Distributed Firewall Flow Logging Troubleshooting, page 1. Distributed Firewall Flow Logging Troubleshooting

Transcription

1 This chapter contains the following sections: Flow Logging Troubleshooting, page 1 Flow Logging Troubleshooting You can use vemcmd commands to troubleshoot issues with flow logging. This section lists the commands and their functions and provides sample output. For general information about flow logging and how to configure it, see the section " Flow Logging" in the Cisco ACI Virtualization Guide. For scalability information, see the Verified Scalability Guide for Cisco ACI. vemcmd show dfw flows {all unreported} Displays all or unreported permit flows. The following example shows the output of the command vemcmd show dfw flows all: # vemcmd show dfw flows all For ltl ESTABLISHED For ltl ESTABLISHED For ltl V/D BUCK SIP DIP SP DP PRO TS EC SQ SQ-2 FG 1

2 vemcmd show dfw flows {all unreported} V V V V V ESTABLISHED- For ltl 52 V/D BUCK SIP DIP SP DP PRO TS EC SQ SQ-2 FG V V V V V ESTABLISHED- Number of Active Flows: 10 Number of Deleted Flows: 0 Number of Established Free Flows: 0 Number of Free Flows: 0 The following example shows the output of the command vemcmd show dfw flows unreported: # vemcmd show dfw flows unreported For ltl 8 ESTABLISHED- For ltl 50 ESTABLISHED- For ltl 51 V/D BUCK SIP DIP SP DP PRO TS EC SQ SQ-2 FG V V V V V ESTABLISHED- For ltl 52 V/D BUCK SIP DIP SP DP PRO TS EC SQ SQ-2 FG V V V V V ESTABLISHED- 2

3 vemcmd show dfwdenyflows {all ltl_number} Number of Active Flows: 10 Number of Deleted Flows: 0 Number of Established Free Flows: 0 Number of Free Flows: 0 vemcmd show dfwdenyflows {all ltl_number} Displays all DFW deny flows or DFW deny flows for a particular LTL. The following example shows the output of the command vemcmd show dfwdenyflows all: # vemcmd show dfwdenyflows all ltl Source IP Dest IP Source Port Dest Port Protocol Deny Reason Timestamp Vem Port TCP syn-ack ingress T06:30: UB4_sid.eth TCP syn-ack ingress T06:30: UB4_sid.eth0 The following example shows the output of the command vemcmd show dfwdenyflows 51 where 51 is the LTL number: # vemcmd show dfwdenyflows 51 ltl Vem Port Source IP Dest IP Source Port Dest Port Protocol Deny Reason Timestamp 51 UB4_sid.eth TCP syn-ack ingress T08:21: UB4_sid.eth TCP syn-ack ingress T08:21: UB4_sid.eth TCP syn-ack ingress T08:21: UB4_sid.eth TCP syn-ack ingress T08:21: UB4_sid.eth TCP syn-ack ingress T08:21: vemcmd show dfwgenflows {all udp tcp icmp} {all ltl} Displays all ICMP, UDP, or completed TCP flows or flows for a particular LTL. The following example shows the output of the command vemcmd show dfwgenflows all all: # vemcmd show dfwgenflows all all ltl Source IP Dest IP Source Port/Type Dest Port/Code Protocol Timestamp Direction Vem Port UDP T06:26: Egress ub3_clone.eth UDP T06:26: Ingress UB4_sid.eth ICMP T06:26: Egress UB4_sid.eth ICMP T06:26: Ingress ub3_clone.eth0 The following example shows the output of the command vemcmd show dfwgenflows upd all: # vemcmd show dfwgenflows udp all ltl Source IP Dest IP Source Port Dest Port Protocol Timestamp Direction Vem Port UDP T06:26: Egress ub3_clone.eth UDP T06:26: Ingress UB4_sid.eth0 The following example shows the output of the command vemcmd show dfwgenflows icmp all: # vemcmd show dfwgenflows icmp all ltl Source IP Dest IP Type Code Protocol Timestamp Direction Vem Port ICMP T06:27: Egress UB4_sid.eth ICMP T06:27: Ingress ub3_clone.eth0 3

