Paloalto下一代防火墻運(yùn)維手冊(cè)V

Paloalto 防火墻運(yùn)維手冊(cè)目錄TOC\o"1-5"\h\z\o"CurrentDocument"下一代防火墻產(chǎn)品簡(jiǎn)介 2\o"CurrentDocument"查看會(huì)話 4查看會(huì)話匯總 4查看sessionID 5條件選擇查看會(huì)話 6查看當(dāng)前并發(fā)會(huì)話數(shù) 6會(huì)話過多處理方法 7\o"CurrentDocument"去除會(huì)話 8\o"CurrentDocument"抓包和過濾 8\o"CurrentDocument"CPLW內(nèi)存查看 10治理平臺(tái)CPLW內(nèi)存查看 10數(shù)據(jù)平臺(tái)CPLW內(nèi)存查看 12全局利用率查看 12\o"CurrentDocument"Debug和Less調(diào)試 13治理平臺(tái)Debug/Less 13數(shù)據(jù)平臺(tái)Debug/Less 14其他Debug/Less 15\o"CurrentDocument"硬件異常查看及處理 16電源狀態(tài)查看 16風(fēng)扇狀態(tài)查看 17設(shè)備溫度查看 17\o"CurrentDocument"日志查看 18告警日志查看 18配置日志查看 18其他日志查看 19\o"CurrentDocument"雙機(jī)熱備異常處理 20\o"CurrentDocument"內(nèi)網(wǎng)用戶丟包排除方法 21聯(lián)通測(cè)試 21會(huì)話查詢 22接口丟包查詢 22抓包分析 23\o"CurrentDocument"VPIW障處理 23\o"CurrentDocument"版本升級(jí) 24Software升級(jí) 24Dynamic升級(jí) 25\o"CurrentDocument"恢復(fù)配置和口令 25配置恢復(fù) 25口令恢復(fù) 26\o"CurrentDocument"其他運(yùn)維命令 26規(guī)劃化配置命令 26系統(tǒng)重啟命令 27查看應(yīng)用狀態(tài)命令 27系統(tǒng)空間查看命令 28系統(tǒng)進(jìn)程查看命令 28系統(tǒng)根本信息查看命令 29ARP查看命令 29路由查看命令 30平安策略查看命令 30NAT策略查看命令 31系統(tǒng)效勞查看命令 31NAT命中查看命令 31UserlP-Mapping查看命令 32\o"CurrentDocument"其他故障處理 32硬件故障 32軟件故障 32接口狀態(tài)查看 32軟件故障 錯(cuò)誤！未定義書簽..下一代防火墻產(chǎn)品簡(jiǎn)介

