CGN运维综述-VSUF-培训文档之三.ppt

1、Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.CGN运维综述第1页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page2目目 录录l CGN故障处理故障处理故障处理流程故障处理流程典型故障场景典型故障场景常用维护手段常用维护手段l CGN常见问题常见问题FAQ第2页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.l CGN业务采用多核

2、业务板VSUF实现，该单板为无出接口的单板。l 业务流程：接口板把流量引入到业务板，业务板负责CGN的处理，完成后再交给接口板发出。Page3SFULPU1LPU2VSUF(CGN)123567CGN业务流程简介第3页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page4NATNAT故障处理流程故障处理流程定位思路定位思路正向：报文在接口板通过ACL(分布式为UCL)引流，根据匹配的规则将流量引入到业务板；首包在业务板上建立会话表，然后与后续包一样，匹配会话表，做NAT转换，然后根据目的IP查fib发

3、送到下行接口板；下行接口板根据转发帧头直接将报文转发。反向：报文到达接口板后，在接口板根据目的IP查询fib将报文转发到业务板；在业务板上匹配会话表，并作NAT转换，然后根据私网IP查fib转发到出接口板；接口板根据转发帧头将报文转发出去。当出现问题时，可以根据转发流程逐步缩小定位范围，确认问题出在业务板或者接口板，在根据各个单板的查询命令来确认故障。第4页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page5 NATNAT故障处理流程故障处理流程Page5第5页，共44页。Copyright 200

4、9 Huawei Technologies Co.,Ltd.All rights reserved.Page6 NATNAT故障处理流程故障处理流程Page6步骤一：报文是否到达业务板TM，并且从TM发送出去 报文从接口板进入业务板，首先到达TM。如果TM没有进入的报文计数，说明报文没有进入业务板。查询命令，进入诊断试图：display tm 7 0 received-packets TM 收到的报文计数 /7号单板为业务板 display tm 7 0 transmitted-packets TM 发送报文计数步骤二：报文是否到达CPU 报文从TM进入CPU，如果是首包，会先建立会话表，然后

5、根据会话表做NAT转换，然后根据目的IP查询FIB进行报转发。后续报文直接查询会话表，如果匹配会话表的话进行NAT转换，然后根据目的IP查询FIB进行转发。确认报文是否到达CPU，查询命令：display nat statistics received slot 7 engine 0步骤三：在CPU上是否建立用户表 分布式场景用户上线的时候就会创建用户表。查询CPU上是否创建用户表，查询命令：display nat user-information 第6页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.P

6、age7 NATNAT故障处理流程故障处理流程Page7步骤四：在CPU上是否建立会话表首包创建会话表，后续包直接查询会话表，然后进行nat转换。三元组模式会话表的目的IP和端口无法看到，五元组模式可以查看到目的IP和端口。会话表查询命令：display nat session table slot 7 engine 0 查询cpu上的所有会话信息 display nat session table slot 7 engine 0 verberse 查询会话表向信息 步骤五：报文是否从CPU发送出去查询命令：display nat statistics transmitted slot 7 e

7、ngine 0如果报文没有从CPU发送出去，可能是因为某种原因丢包：查询命令：display nat statistics discard slot 7 engine 0步骤六：报文是否到TM并且从TM发送出去报文做完nat转换之后，根据目的IP查询FIB，根据路由信息将报文转发到接口板。从CPU出来，首先进入TM，然后经过交换网板，进入接口板。确认报文进入TM和从TM转发出去的查询命令：display tm 7 0 received-packets TM 收到的报文计数 display tm 7 0 transmitted-packets TM 发送报文计数第7页，共44页。Copyrigh

8、t 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page8 NATNAT故障处理流程故障处理流程Page8从交换网板出来，首先到达业务板的TM。查看报文是否到达TM下行，通过命令行查看计数，多次查询看是否计数有增长R15-diagnosedisplay tm 7 0 received-packets TMI Rx Received Total 0 x00000000028b packets(0 x000000080ca4 bytes)(UC)收到的单播报文TMI Rx Received Total 0 x000000000516 p

9、ackets(MC)TMI Rx SP:0 COS:7 Received 0 x00000516 packets(0 x00102374 bytes)TMI Rx SP:63 COS:7 Received 0 x0000028b packets(0 x0000a2c0 bytes)TME Rx SB(6)Received 0 x00000002 packets(0 x00000458 bytes)TME Rx SB(7)Received 0 x00000003 packets(0 x00000684 bytes)查看报文是否从TM发送出去R15-diagnosedisplay tm 7 0 t

