GlobalProtect 之后客户端无法间歇性地访问资源HA故障转移
9398
Created On 11/18/21 04:00 AM - Last Modified 03/02/23 02:34 AM
Symptom
- 在高可用性中，故障转移后，连接GlobalProtect客户端失去对资源的访问权限。
- 有时，用户无法访问资源GP.
- 上的全球柜台CLI显示：
flow_tunnel_encap_err 1 0 drop flow tunnel Packet dropped: tunnel encapsulation error flow_tunnel_encap_resolve 1 0 info flow tunnel tunnel structure lookup resolve
- 在 packet diag (flow basic, tunnel flow) 中，我们看到：
- 数据包被转发到不正确的隧道接口。 它应该是 tunnel.10 而不是 tunnel.11
- 丢包，隧道解析失败
== 2021-11-17 20:28:10.191 -0600 ==
Packet received at fastpath stage, tag 213075, type ATOMIC
Packet info: len 74 port 72 interface 72 vsys 1
wqe index 551795 packet 0x0x800000037dcd00e6, HA: 0, IC: 0
Packet decoded dump:
L2: d4:78:9b:50:49:7f->b4:0c:25:e0:40:48, type 0x0800
IP: 8.8.8.8->172.16.16.16, protocol 1
version 4, ihl 5, tos 0x00, len 60,
id 20797, frag_off 0x0000, ttl 63, checksum 28257(0x6e61)
ICMP: type 0, code 0, checksum 21586, id 1, seq 265
Flow fastpath, session 213075 s2c (set work 0x800000037740d900 exclude_video 0 from sp 0x8000000193b65700 exclude_video 0)
Forwarding lookup, ingress interface 72
L3 mode, router 1
Route lookup in router 1, IP 172.16.16.16
Route found, interface tunnel.11, zone 18, nexthop 172.16.16.0
Packet enters tunnel encap stage, tunnel interface null
== 2021-11-17 20:28:10.192 -0600 ==
Packet received at forwarding stage, tag 213075, type ATOMIC
Packet info: len 74 port 72 interface 132 vsys 1
wqe index 551795 packet 0x0x800000037dcd00e6, HA: 0, IC: 0
Packet decoded dump:
L2: d4:78:9b:50:49:7f->b4:0c:25:e0:40:48, type 0x0800
IP: 8.8.8.8->172.16.16.16, protocol 1
version 4, ihl 5, tos 0x00, len 60,
id 20797, frag_off 0x0000, ttl 62, checksum 28513(0x6f61)
ICMP: type 0, code 0, checksum 21586, id 1, seq 265
Packet enters tunnel encap stage, tunnel interface null
Resolving tunnel 6
Packet dropped, tunnel resolution failure
- 查看路由表，我们看到两条路由GP客户IP水池。 在里面FIB表，正在安装通过 tunnel.11 的意外路由。
admin@Lab(active)> show routing fib | match 172.16.16 422 172.16.16.0/24 172.16.16.0 ug tunnel.11 1500 admin@Lab(active)> show routing route | match 172.16.16 172.16.16.0/24 172.16.16.0 10 A S E tunnel.11 172.16.16.0/24 172.16.16.0 10 S E tunnel.10
Environment
- Firewall 配置有多个全局保护网关配置
Cause
- 在路由表中看到两条路由的原因是因为相同客户IP水池子网用于多个GP网关。
- 在此示例中，两个 GW：GP_External_Gateway 和 GP_External_Gateway_CL 都使用 172.16.16.0/24 客户端IP水池：
Resolution
- 不要用户重叠客户IP水池多个子网GP网关。