Paloalto下一代防火墻〔NGFW〕是應(yīng)用層平安平臺(tái).解決了網(wǎng)絡(luò)復(fù)雜結(jié)構(gòu),具有強(qiáng)大的應(yīng)用識(shí)別、威脅防范、用戶識(shí)別限制、優(yōu)越的性能和高中低端設(shè)備選擇.AppJD Content-ID數(shù)據(jù)包處理流程圖:.查看會(huì)話可以通過查看會(huì)話是否創(chuàng)立以及會(huì)話詳細(xì)信息來確定報(bào)文是否正常通過防火墻,如果會(huì)話已經(jīng)建立,并且一直有后續(xù)報(bào)文命中刷新,根本可以排除防火墻的問題.查看會(huì)話匯總命令：showsessioninfo舉例：admin@PA-VM>showsessioninfoNumberofsessionssupported:Numberofactivesessions:NumbercfactiveTCPsessions:Numberofstriveudpsessions;Numberofactiveicmpsessions;Numbercfactiveecastsessnons：Numberofactivekcastsessions:Numberactivepredictsessions：Sessiontabieufi1nzafion：Numberofsessionscreatedwincebootup:packetrare::Throughput::Newconneccionestabl1shrate:skooooo00%.o-osP5bpcSessdontlntecuitTCPTCPTCPTCPLDPd^faultsessionsessionsessiondefaulttimeout:timeoutbeforesvn-ackreceived:timeoutbefore3-wayhandshaking:timeouttimeout:ICMPdefaulttimeout:otherrpdefaulxtimeout:captivePortalsessiontimeout:5000600113'手3'secssecssecssecssecssecssecssecs說明：通過以上命令可以查看到設(shè)備支持會(huì)話數(shù)的最大值,從而檢查是否有負(fù)載的情況發(fā)生.2.2.查看sessionID命令:showsessionidXX舉例:河津liT[①f-]BW,511?Wr-- '- ；I——一——「Sessiwi 12F200f1Ow! 一___source; I1-92_1 _1GO_?1[Llfirgt]d4：. |-9,■— 1pFOTO； hs-pert: 56SSO dport 2 AO>ifair? active typ^: flomtsreusqf： unknowndstu直01r: unknownflaw：source!dscsp.-oro:Spcrr3Stata:artusaridatuser;19^-7-5-7t72[LJ-unizrLisi-1III.<5L?B80 dporrt 7891ACTIVE fcypa; FLCMurikridwiiunknawm“3"iUi■一口Mt11周丹TQ11V#totalbvtECOUntc,c2sJ(at bytccountCeJc>1ayc-rTpaclkax二口licu?uNu?1ayec7 counc(3>2cjvsys通ppI1tat1onrtnesfljssisriito匕電loggedarecd5P53ioniir「pm北icnagprsqs.s"1Qirisyincaidfror?KApcair鼻dd「@gii/產(chǎn)口/ttFiftrifi1ationriat.-rmileiayer?pra€?S￡lnguirlTiltec1ngenabled手咂*與1onvlfl手味]老多sess1ontErnilnaTedonh.與psessiontraversescwnrHelcap'E-ivsipart:al5iassioniimg十七工占intcirfjeae-gre-33ir*ticrfacetiij1G'FiQU」rtui史02zEodzr■a節(jié)號(hào)615守方6二：.仁￡P(guān)narpol1cysTrue:TrueF>1sa;7口.「耳目+da-stination:H3tl9<](.wayalj:conpi?ii?d:false**】G更EFiaTSC;Fai3?:Fais.alathcarrotl/01e?therne-itl/'3：N/A<C1ass4)說明：從以上命令中可以看出到底是否存在非法流量,可以通過檢查源地址和目的地址端口等信息條件選擇查看會(huì)話命令：showsessionallfiltersource[ip]destination[ip]application[app]舉例：adii1rWpA-￡0MJ>shewsessionillflltQrsource192.Ltft,L(X)*71applicationsslIDApphcatiorStat?Typ#FlagSre[sporrj/Z&ne/Prata(tranalV5ys 05t[nport]/2orr(rran5lJitedTp[PortJ>14112fltsi ACTIVEFLgg 7ir5C5S6]/L3-Lru!?C/fi(1±3.92,L8S[217201)134[d43]^3-untriJ5t<?3.2J5. 13d[4^11])說明：可以檢查一些風(fēng)險(xiǎn)會(huì)話查看當(dāng)前并發(fā)會(huì)話數(shù)命令：showsessioninfo舉例：當(dāng)前并發(fā)會(huì)話13個(gè),而最大會(huì)話為262138,說明會(huì)話利用率并不高,最后一條紅色標(biāo)記為新建數(shù)值.sessionsessiontlraeonTCIPdefaulttimeout;TCPsessiontimeoutbetoreSYN-ACKreceived:TCP5t53iontimeciutbefore3-wayhandshaking：TCPsess1ontimeouxafterpin/rst：udpdefaultICMPdefiultTlqiEQU工；:timcoirt:otheripd^failttimeout:captivePortalsessiontimeout:Sp$<;1ontlnjiciiitindisesrdstsrC5GQc6口CQ1-533363secs3七匚%secs5CC3TrueSO%ofutilizaticniNumtjerofs?^1cr^5LiDrorted:zmaa"Numberofactivesessions:□ 1NumberoractiveTCPsessions:NumberofactivtLOFsessdons:Numberofactiveici^fsfissions:Numberofactivebcastsessions;Numberofacti\cMCASTsessians:dumberofactiveprecHcrsessions:sessiontabicutilization:MumbPrnffssif>n^crest*>risinepbootup:Packetrate；ThrouqhpuT:25SO73*i2J/a21kbpsNewLunrificlTunesLdbllilrrate:03zeesadminGPA-2O5O>showsessioninfotcp：90secs!UDF:60secs,other工pprotocolSti5iohdctelerdieddoing:AcceleratedagingtFrcchcld:scalingfatTor;一￡白卬"|"tupTCP-rtjtctnan-5YNfirstp&cktc: TroeHardwaresessionoffloading: TrueIPv6fir?w*l1ing; FalstAppl1canonrricklirgscanparameters：Timeouttodetermineapplicationtricklingi10seesiRpsnurr*1util57At5ointhresholdtnstsrtsrin?S￡>%5carscalinqfactoroverreqularaging; 名SeisiuhbehdviulwtitrireiuurLt11nil11r^dLhed;drwl說明：了解設(shè)備當(dāng)前并發(fā)會(huì)話情況會(huì)話過多處理方法命令：1、showsessionall〔檢查所有session〕2、showsessionidXX〔檢查該session是否不法流量〕說明：如果發(fā)現(xiàn)會(huì)話數(shù)大于設(shè)備可支撐的性能,需要根據(jù)以上步驟檢查和去除或者防御通過第一步發(fā)現(xiàn)占會(huì)話總數(shù)較多的ID,通過第二步檢查該ID是否存在不法app或者其他流量,通過Dos保護(hù)或者會(huì)話限制該IP數(shù)目〔如果確定是攻擊,可以通過平安策略屏蔽該IP地址訪問〕.

.去除會(huì)話命令：Clearsessionall舉例:可通過sessionid、源或目的IP、源或目的端口或去除所有會(huì)admiadmin&PA-w>clearapplicatiordesrlnailordescinatior-fortdestination-LSBrdos-rulefromhwf-interfacemin-kbnatnat-rulepbf-ruleprococolqos-classqas-ncde-ldqo5-rulErulesourcesojrce-portsource-userssl-decryptscacetDWpmvsys-name<￡nter>sessionallfilterAppHIcationrnameipaddressporterDoSprotect!anrulerarreFromzonehardwareinterfaceminimumkbatbytecountIfsessioni5NATNATrulenamePoliCy-Based-For^ardingrulenameipprotocalvalueQoSclassQoSnode-idvalueQgrulenameSecurityrulenametojrcpIPaddressSourceportsourceusersessionisdecryptedflowsiaieTozonefIOwtypevsys-naneFinishin口u匚說明：將會(huì)話去除..抓包和過濾在做debug/less或者抓包調(diào)試的時(shí)候,最好把PA白fastpath功能關(guān)掉,這樣可以更加完整的看到交互的數(shù)據(jù)報(bào)文,關(guān)閉命令為：SetdeviceconfigsettingsessionoffloadnoSetsessionoffloadno命令:1、創(chuàng)立過濾規(guī)那么：Debugdataplanepacket-diagsetfiltermatchsourcey.y.y.ydestinationx.x.x.x2、開啟過濾規(guī)那么：Debugdataplanepacket-diagsetfilteron3、配置抓包對(duì)象：Debugdetaplanepacket-diagsetcapturestagereceivefilex.pcap〔抓取來自接口接收的報(bào)文〕Debugdetaplanepacket-diagsetcapturestagetransmitfilex.pcap〔抓取地址轉(zhuǎn)換后的報(bào)文〕Debugdetaplanepacket-diagsetcapturestagefirewallfilex.pcap〔抓取經(jīng)過防火墻的報(bào)文〕4、全局抓包開關(guān)：Debugdetaplanepacket-diagsetcaptureon5、查看全局抓包配置：Debugdetaplanepacket-diagshowsetting6、關(guān)閉抓包Debugdetaplanepacket-diagsetcaptureoff7、去除所有抓包內(nèi)容Debugdetaplanepacket-diagclearall8、刪除文件Deletedebug-filterfilex.pcap舉例:admi debugdata.plarepacket-diagshowsett■Packetdiagnosissetting;Packetfi1terEnabled; yesMatchpre-parpacket:yesLoggingTOC\o"1-5"\h\zEn^blccl： noLog-throttle: no5ync-log-by-ticks: yesFeatures,counters;PacketcaptureEnabled； no5nAp1±n: 0說明：paloalto可以通過抓包的方式來分析故障情況..CPU和內(nèi)存查看治理平臺(tái)CPUffi內(nèi)存查看命令：showsystemresources舉例：