10、ransmitted-packets TMI Tx TB:24 COS:0 Transmit 0 x000000000001 packets(0 x0000000005dd bytes)TMI Tx Multicast COS:0 Transmit 0 x000000000002 packets(0 x000000000621 bytes)TME Tx TP:0 COS:7 Transmit 0 x00000005c924 packets(0 x000006dedac0 bytes)发送报文计数TME Tx TP:1 COS:0 Transmit 0 x000000000008 packets

11、(0 x000000000d3a bytes)TME Tx TP:65 COS:0 Transmit 0 x000000000006 packets(0 x000000000174 bytes)第8页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page9 NATNAT故障处理流程故障处理流程Page92.查看报文是否到达CPUcgn-diagnosedisplay nat statistics received slot 7 engine 0This operation will take a few

12、 minutes.Press Ctrl+C to break.Slot:7 Engine:0-Packets received from interface :390243177 CPU收到从TM过来的报文计数 Packets received from mainboard :4040 Packets received by nat entry :390242120 送到NAT模块处理的报文计数-3.查看是否在业务板上建立用户表先查到用户的Idcgndisplay access-user user-id 1 -User access index :1 State :Used User name

13、 :user#Domain name :yxma User backup state :No User access interface :GigabitEthernet2/1/0 User access PeVlan/CeVlan :-/-User access slot :2 User MAC :0030-0101-0101 User IP address :10.64.0.253 User gateway address :10.64.0.1第9页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Pa

14、ge10 NATNAT故障处理流程故障处理流程Page10业务板上的用户表信息cgn-diagnosedisplay NAT user-information user-id 1 slot 7 engine 0 This operation will take a few minutes.Press Ctrl+C to break.Slot:7 Engine:0Total number:1.-CPE IP :10.64.0.252 VPN Instance :-Public IP :13.13.13.109 Start Port :1024 Port Range :4096 Extend Po

15、rt Alloc Times :0 Extend Port Alloc Number :0 First/Second/Third Extend Port Start :0/0/0 Total/TCP/UDP/ICMP Session Limit :8192/10240/10240/512 Total/TCP/UDP/ICMP Session Current :1/0/1/0 Total/TCP/UDP/ICMP Port Limit :0/0/0/0 Total/TCP/UDP/ICMP Port Current :1/0/1/0 Nat ALG Enable :NULL -第10页，共44页

16、。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page11 NAT NAT故障处理流程故障处理流程Page11 4.查看业务板上的是否有会话表cgndisplay nat session table slot 7 engine 0 This operation will take a few minutes.Press Ctrl+C to break.Slot:7 Engine:0Current total sessions:1.udp:10.64.0.253:23413.13.13.163:1037-*:*实例

17、下配置了三元组会话表中目的地址和端口显示成*.*cgndisplay nat session table slot 7 engine 0 verbose This operation will take a few minutes.Press Ctrl+C to break.Slot:7 Engine:0Current total sessions:1.udp:10.64.0.253:23413.13.13.163:1037-*:*:*-13.13.13.163:103710.64.0.253:234 NAT Instance:yxma User-id:1 VPN:-Tag:0 x2,Fixe

18、dTag:0 x1,Status:hit,Create:2010-1-16 08:10:26,TTL:00:04:00,Left:00:04:00,Master AppProID:0 x0,CPEIP:10.64.0.253,FwdType:NATPTStatus:hit 表示有报文命中会话 Create:2010-1-16 08:10:26 会话表创建的时间TTL:00:04:00 会话老化时间 Left:00:04:00 剩余老化时间配置了五元组的情况，显示目的地址和端口。cgndisplay nat session table slot 7 engine 0This operation

19、will take a few minutes.Press Ctrl+C to break.Slot:7 Engine:0Current total sessions:1.udp:10.64.0.252:23413.13.13.109:1024-193.5.1.2:7777第11页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page12 NAT NAT故障处理流程故障处理流程Page125.查看报文是否从CPU发送出去cgndisplay nat statistics transmitted slot

20、 7 engine 0This operation will take a few minutes.Press Ctrl+C to break.Slot:7 Engine:0-Packets transmitted to interface :132 Packets transmitted to mainboard :132 session log packets transmitted :0 user log packets transmitted :0 Transparent packet with nat :29684258 做完nat发送出去的报文计数 Transparent pack

