Juniper防火墙之ICMP-Ping

最新推荐文章于 2025-04-23 11:03:42 发布

原创最新推荐文章于 2025-04-23 11:03:42 发布 · 2k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#icmp #juniper #pingdom #网络

网络技术专栏收录该内容

9 篇文章

订阅专栏

示例拓扑

穿越Ping流量，从Router-A-10.10.10.1-----------VSRX--------------20.20.20.1-Router-B

当Router-B没有回程路由时，此时从A到Ping到B，分析防火墙上的ICMP会话，当对端无回包时，ICMP的Timeout是60秒。

root@vSRX> show security flow session protocol icmp |refresh 1 |no-more
Jul 25 07:03:10
—(refreshed at 2020-07-25 07:03:10 UTC)—
Total sessions: 0
Jul 25 07:03:11
—(refreshed at 2020-07-25 07:03:11 UTC)—
Total sessions: 0
Jul 25 07:03:12
—(refreshed at 2020-07-25 07:03:12 UTC)—
Session ID: 47, Policy name: 1/4, Timeout: 60, Valid
In: 10.10.10.1/0 --> 20.20.20.1/19478;icmp, If: ge-0/0/2.0, Pkts: 1, Bytes: 84
Out: 20.20.20.1/19478 --> 10.10.10.1/0;icmp, If: ge-0/0/3.0, Pkts: 0, Bytes: 0
Total sessions: 1
Jul 25 07:03:13
—(refreshed at 2020-07-25 07:03:13 UTC)—
Session ID: 47, Policy name: 1/4, Timeout: 58, Valid
In: 10.10.10.1/0 --> 20.20.20.1/19478;icmp, If: ge-0/0/2.0, Pkts: 1, Bytes: 84
Out: 20.20.20.1/19478 --> 10.10.10.1/0;icmp, If: ge-0/0/3.0, Pkts: 0, Bytes: 0

Note：Timout=60秒，可以通过以下的方式进行修改，

set applications application icmp-ping-test protocol icmp
set applications application icmp-ping-test icmp-type echo-request
set applications application icmp-ping-test inactivity-timeout 20

分析flow-traceoptions日志消息， ICMP类型8，代码0，请求回显，timeout=60s

Jul 25 07:03:12 07:03:11.978862:CID-0:RT:<10.10.10.1/0->20.20.20.1/19478;1> matched filter input:
Jul 25 07:03:12 07:03:11.979079:CID-0:RT: ge-0/0/2.0:10.10.10.1->20.20.20.1, icmp, (8/0)

Jul 25 07:03:12 07:03:11.979239:CID-0:RT:flow_first_policy_search: policy search from zone trust-> zone untrust (0x0,0x4c16,0x4c16)

Jul 25 07:03:12 07:03:11.979247:CID-0:RT:Policy lkup: vsys 0 zone(6:trust) -> zone(7:untrust) scope:0

Jul 25 07:03:12 07:03:11.979249:CID-0:RT: 10.10.10.1/2048 -> 20.20.20.1/4406 proto 1

Jul 25 07:03:12 07:03:11.979267:CID-0:RT: app 0, timeout 60s, curr ageout 60s

配置回程流量，分析会话及flow-traceoptions，当ping流量穿越防火墙时，穿越防火墙的timout=60秒，当对端回显回复时，SRX将ICMP的超时时间减少到4秒，快速超时，删除会话。

Session

Jul 25 07:27:27 07:27:26.1824331:CID-0:RT:<20.20.20.1/23->10.10.10.1/0;1> matched filter back-input:
Jul 25 07:27:27 07:27:26.1824346:CID-0:RT: ge-0/0/3.0:20.20.20.1->10.10.10.1, icmp, (0/0)

通过Wireshark抓包分析，在防火墙ge-0/0/2接口抓包

icmp-echo-request-type8-code0:

在这里插入图片描述

接口 ge-0/0/3接口, icmp-echo-request-type8-code0:

在这里插入图片描述

再回顾当前的策略配置及服务应用，如下所示：

root@vSRX# show security policies |display set

Jul 25 07:43:50
set security policies from-zone trust to-zone untrust policy 1 match source-address any
set security policies from-zone trust to-zone untrust policy 1 match destination-address any
set security policies from-zone trust to-zone untrust policy 1 match application icmp-ping-test
set security policies from-zone trust to-zone untrust policy 1 then permit
set security policies from-zone untrust to-zone trust policy 1 match source-address any
set security policies from-zone untrust to-zone trust policy 1 match destination-address any
set security policies from-zone untrust to-zone trust policy 1 match application icmp-reply
set security policies from-zone untrust to-zone trust policy 1 then permit

Application使用是自定义的icmp-request，其实与设备自带的junos-icmp-ping是一致的，如下所示：

###自定义配置###

root@vSRX# show applications |display set
Jul 25 07:43:58
set applications application icmp-ping-test protocol icmp
set applications application icmp-ping-test icmp-type echo-request
set applications application icmp-ping-test inactivity-timeout 20
set applications application icmp-reply protocol icmp
set applications application icmp-reply icmp-type echo-reply
set applications application icmp-reply inactivity-timeout 30

###设备内置icmp-ping###

root@vSRX# show groups junos-defaults | match icmp-ping|display set
Jul 25 07:44:21
set groups junos-defaults applications application junos-icmp-ping term t1 protocol icmp
set groups junos-defaults applications application junos-icmp-ping term t1 icmp-type echo-request

通常还有另外一种ICMP的Application，如下所示，在使用的时候还需作区分，只匹配icmp协议：

root@vSRX# show groups junos-defaults | match icmp-all |display set
Jul 25 07:46:52
set groups junos-defaults applications application junos-icmp-all term t1 protocol icmp

junos-ping and junos-icmp-all 两者在功能上完全一样，这两个应用的目标协议都是ICMP的所有类型，两者同时存在的原因是为了配置的兼容性：