问题描述
现场两个防火墙模块插在两台SR8804X上，做的IRF加冗余组，从8560p40升级至 9660p51，发现模块直连PING路由器有丢包
让现场写ACLweb页面抓包，然后ping测试
测试Ping34个包，命令行上显示有丢包，但是抓包文件里34个包有发有收
在防火墙上debug ip packet和aspf，发现只有IPFW_PACKET，没有aspf的debug回显
查看驱动丢包和单核cpu使用情况：
dis process cpu slot 1 | in kdr
486 0.0% 0.0% 0.0% [kdrvBoardTsk0]
487 0.0% 0.0% 0.0% [kdrvdp0]
488 0.0% 0.0% 0.0% [kdrvdp1]
489 0.0% 0.0% 0.0% [kdrvdp2]
490 0.0% 0.0% 0.0% [kdrvdp3]
491 0.0% 0.0% 0.0% [kdrvdp4]
492 0.0% 0.0% 0.0% [kdrvdp5]
493 0.0% 0.0% 0.0% [kdrvdp6]
494 0.0% 0.0% 0.0% [kdrvdp7]
495 0.0% 0.0% 0.0% [kdrvdp8]
496 0.0% 0.0% 0.0% [kdrvdp9]
497 0.0% 0.0% 0.0% [kdrvdp10]
498 0.0% 0.0% 0.0% [kdrvdp11]
499 0.0% 0.0% 0.0% [kdrvdp12]
500 0.0% 0.0% 0.0% [kdrvdp13]
501 0.0% 0.0% 0.0% [kdrvdp14]
502 0.0% 0.0% 0.0% [kdrvdp15]
503 0.0% 0.0% 0.0% [kdrvdp16]
504 0.0% 0.0% 0.0% [kdrvdp17]
505 0.0% 0.0% 0.0% [kdrvdp18]
506 0.0% 0.0% 0.0% [kdrvdp19]
507 0.0% 0.0% 0.0% [kdrvdp20]
508 0.0% 0.0% 0.0% [kdrvdp21]
509 0.0% 0.0% 0.0% [kdrvdp22]
510 0.0% 0.0% 0.0% [kdrvdp23]
511 0.0% 0.0% 0.0% [kdrvdp24]
512 0.0% 0.0% 0.0% [kdrvdp25]
513 0.0% 0.0% 0.0% [kdrvdp26]
514 0.0% 0.0% 0.0% [kdrvdp27]
515 0.0% 0.0% 0.0% [kdrvdp28]
516 0.0% 0.0% 0.0% [kdrvdp29]
517 0.0% 0.0% 0.0% [kdrvdp30]
518 0.0% 0.0% 0.0% [kdrvdp31]
519 0.0% 0.0% 0.0% [kdrvdp32]
520 0.0% 0.0% 0.0% [kdrvdp33]
521 0.0% 0.0% 0.0% [kdrvdp34]
522 0.0% 0.0% 0.0% [kdrvdp35]
523 0.0% 0.0% 0.0% [kdrvdp36]
524 0.0% 0.0% 0.0% [kdrvdp37]
525 0.0% 0.0% 0.0% [kdrvdp38]
526 0.0% 0.0% 0.0% [kdrvdp39]
527 0.0% 0.0% 0.0% [kdrvdp40]
528 0.0% 0.0% 0.0% [kdrvdp41]
529 0.0% 0.0% 0.0% [kdrvdp42]
530 0.0% 0.0% 0.0% [kdrvdp43]
531 0.0% 0.0% 0.0% [kdrvdp44]
532 0.0% 0.0% 0.0% [kdrvdp45]
533 0.0% 0.0% 0.0% [kdrvdp46]
534 0.0% 0.0% 0.0% [kdrvdp47]
535 0.0% 0.0% 0.0% [kdrvDataSync0]
542 0.0% 0.0% 0.0% [kdrvtxtemp0]
544 0.0% 0.0% 0.0% [kdrvlink0]
现场主备倒换和重启测试，问题依旧
在路由器侧ping防火墙，同时抓包和debug，发现防火墙少回了几个包
现场回退版本后就没有问题
过程分析
升级版本后ping丢包是因为copp限速导致，P51版本合入了copp限速功能，但是因为限速控制存在优化差异导致现场出现copp限速丢包，可以在升级版本后开启一个traffic qos策略。
Traffic class test
if-match control-plane protocol arp icmp http
Traff behave test
Packet-rate 10000(pps)
Qos policy test
Class test behavior test
Control-plane slot 1
Qos apply policy test inbound
也可以等一下后面的100分支版本再进行升级
解决方法
可以在升级版本后开启一个traffic qos策略。
Traffic class test
if-match control-plane protocol arp icmp http
Traff behave test
Packet-rate 10000(pps)
Qos policy test
Class test behavior test
Control-plane slot 1
Qos apply policy test inbound
也可以等一下后面的100分支版本再进行升级