admiri^PA?05Q>srw)wSySTCnr蠟占o(jì)u『￡C5top0L:i9:*4up11day%.16:4^?1LiseirBloadaverage:0,00,0B02r0,05Tasks;94totala1running.fiJils<?plng4 .QzcHibia-dpuQs1)1 1.6%U5p 1.?KsyJ195.B%1dFCLO%wayO.Dffihl□.1%51,O.CH1^門上變一 _尹"8洌K"zil., JhBZ丁Zk+ 〞 縣11t I->**ap:上口口出)由1H?口工才1 used；ly^/izk cachedUSER.zoJOizUSER.zoJOiz?1C8I…IF741“0773012961Btb170717C81HR17.2QKI?0PIT20202D20?□202020207.202G?Q2020202D2070202020207口202020itRT03U60心皿1168060uooooaooooooooUOU0-000000OonoUQ8QOW6fr1onI4BBonN4712J5MRT1ME+COPMA^DGD.的TOp45.61python01.021niTCQ.OOIkthreadd□2.idnUgraTlcn/Doc.oniksofT1rqd/o01.92migrati-cn/100,01ksoftirqd/100.ICevents>0□C.04event5rlGO.02klNilp^r口.,QQaS^HC/B￡jr00.00syriLSupers00.00bdi-d<f*uiTcco,sskblockd/osmkblockd/loc.ooara/oCD.Mata/1□C.OCJ?a_auxoo.onkhubdCs0.OClkseriodoo.OGrpclod/c00.00rpcicd'l41.工口iks^apdc00i00aicj/O□o,口口ano/'iCD.00nfsliod00.03octtcn-ithtrntc0o,oo“steh_oCO.00oc.mtdbiockiriCD.CMusblh-idresumer46.46klourniald32.57flMSh-850QL.29ude,^d00.17ikjourridld00.01kiournald說明：通過以上命令可以查詢到數(shù)據(jù)平臺(tái)的 cpu使用情況和內(nèi)存使用情況.如發(fā)現(xiàn)CPU過高的情況,可以通過showsystemresourcesfollow 這個(gè)命令去檢查到底是哪項(xiàng)應(yīng)用有超負(fù)載行為：-1可以檢查哪個(gè)CPU?率高,默認(rèn)為合并-M可以檢查內(nèi)存使用率是否過高檢查異常應(yīng)用是否必要使用,否那么請(qǐng)關(guān)閉,如果不清楚需要開case分析問題.

]?*41〞照匐t1*?1W4?a&tcjNpiinqb.]?*41〞照匐t1*?1W4?a&tcjNpiinqb.I'D“conat211?收/鰭、>j’klkfe_AllHEiti^M1tliaMeii,IicruaTlQcac'rfFpM/EE,.i■?din.*Hrt*11wd鰭f舊.￡Tl5fAT-3pminn_rBnar1匕ERlIWZ7UIXDSh*275^55秘TH工31:4打1->^4山第工口：■nS2H>71.過〞巾BM514IZ15J-14J4LS??<5ftifl?71D3T1 t_rx^_sktu!sInf—JJKik/!le」iK」]_?.?i4_dr叩1-fwtlt.rrljasifa■KQUI1〞]"『Y/-.,印1 tit(平:■曠IM：[0r/"Mrfc^r」■Jriai-ijjuFt57M,9S￡'TiMnLU.Ec^'iAZ1l-W,_Dlir3Hipv^ra-se_jw-*jf：*HL|o*er「jrf 1p-T1141i乳帛litIl^Sir?i?“■11nfi?*31rra4Iff1*,I*"i1D■11nffi0溫,和函*.d『f4打瞥4HrJ!Hu1^611"Bdrsp,〞.■Jd>wdr-*dr加■Jdr-sp■JJr-tff0dr.才.和和Ljl|i*口jmic^matrmnq「M4dr*qdiup中亦一>1QE0rir-W-邛de?J1r^D4和』ENJ:4=1r::'器鑿"Ey"Mm案黑案器雷工需黑文,■??**手!p』<%:u卡f'T3rT+-F,-F?■JITFXUT^rT$rr十串學(xué)JrJiTFXpbrrrwmdirc*pkEgirLH.^wcvrcefp--r-r1■*??. .1Lir^cu'-rc小BMrvaa_ir-E??-I口**jIMM口rf]-+l￥?SC55iiXffn*T?fETMTCT由Wz中tir%ar-=T=TPPWM-修X?■=,,u!ni'*AM.,Ith=HfkKa■!lacn-id■dd.kK.Jr*plhALkIUS>n|MrfCH^Uhff?5C55l'Xe-lllKBTt4Sui-IsnsInifc!1I5?tead1-G<jir?dy gTIqcnee:福,ini^!!|l?1^nbFw&mEl-annac-irrejercnir?Eirjrwitt-idrarar+Jrsjdp*?4kMbB-MkHU尸注￡宜,心*K^Ki\F〞fEnaisn■KkKJiWkK-!*ih加=K：lcmFCXg■血Hic,=d￡k?u*?kKjFEE^KkaraWMU?MkKJ■ 門"l>1M4r-14?i""VurrwDpptf!M12Jl4tlf!MTC.Cinf1ij^r?Jit■印ped.Fn“7M■才事■中匕修?■外通Imtw?1曰"4恥金rn<Mvff-u^da配必(I」/知E/TEd曰?〞帖y型中片8?S^tup"0idfil'rwUnnfiw117PP-T^rlli3VTUP'牙UUMVIiwTIP1MXT1srrBKjlCII■I24■,I'■1'■"--Isr3hir卻k,drD|jpvd.口"即時(shí)日:才WE?**p*士事VUl；面干尸:Ta41Kdri-ncp^fl-*opp*d：尚率A#drzwkdf'-ftPEthC皿9C551V>BXIiEEii11HkniM〞nvrwiafarV■Nltluat*EF-iiAChfl-Ewofrw4emulf-〞Ti?HIB*〞,餐司**e?.Re氣丸■好rlI+1口力￥上「,ftprf-minH4frnvalsriZf'MF3*UiZ'a、]?d就工出—_ ijaiMiiichtt^cprerror*-T 尸網(wǎng)yEF4Fli#fir*BI3>斤?_k?：<■r-Kirmdm?■■,>>,?s ?wfr仲me蟲咒、曰叫F 數(shù)據(jù)平臺(tái)CPUffi內(nèi)存查看命令：showrunningresource-monitor舉例：admin&PA-2O5O>showrunningresource-nonitorResource(nan1ior1ngsamplingdata(persecond):t~PUloads^mpl"ingbygroup：f1ow_lookup0%Flow_fasrparh0%fluw_sluwpdLho招rlow_forwarding㈱rlnw_mgmr【定plow_ctr11%nac_resuift.髡Cluw_np0%dfa^recult魄moduleinternal0%aho_result0%zip_resuIt口為pkt1og_forwarddng0*pud0Mflow_host1%CPUloadcore0000Wi1CPUloadcore0000Wi111◎0

