|
In order to see how OSPF packets flow with functions or features in FortiGate unit. Execute the following commands for further troubleshoot.
On CLI :
# diagnose debug reset
# diagnose debug disable
# diagnose debug flow filter clear
# diagnose debug flow trace stop
# diagnose debug flow filter proto 89
# diagnose debug flow show function-name enable
# diagnose debug flow trace start 454545
# diagnose debug flow show iprope enable
# diagnose debug console timestamp enable
# diagnose debug enable
To stop debugging:
# diagnose debug disable
# diagnose debug reset
# diagnose debug flow filter clear
# diagnose debug flow trace stop
Note:
- The command 'diagnose debug flow show function-name enable' allows to show the function name.
- The command 'diagnose debug flow show iprope enable' allows to show trace messages about iprobe.
Example:
# diagnose debug reset
# diagnose debug disable
# diagnose debug flow filter clear
# diagnose debug flow trace stop
# diagnose debug flow filter proto 89
# diagnose debug flow show function-name enable
# diagnose debug flow trace start 454545
# diagnose debug flow show iprope enable
# diagnose debug console timestamp enable
# diagnose debug enable
2022-07-17 16:53:28 id=20085 trace_id=106351 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=89, 136.136.136.155:0->224.0.0.5:0) tun_id=10.165.1.249 from IPSec36. "
2022-07-17 16:53:28 id=20085 trace_id=106351 func=resolve_ip_tuple_fast line=5910 msg="Find an existing session, id-4c4cedd8, original direction"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=iprope_access_proxy_check line=435 msg="in-[IPSec36], out-[], skb_flags-02000108, vid-20"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check line=2277 msg="gnum-100017, check-ffffffffa002b990"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=iprope_policy_group_check line=4728 msg="after check: ret-no-match, act-accept, flag-00000000, flag2-00000000"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=iprope_in_check line=468 msg="in-[IPSec36], out-[], skb_flags-02000108, vid-20"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check line=2277 msg="gnum-100011, check-ffffffffa002cb5d"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=iprope_policy_group_check line=4728 msg="after check: ret-no-match, act-drop, flag-00000000, flag2-00000000"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check line=2277 msg="gnum-100001, check-ffffffffa002b990"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=iprope_policy_group_check line=4728 msg="after check: ret-no-match, act-accept, flag-00000000, flag2-00000000"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check line=2277 msg="gnum-10000e, check-ffffffffa002b990"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check_one_policy line=2029 msg="checked gnum-10000e policy-4294967295, ret-no-match, act-accept"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check_one_policy line=2029 msg="checked gnum-10000e policy-4294967295, ret-no-match, act-accept"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check_one_policy line=2029 msg="checked gnum-10000e policy-4294967295, ret-no-match, act-accept"
2022-07-17 16:53:28 id=20085 trace_id=106351 func=__iprope_check_one_policy line=2029 msg="checked gnum-10000e policy-4294967295, ret-matched, act-accept"
2022-07-17 16:53:29 id=20085 trace_id=106351 func=__iprope_check_one_policy line=2247 msg="policy-4294967295 is matched, act-accept"
2022-07-17 16:53:29 id=20085 trace_id=106351 func=__iprope_check line=2294 msg="gnum-10000e check result: ret-matched, act-accept, flag-00000000, flag2-00000000"
2022-07-17 16:53:29 id=20085 trace_id=106351 func=iprope_policy_group_check line=4728 msg="after check: ret-matched, act-accept, flag-00000000, flag2-00000000"
2022-07-17 16:53:29 id=20085 trace_id=106352 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=89, 136.136.136.24:0->224.0.0.5:0) tun_id=0.0.0.0 from local. "
2022-07-17 16:53:29 id=20085 trace_id=106352 func=resolve_ip_tuple_fast line=5910 msg="Find an existing session, id-0000005b, original direction"
2022-07-17 16:53:29 id=20085 trace_id=106352 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface IPSec36, tun_id=0.0.0.0"
2022-07-17 16:53:29 id=20085 trace_id=106352 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel IPSec36"
2022-07-17 16:53:29 id=20085 trace_id=106352 func=esp_output4 line=868 msg="IPsec encrypt/auth"
2022-07-17 16:53:29 id=20085 trace_id=106352 func=ipsec_output_finish line=544 msg="send to 10.165.1.249 via intf-port4"
|