4 vemcmd show dfwslflows {all <ltl>} The following example shows the output of the command vemcmd show dfwgenflows tcp all: # vemcmd show dfwgenflows tcp all ltl Source IP Dest IP Source Port Dest Port Protocol Timestamp Vem Port TCP T06:28: UB4_sid.eth TCP T06:28: ub3_clone.eth0 vemcmd show dfwslflows {all <ltl>} Displays all entries or entries for a particular LTL in the short-lived flows table. The following example shows the output of the command vemcmd show dfwslflows all: vemcmd show dfwslflows all ltl Source IP Dest IP Source Port Dest Port Protocol Timestamp Vem Port TCP T06:28: UB4_sid.eth TCP T06:28: ub3_clone.eth0 The following example shows the output of the command vemcmd show dfwslflows 51where 51 is the LTL number: # vemcmd show dfwslflows 51 ltl Source IP Dest IP Source Port Dest Port Protocol Timestamp Vem Port TCP T06:28: ub3_clone.eth0 vemcmd show dfw globals Displays and logging state, total number of deny flows, permit flows, and short lived flows, respectively. The following example shows the output of the command vemcmd show dfw globals: # vemcmd show dfw globals Show DFW GLobals DFW Feature Enable: ENABLED DFW Total Flows : 10 DFW Flows Allowed : DFW Current Time : DFW Logging Enable: ENABLED DFW Deny Logging Total Flows : 0 Max DFW Deny Logging flows : DFW Short Lived Total Flows : 0 Max DFW Short lived flows : 5000 vemcmd show dfw globals ltl ltl_number Displays global statistics for a specified interface. The following example shows the output of the command vemcmd show dfw globals ltl 51 where 51 is the LTL number: # vemcmd show dfw globals ltl 51 Show DFW Port: 51 GLobals DFW Feature Enable: ENABLED DFW Total Flows : 10 DFW Current Time : DFW Port Init : 1 DFW Port Flows : 5 DFW Free Flows : 0 4

5 vemcmd show dfw connection stats vemcmd show dfw connection stats Displays consolidated statistics per interface. The following example shows the output of the command vemcmd show dfw connection stats: # vemcmd show dfw connection stats LTL CREATED DELETED AGED DENIED_GBL DENIED_PORT DENIED_NO_MEM REPLACED UNALIGNED Total vemcmd show dfwflows ltl ltl_number Displays all permitted flows for a specified interface. The following example shows the output of the command vemcmd show dfwflows ltl 51 where 51 is the LTL number: # vemcmd show dfwflows ltl 51 Get DFWFLOW Table for ltl: 51 SIP DIP SP DP PRO State Age TCP ESTABLISHED TCP ESTABLISHED TCP ESTABLISHED TCP ESTABLISHED TCP ESTABLISHED 0 Number of Flows: 5 vemcmd dpa show dfwlog config Displays configuration information received from APIC to assist with verification of the logging server configuration. The following example shows the output of the command vemcmd dpa show dfwlog config: # vemcmd dpa show dfwlog config =>dpa command is: show dfwlog config DFW-Log Config: DFW Log Enable: enabled DFW Deny Logging Enable: enabled DFW Permit Logging Enable: enabled Reporting Interval: 300 sec Syslog Severity: information (6) Syslog Srvr 1: Enable: 1 IP: Sev: information (6) Fac: local7 (7) Port: 514 Syslog Srvr 2: Enable: 0 IP: Sev: information (6) Fac: local4 (4) Port: 514 Syslog Srvr 3: Enable: 0 IP: Sev: information (6) Fac: local4 (4) Port: 514 Syslog Srvr Name 1: Syslog Srvr Name 2: Syslog Srvr Name 3: #byebye# 5

6 vemcmd dpa show dfwlog config 6