G說明：通過以上命令可以查詢到治理平臺(tái)的 cpu使用率,查看該CPU哪個(gè)應(yīng)用占用的程序比擬大,根據(jù)情況關(guān)閉相關(guān)應(yīng)用,例如flow_lookup是檢查會(huì)話是否存在進(jìn)程, flow_forwarding是transmit地址轉(zhuǎn)換進(jìn)程,如果不確定的情況下開case解決問題.全局利用率查看

命令:showcounterglobal舉例：Gdj箝<CMri(^S-Elapsedtinesiince143ts-wrpHing: seca^dsnuwracnuwracy-Agir_s*flT-fTw-NjsI-pkt-r-cvfTw_ho32kmjwlfl<3M_Fi<i3t_decap_errlafliui!!riqcnEII9g_^fc±_jdlag_jkjss>averityliflfoif*nfh>infQinfodropifffa14ifackckblmQg

J111a口

p--4*rtJpk沖DC-gKy01Tt工〞"Pi￡v&EfiHElSECripT1CN1pacLail￡r?c?1^dPiCi^S(KirtSfiUiedP-acketir?ei'--Td薩「mcontnjlir^ninitTccIIQtsrirollpH*?PAcketJd"Dp|]ed：dBCApMla￡lloneftcffrmcontrolplaneu-ifbarflf1tnard4MMT)a^xr1n4i(匕小)s-pardon)■?1tInq -di1□□說明：可以根據(jù)數(shù)據(jù)平臺(tái)和治理平臺(tái)綜合情況,去查看具體哪個(gè)應(yīng)用利用率超標(biāo),綜合判斷引起故障的要點(diǎn)..Debug和Less調(diào)試在PA的debug是為了獲取等多的排障詳細(xì)信息,這個(gè)命令相當(dāng)于show的命令,主要是查看治理平臺(tái)和數(shù)據(jù)平臺(tái)額外信息從而判斷問題的根本原因.Less為治理和數(shù)據(jù)平臺(tái)log日志的查看,比照起GUI使用CLI的less能看到更多的詳細(xì)數(shù)據(jù)交互信息,從而判斷問題的根本原因.治理平臺(tái)Debug/Less命令：lessmp-log/tailfollowyesmp-log舉例：adnadnrin@PA-VM>mp-1ogigwrt 用工門近.1ogJevsrv.1ogia-mcinitar.lo^.2tcymgr.1agnast#rd_ranag?r-apps?lognp-mnn-itor.Inn,?ifcanntrack?lofljari(■qnit-fir^tboot_1ogjamo.log.old'asmgr.1agdpp機(jī)b.log brdagerK,Togdhepa.lugehmon.log1ogrevr,logma5^erd_nanagcr-infr*.logmp-nonirnrlot;.?pancomm.0,logpan_task_l.logpanlogs-parri€1on.1ogreboot.logsslrgr.log到5dagEiriogcrasd.lo5drsprox/C.logha_agenr.1ogmjstcrd.locb.locmp-mnnirnr,1口￡pan_dha.logpan_ur1_covn'cpdtrc.locr^porT_gerr,1ocsslvpn*1eguseridd.loc說明：查看治理平臺(tái)日志信息可以通過輔助命令去實(shí)現(xiàn):tatailfollowyesmp-logauthd.log使用tail可以實(shí)時(shí)發(fā)現(xiàn)流量情況,例如該命令為查看治理平臺(tái)的認(rèn)證情況.ts11fpllotiyasrp-]a^aiuThE.laaHSy AuTZht,士臺(tái)f彳的1*^51 adfrlrtMaqrIEOB= ~rn^?ss_j|LrchFflSL|l,E(panairtW.c:X3￡￡}ipafvauEhdBiFac-?FEaarchr-asuIt：adnnnaurnrai-IeaiUch'adl<=匚嶼；工$二口J^HuAstr*coiv?dta51actasharM.,_<iufwy_\i3dirtn_^_pri3tTli_ittFiirMayLbO5:25-:D7Error:pari^au-rtid^urilecIf^LHiAr(pari_airt1ul_locaTdb.ti1s.c:994): rounlockusar<slwad.jij—yjE_ae^in<ptbH1a_H3^1A1:(17uavpidnnrie3ucFivn^e3￡4dLCr?: jj.wj/1605:25:07 parqer?^:p白11_「?1=口1_1|]|_11(95『^1張irti15,二！?二丁門：a >-&CLrrirc-lst -local hir s?fc -n -r cf5. aparamanal nod?M3^lA flV1_3UTnd_$flW3E*_^T*NVj.AUThd.C!90S)C￡ Lnacl1A-FJi1￡4PTBrIE05:2S:D7 jparqar小=Fnn1ruEuiLFpuT(.「廿rfrgirt113.l4=丁門:a >acLrr"lr^:ljst lafal tHr" i- -1" -r cfq. apdr3T"ianal nod*MqrIhQ5>:3I:O7 pstfL9udu_.xflrviicfl_r?4(pA^_Mhd.c：m")：*urM:g醍 事rcMPr?qw?cPay*L￡O5~2S:D7jparaLrhdnantdld3rcuip=rsq：,pirauThd.ci .口「ralfi；,adonirr-far[us-orurin數(shù)據(jù)平臺(tái)Debug/Less命令:debugdataplane舉例:adnrin@PA-VM>debugdatap1ane>flqw-controlEnable/Disableflowcontrol>fpgaDebugcontentfpga>internalDebugdaxaplaneinternalsraxe>memoryExaminedat^planememory>monixarDebugdataplanemonlcord^tai1>natnal>packet-diagPa匚kEt-「elatecldiagnosia>poolDebugbufferpool5>powDebugpacketschedulingengineaprocessDebugdataplaneproce^G>resetResetdataplanesettlngs>showShowdataplanerunningdata>task-hearrbeatDebugdataplanetaskheartbear>tasksal1pan_rasks>tepExamlnedataplanetepstare>testverifysystemsettingsvHthtestcases說明：使用debugdataplane可以查看數(shù)據(jù)平臺(tái)流量,例如內(nèi)存