21、et without nat :0 没有做nat发送出去的报文计数-查看报文是否在CPU丢包cgn-diagnosedisplay nat statistics discard slot 7 engine 0This operation will take a few minutes.Press Ctrl+C to break.Slot:7 Engine:0-Fib miss discard :2190892444 没有路由导致丢包-第12页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page13 N

22、ATNAT故障处理流程故障处理流程Page136.报文从业务板cpu出来，首先到达TM，然后从TM到达交换网板.1)查看报文是否进入TMR15-diagnosedisplay tm 7 0 received-packets TMI Rx Received Total 0 x00000000028b packets(0 x000000080ca4 bytes)(UC)上行收到的单播报文TMI Rx Received Total 0 x000000000516 packets(MC)TMI Rx SP:0 COS:7 Received 0 x00000516 packets(0 x00102374

23、 bytes)TMI Rx SP:63 COS:7 Received 0 x0000028b packets(0 x0000a2c0 bytes)TME Rx SB(6)Received 0 x00000002 packets(0 x00000458 bytes)TME Rx SB(7)Received 0 x00000003 packets(0 x00000684 bytes)从CPU进入TM的报文2)查看报文是否从TM发送出去R15-diagnosedisplay tm 7 0 transmitted-packets TMI Tx TB:24 COS:0 Transmit 0 x00000

24、0000001 packets(0 x0000000005dd bytes)从TM发送到交换网板的报文TMI Tx Multicast COS:0 Transmit 0 x000000000002 packets(0 x000000000621 bytes)TME Tx TP:0 COS:7 Transmit 0 x00000005c924 packets(0 x000006dedac0 bytes)TME Tx TP:1 COS:0 Transmit 0 x000000000008 packets(0 x000000000d3a bytes)TME Tx TP:65 COS:0 Transm

25、it 0 x000000000006 packets(0 x000000000174 bytes)第13页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page14目目 录录l CGN故障处理故障处理故障处理流程故障处理流程典型故障场景典型故障场景常用维护手段常用维护手段l CGN常见问题常见问题FAQ第14页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page15License故障排查1 1）查看）查看lic

26、enselicense文件里是否有文件里是否有natnat资源资源,如果没有需要申请相关如果没有需要申请相关licenselicense1.查看是否给单板分配NAT 会话资源 display nat session-table size -TotalSize:96 M UsedSize :4 M FreeSize :92 M SlotID CpuID CurSessTblSize CfgSessTblSize ValidFlag 7 0(engine)4 M 4 M Valid （Valid表示有效，Invalid表示无效）-CurSessTblSize 目前有效的会话资源数 CfgSessT

27、blSize 命令行分配的会话资源数ValidFlag 表示此项配置是否有效 display licenseItem name Item type Value Description-LME0NATDS00 Resource 32 2M NAT Session /32 代表会话资源数，单位是2M，总的nat会话资源是64MLME0L2NAT01 Resource 32 L2NAT License for VSUF/32 代表可以使能l2nat特性的业务板的个数是32LME0DSLITE01 Resource 32 DS-Lite License for VSUF/32 代表可以使能dslite

28、特性的业务板个数是322）查看是否给单板分配资源第15页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.license故障排查Page16ds-lite场景下，需要查看单板是否使能ds-lite功能 display ds-lite vsuf status -VSUF LICENSE:TotalSize:32 UsedSize :2 FreeSize :30 SlotID CurState CfgState ValidFlag 1 1 （实际状态）1 （配置状态）Valid（是否有效）-3）如果单板没有分配

29、资源或者使能特性功能，则需要按照如下方法配置首先进入license试图：cgn-license active nat session-table size 2 slot 7 engine 0cgn-license active ds-lite vsuf slot 1cgn-license active ds-lite vsuf slot 6第16页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page17Page17 查看实例相关配置是否正确实例配置排查可能出现的错误：1）没有配置nat outboun

30、d2）nat outbound中acl规则配置错误3）没有绑定service-instance-group实例配置举例nat instance nat444 id 100 /SPU2.0对应的实例必须配置ID service-instance-group nat444 /实例下绑定service-instance-group nat address-group nat444_1 group-id 0 /地址池必须配置group-id section 0 211.50.0.0 mask 24 nat address-group nat444_2 group-id 1 section 0 211.

