利用使用者介面和 API 對閘道防火牆進行疑難排解。
使用
NSX Manager UI 和 API 檢查下列事項：
- 指定的閘道已啟用閘道防火牆。
- 查看指定閘道防火牆原則的實現狀態。UI 會在「防火牆原則」標頭右上方的旁邊顯示實現狀態。
- 查看規則統計資料，以確認是否有任何流量叫用了防火牆原則。
- 啟用規則的記錄，以對原則進行疑難排解。
閘道防火牆會在 NSX Edge 傳輸節點上實作。在下一個步驟中，請在 NSX Edge 節點命令提示字元上使用 nsxcli 命令，進行如下的資料路徑疑難排解。
取得已啟用防火牆之閘道的 UUID
EDGE-VM-A01> get logical-router Logical Router UUID VRF LR-ID Name Type Ports 736a80e3-23f6-5a2d-81d6-bbefb2786666 0 0 TUNNEL 4 8ccc0151-82bd-43d3-a2dd-6a31bf0cd29b 1 1 DR-DC-Tier-0-GW DISTRIBUTED_ROUTER_TIER0 5 5a914d04-305f-402e-9d59-e443482c0e15 2 1025 SR-DC-Tier-0-GW SERVICE_ROUTER_TIER0 7 495f69d7-c46e-4044-8b40-b053a86d157b 4 2050 SR-PROD-Tier-1 SERVICE_ROUTER_TIER1 5
使用 UUID 取得所有閘道介面
閘道防火牆會根據閘道的上行介面實作。請識別上行介面，並從以下輸出中取得介面識別碼。
dc02-nsx-edgevm-1> get logical-router 16f04a64-ef71-4c03-bb5c-253a61752222 interfaces
Wed Dec 16 2020 PST 17:24:13.134
Logical Router
UUID VRF LR-ID Name Type
16f04a64-ef71-4c03-bb5c-253a61752222 5 2059 SR-PROD-ZONE-GW SERVICE_ROUTER_TIER1
Interfaces (IPv6 DAD Status A-DAD_Success, F-DAD_Duplicate, T-DAD_Tentative, U-DAD_Unavailable)
Interface : 748d1f17-34d0-555e-8984-3ef9f9367a6c
Ifuid : 274
Mode : cpu
Port-type : cpu
Interface : 1bd7ef7f-4f3e-517a-adf0-846d7dff4e24
Ifuid : 275
Mode : blackhole
Port-type : blackhole
Interface : 2403a3a4-1bc8-4c9f-bfb0-c16c0b37680f
Ifuid : 300
Mode : loopback
Port-type : loopback
IP/Mask : 127.0.0.1/8;::1/128(NA)
Interface : 16cea0ab-c977-4ceb-b00f-3772436ad972 <<<<<<<<<< INTERFACE ID
Ifuid : 289
Name : DC-02-Tier0-A-DC-02-PROD-Tier-1-t1_lrp
Fwd-mode : IPV4_ONLY
Mode : lif
Port-type : uplink <<<<<<<<<< Port-type Uplink Interface
IP/Mask : 100.64.96.1/31;fe80::50:56ff:fe56:4455/64(NA);fc9f:aea3:1afb:d800::2/64(NA)
MAC : 02:50:56:56:44:55
VNI : 69633
Access-VLAN : untagged
LS port : be42fb2e-b10b-499e-a6a9-221da47a4bcc
Urpf-mode : NONE
DAD-mode : LOOSE
RA-mode : SLAAC_DNS_TRHOUGH_RA(M=0, O=0)
Admin : up
Op_state : up
MTU : 1500
arp_proxy :
取得 GW 介面上的閘道防火牆規則
使用介面識別碼取得在閘道介面上設定的防火牆規則。
dc02-nsx-edgevm-2> get firewall 16cea0ab-c977-4ceb-b00f-3772436ad972 ruleset rules
Wed Dec 16 2020 PST 17:43:53.047
DNAT rule count: 0
SNAT rule count: 0
Firewall rule count: 6
Rule ID : 5137
Rule : inout protocol tcp from any to any port {22, 443} accept with log
Rule ID : 3113
Rule : inout protocol icmp from any to any accept with log
Rule ID : 3113
Rule : inout protocol ipv6-icmp from any to any accept with log
Rule ID : 5136
Rule : inout protocol any from any to any accept with log
Rule ID : 1002
Rule : inout protocol any from any to any accept
Rule ID : 1002
Rule : inout protocol any stateless from any to any accept
dc02-nsx-edgevm-2>
檢查閘道防火牆同步狀態
閘道防火牆會同步 Edge 節點之間的流量狀態，以實現高可用性。閘道防火牆同步組態可使用以下輸出來顯示。