的詳細(xì)使用情況等.其他Debug/Less命令：debugikeglobalondebug(查看VPNike信息)lessmp-logikemgr.log(查看VPNike日志信息)舉例:.ItillIFHJLP1-J'LJS'.JL--adm1.ItillIFHJLP1-J'LJS'.JL--adm1n&PA-2O5O>less2OT?06-302021-06-30201J-Ub-JJ-犯NCNL占-口BT.2021-05-3015MhM?s94:331QU4門3IQ：34：33ID：M：3510^?4：35■p-loa1ke?gr,lcg.ThFOj;mlh?c:347;wfnQ;startingpmlkvtPTDia2316訃fq];Niirks二科qpenmslqhx:etc/pfci/Us"IhFO];nairi.c:JbSzmint)readirgcorrtig?tc/'.'pHikemcr.corrtoesug]:iIiwif-c2&^:1Iff-corrfsck_c(ra1sttncy():rh^cklfbgconfiguraTlon'ihFO]:nain.c:46O:uirnQ:+*門+/++-+++++++^++++++++++++++++-++++++++++++：IMFOj|：IM-In,C：4fil：iMlnO：iketWEMOHST-MLTOH3rlJun3010:54:3520212021-OS-33JuriJunJunJWlJun3uri3unDumJunJurJUTijun3un3unJun10:34:371Q*：M：3710134：371Q：34：廠10:34:3?10:34:4210:34:4I210^34:4710:34:521.二襯〞210:34:571M川；5/10U1：57[INFOJ;nain.c;462;aaimO:++4++*+h++++tx+++卡**；++++++++4-+-++++?++++n-aitingtogitlutQomaittiidconfiguritImhiurninq:e~lcg?cal1backCpan_el.c：J1)sEl/beinqproxiedr_rgagen]t_get_1astcfg(pain_cfgagent.c:fi31J:Can'tfetchlistCMmltreidc*niflguiraiclart占隼:電Errorrpan_cfgag*nr_wr1ce_5ysd_boo1ean_5ync(pan_cfqarqenic.c:124):cfgjgGhtregisterf-ad10d1ntr^y1/5>sleepingfur3sec-ohds,B.Errcrrpini_cfgagtnv ii?_sdboo1 syrc(pincFgigarit.u;12巾】：cfgagertregisterfanTedintry2/3.s1eepingFor5seconds^?.error:pan_cfgagtn? 1re_sysd_boo1#an_syrc(panutfgagsnr.c?124):Error:panulastsyncsyrcsyricrfgaqi?ntrfiET晅尸faillpd1nrry3/^.Ell^ppirit;far寫寫用匚力足與一,Error:pan_jcfgagfem_wr1ce-sysd-boolearcsync(pan_cfgageme,c:i24):cfg^gem『的1打百 典1行iry勾工sleepingfor52sMe+一Error;口即_cf*gierit_^ritwan995yhetE^rucfgageritiC；；12,7；syncError：pan_C-fCH9HHHt_ErMiibletpaJi_cfga^erit.l: :tailedtcsynccdnf1gsilnicedatapllanernoclfyc5w,im()inT..rLtnrTine.■ocify芬runtime.ftMlfytsw.imgiTH：.runtlm*.Boctfycsw^gmT^riinifme.■1ogcal1buck(p.c:41):fclwt?irgproxltd,Pc;124);sync■edify<zsw^injnrt?ruintinieB