31、50.100.1 211.50.100.1 nat outbound 2000 address-group nat444_1 /地址池绑定，必配项 nat outbound 2001 address-group nat444_2service-instance-group nat444 /service-instance-group下绑定service-location service-location 200service-location 200 /service-location下配置绑定单板cpu location slot 7 engine 0第17页，共44页。Copyright

32、2009 Huawei Technologies Co.,Ltd.All rights reserved.Page18 会话表存在，流量不通 配置完NAT，会话表存在，但是流量不通。此故障可能有如下原因：1）报文在业务板CPU丢弃。通过如下命令观察迅速增值的丢包增长计数。cgn display nat statistics discard slot 7 engine 0 2）上行CR设备没有回程路由。在上行CR设备查询是否有指向CGN设备的路由。1）如果没有，查看是否将公网地址池地址的路由通过路由协议发布出去。2）如果在上行CR上查询到路由是指向另外一台设备，请与客户联系，确认此公网地址是否

33、在其他设备上使用。3）对于以下两种情况，需要做流量统计判断：（1）有会话，但是无法确认是否从网络侧接口发送出去 （2）上行CR有到CGN设备的回程路由，但是无法确认是否进入CGN设备。第18页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page19 会话表存在，流量不通流量统计配置举例：Acl number 3100 rule 0 permit ip source 100.11.1.2 0 destination 193.5.2.2 0 /匹配到网络侧正向流量 rule 10 permint ip s

34、ource 193.5.2.2 0 destination 100.11.1.2 0/匹配从网络侧反向流量Traffic classifier 3100 operator or if-match acl 3100 Traffic behavior 3100 /动作内容为空Traffic policy 3100 shar-mode statistics enable /使能流量统计功能 classifier 3100 behavior 3100Interface GigabitEthernet2/1/1 undo shutdown ip address 2.2.2.1 255.255.255.0

35、 traffic-policy 3100 outbound /匹配出方向的流量 traffic-policy 3100 inbound /匹配入方向的流量做流量统计的方法 配置traffic policy，traffic classify匹配用户报文（规则要尽量细化），traffic behaivor动作为默认动作（即permit），在traffic polioy下使能统计，将策略在上行出口outbound方向应用可以查看统计确定是否有报文发出，将策略在上行出口inbound方向应用可以查看统计计数判断是否存在网络侧回应流量。如：原ip 为11.64.0.253 用户访问目的IP：193.5.

36、2.2，分配的公网ip是100.11.1.2，有会话表。网络测接口为GE2/1/1。第19页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page20 会话表存在，流量不通cgndisplay traffic policy statistics interface GigabitEthernet 2/1/1 outbound verbose rule-based class 3100 Info:The statistics is shared because the policy is shared.I

37、nterface:GigabitEthernet2/1/1 Traffic policy outbound:3100slot 2:Traffic policy applied at 2010-01-17 07:33:16Statistics enabled at 2010-01-17 07:34:37Statistics last cleared:NeverRule number:4 IPv4,0 IPv6Current status:OK!Classifier:3100 operator or if-match ACL 3100 rule 0 permit ip source 100.11.

38、1.2 0 destination 193.5.2.2 0 0 bytes,300,888,788 packets 此处计数不断增长，说明有匹配此规则的报文 Last 30 seconds rate 385,606 pps,0 bps rule 10 permit ip source 193.5.2.2 0 destination 100.11.1.2 0 0 bytes,0 packets Last 30 seconds rate 0 pps,0 bps查看是否有流量从网络测接口发送出去，即outbound方向是否有报文匹配第20页，共44页。Copyright 2009 Huawei Te

39、chnologies Co.,Ltd.All rights reserved.Page21 会话表存在，流量不通cgndisplay traffic policy statistics interface GigabitEthernet 2/1/1 inbound verbose rule-based class 3100Info:The statistics is shared because the policy is shared.Interface:GigabitEthernet2/1/1 Traffic policy inbound:3100slot 2:Traffic policy

40、 applied at 2010-01-17 07:38:09Statistics enabled at 2010-01-17 07:38:09Statistics last cleared:NeverRule number:4 IPv4,0 IPv6Current status:OK!Classifier:3100 operator or if-match ACL 3100 rule 0 permit ip source 100.11.1.2 0 destination 193.5.2.2 0 0 bytes,0 packets Last 30 seconds rate 0 pps,0 bp

