新华三集团所有，仅限本社区使用，切勿用做商业目的，违者必究

浙ICP备09064986号-1 浙公网安备 33010802004416号

✖

亲~登录后才可以操作哦!

确定

✖

亲~检测到您登陆的账号未在http://hclhub.h3c.com进行注册

注册后可访问此模块

跳转hclhub

✖

你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作

✖

产品线		搜索取消
案例类型
发布者
是否解决
是否官方
时间
搜索引擎
匹配模式	默认策略匹配全词匹配整句

某局点 msr3600 ipsec视频丢包

组网及说明

告警信息

问题描述

过程分析

解决方法

编辑评论

提出建议