toregi5tercDrrfagentwitlhlarageniendijniTr^PA2Q50>ijil1runcwyesupi『g根明叫r*i制一ikewg：r!panike_daereonpbase1firri1515D6!39：36&B^0:3Oshe-dwithstarus1iktmgir：panike_ddeniGnptme2.tartedU：<0!3E>punUEcfg ？triqqpFEd,DB:dC;30panIKEcfqpH—— : 1parEKEcfqphase-2triggered*#iennotrecessarysskipped.ike?gir-jip3nlke_da^noripKase2finlshed2021-07-2712;5O：52flNFOTzpanikectebuq.lev?l_cbd-5Jul〞12^50:571fi?onL_requesi-puc￡aaemon./pan1ke_s-y5d_1fHc:655);15iiecopipe:d€tmg_1eBe*O?：40sJOHui2712:50:57TifM-n_r#^uejst_g*T(da*mapar1k#asysd_iif-c*871):16r#Adf>orpip**,nsgtyp#1Jul2/12:50:57pan.asgprocessCdientonp.anllte_sy5d1f,c：969)：regues-xfr5pip電：d?buglevel2021^07-2712iSO：[INFC]ipaindlks_sympl.e1200：partilkifi_idebiig_T1b(J!panilk<L.dHijg_iev<61_chS=>說明：查看VPNike交互過程,可以通過tailfollowyes的方式實(shí)時(shí)查看數(shù)據(jù)報(bào)文的交互.命令：debuglog-receiverstatistics 〔查看日志情況〕lessmp-loglessmp-loglogrcvr.log舉例：O/sec0/二比500S408admin?PA-2050>ckbuqlog-receiverstarO/sec0/二比500S408Logincomingrate:Logwritrenrate!corruptedpackets:corruptedurlpackets:Logsdiscarded +till):Trafficlogswritren:urllogswritten；Anti-virusTog與written:spywarelogswritren:Arracklogswritten:vulnerabilitylogswi^tT&n:Fi1eextlogswritren:urlcachemg殳outcount;URLcaeh&fullcount:urlcacheTraffic

Traffic

TrurlcacheTraffic

Traffic

Traffic

TraffickeyarmsarmsArmsarmsex-lsTcount:droppedcuedroppeddue

droppedduerototo5ysdwriteg1obalrateeachsourceLogForwardLogForwardcount:LogForv.arddnsc-ardeddiscardedLogForwardgeneratedcount:queuecount: 00queuefullsenderrorcount:

count:川?1修〞■"助事醍犯〞?logio?.vr.loftlunto1014-；3J = :==LCMRCVR5T>r(=======削ICIMMfyM-⑼;“醺打附：fSFlr49.IJ"id10Uii￡胖dM3k/h]：#SMbO：&T*■-I：1r-jUp,?]ua10：科：藕于在.S'r?nr：無方予i?,iQ1n木一0即六iie&tfg-MQ-K-iKMt5]un￡010：34：J7百砧Mcontainer彈酬c?ch4**ni門內(nèi)JunId103JJ."良M";pirt_l0irt*r_inlt.jociiKCpirLlofl.receivetf,csift421:lu/id3418Errorp?r-.lo^rc-rf_ir1t_tc<ie-rCpirvlofl_r-^ceiver.c51B<:3urt>&10： !//,■;方人】*￡寸_1面1il」叱“工耶人1咐_^^電忖〞/二1衽13：ju^￡0lGaM-r-UOErrcr:|3?iL-loflrair_lp1i_￡oci:ei<i]:an_"lcifl.j,#ce'h^er.c:1S4：21:HinNiXmi(rrer-mV「◎WC'JEJGOOer門Jun10-Jd.^2EP『k〞D5r_lOflTtvr_1r-1i_soctST<p?_10Q_fecei.C：18i21:〞巾aIk時(shí)7JrFT&f:巾"飛//『]『11^5用4箕口有下為/蝦可￥/<二口混？7!jyn$Q技Tdtfr&Tp^-_lDgrtvr_11T_tocH.et< ece?%-e^.C：18i!1"toid-34-45rrrw：ipf.Ioflrr<sr-lr-1T￡dc"t?5"qF'tc&iwe^.c：ifl4?)!JunJQ10:34Mifcrrwr:panLlofrtvr_1?1t_sccketfpiR_1og_recetver-1;1w11!Jun41G-M-r^?eftat:fi#VlofrcvrB1illT^scckeifpecefverdc-1a47>:7gOi.Ci.ldlMmftcarr^cTtlJ".D1110O30'IIIt-I.Pi1J.IIiLlili-311!can^ecTil?",0：l1-10(O0>拒口,riai-inc-jiryCfln^cr.0'lli-lCKOO)iHr^CT11?^.fl"JL!cnn^ecTtlJ-.o：|1-10030>fflfriSCTil?-.0IL10i："3flIcomect[ii\Q01-1HWO>carr^CT(l?7.0f4,'1W1railed-1〞r(shí).i [J牙,faileO'ierrno:T膈5mie?-?/rT『cr14百：中肅11Ml：?kFr4：14q1connectionrtfutdcofirwcTlocir?fi>-5.edca<wwcT1onrefusedC(medlarFMu陽(yáng)connecTlonrefusedCiKWCTlorinN工同connecTiomirefutedcoftnecTliirirHu4Mlcomect1onrefusedcneEonrefusalcomectE\0f0,1faHe<i"(srrKjr1.14)io?WCAlijnfTu鼻說明：說明：可以通過該命令來檢查日志工作情況7.硬件異常查看及處理電源狀態(tài)查看命令：showsystemenvironmentalspower舉例：admln<nPAadmln<nPA-500>5howsystemenvironmentalspower!—Pow@r————51otDescription50 1.05vPowerRailpowerPowerpowerPowerPowerPower111

mm

aaaaaa

RRRRRRAlarm

False

FalseRTCBaXXeryFalseFalseFalseFalseFalseFalsevolts1.041.091.201.BO2.493.344.912.49說明：當(dāng)Alarm列為True時(shí),表示電源狀態(tài)異常,此時(shí)需要檢查供電設(shè)施〔如機(jī)柜電源及電源插排〕是否正常供電,在確認(rèn)供電正常,防火墻電源仍然異常時(shí),可以生成診斷信息文件,提供應(yīng)PaloAlto廠商case處理,以確認(rèn)電源模塊是否故障或損壞.風(fēng)扇狀態(tài)查看命令：showsystemenvironmentalsfans舉例：ows-ysLemenvircnmentalstansSiSiarDescr\pnian寫0 ran#1op^rati□na'ISO Fan#2Operarianala1arm