dc02-nsx-edgevm-1> get firewall 16cea0ab-c977-4ceb-b00f-3772436ad972 sync config Wed Dec 16 2020 PST 17:30:55.686 HA mode : secondary-active Firewall enabled : true Sync pending : false Bulk sync pending : true Last status: ok Failover mode : non-preemptive Local VTEP IP : 172.16.213.125 Peer VTEP IP : 172.16.213.123 Local context : 16f04a64-ef71-4c03-bb5c-253a61752222 Peer context : 16f04a64-ef71-4c03-bb5c-253a61752222 dc02-nsx-edgevm-1> dc02-nsx-edgevm-2> get firewall 16cea0ab-c977-4ceb-b00f-3772436ad972 sync config Wed Dec 16 2020 PST 17:47:43.683 HA mode : primary-passive Firewall enabled : true Sync pending : false Bulk sync pending : true Last status: ok Failover mode : non-preemptive Local VTEP IP : 172.16.213.123 Peer VTEP IP : 172.16.213.125 Local context : 16f04a64-ef71-4c03-bb5c-253a61752222 Peer context : 16f04a64-ef71-4c03-bb5c-253a61752222 dc02-nsx-edgevm-2>
檢查閘道防火牆的作用中流量
閘道防火牆的作用中流量可使用以下命令來顯示。流量狀態會在該閘道的作用中和待命 Edge 節點之間進行同步。以下範例顯示 Edge 節點 1 和 Edge 節點 2 的輸出。
dc02-nsx-edgevm-2> get firewall 16cea0ab-c977-4ceb-b00f-3772436ad972 connection Wed Dec 16 2020 PST 17:45:55.889 Connection count: 2 0x0000000330000598: 10.166.130.107:57113 -> 10.114.217.26:22 dir in protocol tcp state ESTABLISHED:ESTABLISHED fn 5137:0 0x04000003300058f1: 10.166.130.107 -> 10.114.217.26 dir in protocol icmp fn 5136:0 dc02-nsx-edgevm-2> dc02-nsx-edgevm-1> get firewall 16cea0ab-c977-4ceb-b00f-3772436ad972 connection Wed Dec 16 2020 PST 17:47:09.980 Connection count: 2 0x0000000330000598: 10.166.130.107:57113 -> 10.114.217.26:22 dir in protocol tcp state ESTABLISHED:ESTABLISHED fn 5137:0 0x04000003300058f1: 10.166.130.107 -> 10.114.217.26 dir in protocol icmp fn 3113:0 dc02-nsx-edgevm-1>
檢查閘道防火牆記錄
閘道防火牆記錄會提供閘道 VRF 和 GW 介面資訊，以及流量詳細資料。閘道防火牆記錄可從 Edge 存取，也可傳送至 Syslog 伺服器。防火牆記錄會提供邏輯路由器 VRF、防火牆介面識別碼、防火牆規則識別碼，以及流量詳細資料。
dc02-nsx-edgevm-1> get log-file syslog | find datapathd.firewallpkt <181>1 2020-08-04T21:18:25.633996+00:00 dc02-nsx-edgevm-1 NSX 26581 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <8 16cea0abc9774ceb:b00f3772436ad972> INET reason-match PASS 3061 OUT 48 TCP 10.114.217.26/33646->10.114.208.136/22 S <181>1 2020-08-04T21:18:41.182424+00:00 dc02-nsx-edgevm-1 NSX 26581 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <2 460b362ce1254ebd:98498057bc3b18df> INET TERM PASS 3053 IN TCP 10.166.56.254/60291->10.114.217.26/22 dc02-nsx-edgevm-1>
用來偵錯閘道防火牆的其他命令列選項
dc02-nsx-edgevm-2> get firewall 16cea0ab-c977-4ceb-b00f-3772436ad972
Possible alternatives:
get firewall <uuid> addrset name <string>
get firewall <uuid> addrset sets
get firewall <uuid> attrset name <string>
get firewall <uuid> attrset sets
get firewall <uuid> connection
get firewall <uuid> connection count
get firewall <uuid> connection raw
get firewall <uuid> connection state
get firewall <uuid> ike policy [<rule-id>]
get firewall <uuid> interface stats
get firewall <uuid> ruleset [type <rule-type>] rules [<ruleset-detail>]
get firewall <uuid> ruleset [type <rule-type>] stats
get firewall <uuid> sync config
get firewall <uuid> sync stats
get firewall <uuid> timeouts
get firewall [logical-switch <uuid>] interfaces
get firewall interfaces sync
dc02-nsx-edgevm-2>