41、s rule 10 permit ip source 193.5.2.2 0 destination 100.11.1.2 0 0 bytes,0 packets 此处报文计数为0，且一直没有增长，说明没有匹配此规则的报文 Last 30 seconds rate 0 pps,0 bps网络侧没有报文进入，下一步继续在上行CR查看是否有地址100.11.1.2的路由，且此路由指向CGN设备。查看是否有流量从网络测接口进入me60，即inbound方向是否有报文匹配第21页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights re

42、served.Page22 会话表不存在，流量不通display nat statistics received slot 7 /参考之前的解释首先排查业务板cpu是否收到报文如果业务板cpu没有收到报文，可以进一步判断报文是否到达业务板，是否报文在业务板TM丢包。如果报文没有到达业务板，则排查上行接口板是否丢包，查看tm计数，确认报文是否发向目的业务板。1）确认业务板TM是否收到报文。参考前面的查询命令。2）确认接口板引流是否有问题。使能流量策略下的统计功能，查看cgn的流量统计是否有计数。若计数没有变化，说明没有匹配acl。检查配置是否有问题。如果配置没有问题，可能是引流问题，请联系华为研

43、发。如果cpu收到报文，进一步查看是否在业务板丢包display nat statistics discard slot 7 /查看业务板cpu丢弃报文统计第22页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page23 会话表不存在，流量不通cgndisplay traffic policy statistics ucl inbound verbose rule-based /基于ucl规则查询Traffic policy inbound:yxmb Error:The policy-based st

44、atistics is not supported on slot 1slot 2:Traffic policy applied at 2010-01-17 05:15:24Statistics enabled at 2010-01-17 05:17:26Statistics last cleared:NeverRule number:2 IPv4,0 IPv6Current status:OK!Classifier:yxmb operator or if-match ACL 6006 rule 0 permit ip source user-group yxmb nat444分布式用户上线匹

45、配用户组 1,240,182,827,420 bytes,4,133,942,763 packets 此处有计数且不断增长说明引流没有问题 Last 30 seconds rate 385,135 pps,924,324,248 bps如果没有计数匹配，需要进一步的检查引流的配置。查看CGN引流是否有问题第23页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page24 会话表不存在，流量不通R15display traffic policy statistics ucl inbound verbose

46、 classifier-based class yxmb/基于流分类查询 Error:The policy-based statistics is not supported on slot 1Traffic policy inbound:yxmbSlot 2:Traffic policy applied at 2010-01-17 05:15:24Statistics enabled at 2010-01-17 05:17:26Statistics last cleared:NeverRule number:2 IPv4,0 IPv6Current status:OK!Classifier:

47、yxmb Behavior:yxmbItem Packets Bytes-Matched 4,236,897,043 1,271,069,111,420 有计数并不断增长说明引流没有问题 +-Passed 4,236,897,043 1,271,069,111,420 +-Dropped 0 0 +-Filter 0 0 +-URPF 0 0 +-CAR 0 0Last 30 seconds rateItem pps bps-Matched 385,381 924,916,264 +-Passed 385,381 924,916,264 +-Dropped 0 0 +-Filter 0 0 +

48、-URPF 0 0 +-CAR 0 0查看CGN引流是否有问题第24页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page25目目 录录l CGN故障处理故障处理故障处理流程故障处理流程典型故障场景典型故障场景常用维护手段常用维护手段l CGN常见问题常见问题FAQ第25页，共44页。Copyright 2009 Huawei Technologies Co.,Ltd.All rights reserved.Page26 常用维护命令display license /查看license资源里是否有na

49、t资源display nat session-table size /查询给业务板分配的会话资源display nat session table /查询会话表display nat instance name /查询实例信息display nat session aging-time /查看会话老化时间display service-location /查看实例下配置的单板的主备状态（配置和实际）display nat user-information /查看业务板用户表信息display nat memory-usage /查看业务板内存中各个表项的使用率，包括会话、用户表等display

50、 nat address-usage instance hi address-group /查询某个实例地址池地址使用率isplay nat statistics alg /alg统计报文display nat statistics error /错误报文 display nat statistics global /全局统计报文 display nat statistics discard /丢包统计报文 display nat statistics received /业务板cpu收到的报文计数display nat statistics table /业务板会话统计display nat