Fais巨

FaiSeTrueTrue說明：當(dāng)Alarm為True時(shí),表示風(fēng)扇狀態(tài)異常.RPMs為False時(shí),表示風(fēng)扇不轉(zhuǎn).此時(shí)需到現(xiàn)場(chǎng)檢查設(shè)備風(fēng)扇是否轉(zhuǎn)動(dòng)〔用手放在風(fēng)扇后面,看是否能感受到風(fēng)〕.如果風(fēng)扇不轉(zhuǎn),那么需要對(duì)其進(jìn)行更換.設(shè)備溫度查看命令:

showsystemenvironmentalsthermal舉例：admin(apA-2O5O>showsystemenvironmentalsthermal Thermal DescriptionA.larm□egreescTemperatureat3&30[U85；False40.00T&mperatureatLION[u86False41.00TemperatureatPhy[US7]Faise40.00Temperatur電atCPLD[u88]Faise42.00ooooo15555s說明：當(dāng)Alarm為True時(shí),表示溫度狀態(tài)異常.異常時(shí)需要確定機(jī)房溫度是否過高,或者散熱系統(tǒng)是否受阻..日志查看告警日志查看命令：showlogalarm舉例：admiri&PA-vw>show+ack_admin+admin+csv-output+direction+dport+dst1agalarmack1agalarmack_adminadmincsu-outputdirectiondportdstend-time+opaque+qu^ry+rcceive_time+rule^roup+sport+src+start-time+time_acknowledged+vsys<Enter>opaquequeryreceivc_fimerulegroupsparesrcstart-fimerime_acknowledgedPipcthroughacommandFinishinput說明：告警可以根據(jù)屬性篩選如開始時(shí)間或者結(jié)束時(shí)間等等配置日志查看命令:

showlogconfig舉例：adm"in@PA-VW>show1ogcon^ig+clierrcclient+endemd+C5V-OLtpUT：CSV-iJUtput+direct5ordirection+end-Timeend-time+queryque「y+receiimereceive_time+resultresult+start-Tlmestart-Lim@1pipethroughacomrranci<Enrter>FinishinputadmirtJPA-vM>showloqconfigstart-time電qua】2006/08/01^10:00:00TiHOStconmandAdminclientRAKUltPQl^/flS/O7?l:^:OSO.O.0,0AdminCLTraadpei201B/05/0721:34:13Q.O.Q.0cowitadminCLIsubmitted2O13/0S/0722:0B:471Q3.16￡.12.2setadm-inu&bsucceeded2021/05/0722:11:151^.160,12.2setadminKWbSucceeded2021/05/0704.etadmin詞ghPai1ed2021/05/0722:13:13setadminwebFailed7011/(1S/0777rl3:?71Q2.?sprartninwpbFai1cd2021/05/0722:13:51192.16B,12.2setadninwebFailed2021/05/0722:15:lfl1Q2.16B.12.?setadm-iinw&bsucceeded2021/05/0722:16:24setadminwebSucceeded2021CV0800:55:41192.IBS.12.2setachtink*ehsucceeded2021/05/0800:58:36setadminwebsucceeded2021/05/0800:5E:iflig?+1SR.l?.2ptiirnwph^uccpetied2021/05/0SQL:LS:25editackninwebsucceeded2017/〞/0X0^:00:48192,158,12.2SE7adminl*'plhsucrepnpd2021/05/0822:16:41192.16S.12.2setadmin^'elbFml1ed2021/05/0822:50:07192.16&.12.2setachiinw曲succeeded2021/05/09OL：37i27secadminwebsucceeded2021/05/0901：37： 192.15隊(duì)132setadminwphsuccpeded2021/05/09QL：38：45setachiinwebsucceeded2021/(15/09□1:3^:20192,168,12.2SP7adminwplhSLicrpprpd2021/0V090298:2219^.168.12.2setadminwebsucceeded2021705/0902:09:12setadminwebsucceeded說明：可以通過條件選擇來篩選需要的配置日志信息其他日志查看命令:showlog舉例：adm-!rK?PA-vy>showlog>alarmShowalarm1ogs>appstaTshowappsrarlogs>conf-i55howconfiglogs>da-ilythsumShowdai1ythsum1ogs>danlytrsumShowdailytrsumlogs>data>hipmatch5howdana.1tjgsShewhipmatcnlogs>fiourlythsuinShowhourlyrhsum1ogs>hourlytrsun5howhourlytr5iini1ogs>systemShowsystem1ags>tnrcarshowthreat1ogs>thsumshow[Mumlogs>trafficShowtrafficlogs>trsumShowtrsum1ogs>url5howur1log、>uswidshowus?rid1ogs>weeklythstmshowweeklyrhsum1ogs>weeklytrstn5howweeklytrsum1ogs>wiIdf1F€showwi1dfire1og%說明：使用該命令可以查看到系統(tǒng)日志、流量日志、野火日志等.雙機(jī)熱備異常處理命令：showhigh-availabilitystate〔查詢防火墻HA雙機(jī)狀態(tài)〕showhigh-availabilityall〔查詢完整的HA信息〕showhigh-availabilitystate-synchronization〔詢HA同步信息〕requesthigh-availabilitystatesuspend〔手工切換防火墻HA狀態(tài),運(yùn)行此命令的防火墻將會(huì)從Active/Passive 狀態(tài)切換為暫停狀態(tài)〕requesthigh-availabilitystatefunctional〔手工恢復(fù)防火墻HA狀態(tài)〕舉例:PAN-A PAN-B說明：由于PaloAlto采用將治理平臺(tái)和數(shù)據(jù)轉(zhuǎn)發(fā)平臺(tái)別離的硬件結(jié)構(gòu),因此PaloAlto的HA同步方式也采用治理平臺(tái)和數(shù)據(jù)轉(zhuǎn)發(fā)平臺(tái)之間單獨(dú)同步.PaloAlto防火墻HA的狀態(tài)主要有如下四種：Initial一初始化狀態(tài),此狀態(tài)為防火墻在發(fā)現(xiàn)對(duì)等體并且進(jìn)行HA狀態(tài)協(xié)商前保持的狀態(tài),時(shí)間閥值為60秒.60秒過后,如果防火墻在未發(fā)現(xiàn)對(duì)等體時(shí),將會(huì)轉(zhuǎn)換為Active狀態(tài).Active一活潑狀態(tài),此狀態(tài)為的防火墻處理所有的業(yè)務(wù)流量Passive一被動(dòng)狀態(tài),此狀態(tài)為備份狀態(tài),備份主狀態(tài)防火墻所有業(yè)務(wù)流量Suspended一暫停狀態(tài),此狀態(tài)為防火墻治理員手工暫停Non-functional-錯(cuò)誤狀態(tài),主備防火墻都將可能出現(xiàn)此故障狀態(tài)當(dāng)防火墻發(fā)生故障時(shí)故障時(shí)可以根據(jù)狀態(tài)來判斷和使用命令.內(nèi)網(wǎng)用戶丟包排除方法聯(lián)通測(cè)試命令:pingsource<IP_addr_src_int>host<IP_addr_host>pinghost<IP>舉例：adnrin@PA-vW>pingsource152.16S.12.1hostPING<)from:56(B4)bytesofdata.64bytesfrom\ictttp_sec|=lttl=128 395m專64bytesfrom192,lfifl.12.2:icmp_seq-2ttl=128time-0.225msACadmin(apA-VM>pinghosx192.158,12.1PING192.ICS.12.1(192,168.12.1)5^(84)bytesofdata.64bytesfrom192.1^6,12,1：1cmp_seq=lttl=64tirne=O.L5Cms說明：指定源接口進(jìn)行ping測(cè)試,如果不通,可以ping自己,如果本機(jī)不通可能考慮端口協(xié)議沒有起來,可以調(diào)試端口協(xié)商模式,或者接口沒有接好,檢查網(wǎng)線(光纖)情況.會(huì)話查詢命令：showsessionall舉例：說明：可以參考上節(jié)會(huì)話命令判斷故障內(nèi)容, 查看是否在PA是否存在該會(huì)話信息.接口丟包查詢命令：showcounterglobal|matchdrop舉例：adnftdrWA-vN'>sh也刷counterglobalmatchdropflow_host_decap_err 26 Cdropflowadmin^PA-Wa說明：查詢?nèi)钟?jì)數(shù)器中中存在的Drop數(shù)據(jù)包,如果有丟包請(qǐng)查看是否由于平安策略引起.抓包分析命令：debugdataplanepacket-diagsetfilteron說明：請(qǐng)參考上節(jié)抓包和過濾分析..VPN故障處理命令：1、showvpnflow〔查看防火墻加解密狀態(tài)〕showvpngateway〔查看防火墻vpn酉己置〕3、showvpnike-sa〔查看防火墻第一階段IKESA狀態(tài)〕4、showvpnipsec-sa 〔查看防火墻第二階段IpsecSA狀態(tài)〕5、showvpntunnel〔查看防火墻tunnel酉己置〕6、lessmp-logikemgr.log 〔debug/less調(diào)試〕舉例：常見的VPN^障報(bào)錯(cuò)信息：HIssueInitiatorerrorRespondererror IWrongIP/noconnectionP1-TmeoutP1-TimeoutNomatchingP1ProposalP1-TimeoutNosuitableproposal(P1)MismatchedPeerIDP1-TimeoutPeeridentifierdoesnotmalefiNomatchingP2ProposalNoproposalchosenNosuitableproposal(P2)PFSGroupmismatchF2-TimeoutPfsgroupmismatchMismatchedProxyIDP2-Timeoutcannotfindmatchingphase-2tunnel說明:WronglP:在建立VPNM端的設(shè)備上面沒有使用正確的公網(wǎng)IP地址進(jìn)行VPN勺建立.NomatchingP1orP2Proposal:在建立VPNBf端的設(shè)備上面使用的加解密算法,數(shù)據(jù)完整性算法,Hash保持協(xié)議不匹配.MismatchedPeerID:在建立VPN兩端的設(shè)備上面使用的PeerID不匹配.PFSGroupmismatch:在建立VPNBf端的設(shè)備上面使用不同的DHgroups.MismatchedProxyID:在建立VPN兩端的設(shè)備上面使用的ProxyID不匹配〔通常發(fā)生在使用Policybased〕因此,在PaloAlto上面,可以通過一系列的查詢命令來進(jìn)行Vpn建立不成功的故障排查.版本升級(jí)12.1.Software升級(jí)命令：1、requestsystemsoftwarecheck 〔執(zhí)行版本檢查〕2、requestsystemsoftwaredownload 〔執(zhí)行軟件下載〕〔執(zhí)行系統(tǒng)軟件安裝〕3、requestsystemsoftwar〔執(zhí)行系統(tǒng)軟件安裝〕4、requestrestartsystem 〔執(zhí)行設(shè)備重啟〕舉例：adm'inCiPA-2O5O>requestsystemsoftwarecheckVersionSizeR.eleasedon[Xjwnlaaded5.0.6188MB2021/07/0817：1工：59no5.0.5188MB2021/05/2422：36：56no5.0.4188MB2021/04/0222;41;15no5.0-3188MB2021<O^/O821:27:01no5.0-2201~01/1515:40:2?no5.0-1168MB201Z12/0421：Z1：19no5.0.0270HB2021/11/0120;26;Z3noadmlr?PA-2O5O>requestsystemsoftwaredownloadversion2.1.531.53.0*13.0.101cl,62.1.7S.0.03,0.1J.0,10,門、說明：需要注意的是升級(jí)版本后需要重啟設(shè)備Dynamic升級(jí)命令：1、requestcontentupgradecheck2、requestcontentupgradedownload3、requestcontentupgradeinstall舉例:admlrequestcontentupgradecheckGetinformationfromPaloAltoNetworksserverdownloadocwnl0KdcorrcentpackagesinrFo ShownnFormationaboutavailableconten±packagesins工all installcontenrpackages說明：完成后不需要重啟即可生效.恢復(fù)配置和口令配置恢復(fù)命令：loadconfig

舉舉例:adm-int^PA-VN#+key>from>last-saved?partial>version1oadcanfigkeyFilenameListadm-int^PA-VN#+key>from>last-saved?partial>version說明：可以通過load命令恢復(fù)到last-save最近配置狀態(tài),或者from自定義配置狀態(tài)：gfrom