如何确认 Panorama 与思科 ACI 面料的沟通
12835
Created On 01/18/21 13:10 PM - Last Modified 03/26/21 18:55 PM
Objective
本文提供了如何确认 Panorama 在 ACI 按照管理指南完成配置后与思科织物的通信。
Environment
- 任何 Panorama .
- PAN-OS 9.1及以上。
- 与思科 ACI 集成。
Procedure
- 检查与所有织物的连接状态 ACI
admin@aci-pan-67> show plugins cisco status
Cluster Name Status Last Updated Time Error Msg
----------------------------------------------------------------------------------------------------
apic1 Success 2021-01-18T12:12:14.963000
- 检查网套 Panorama ，并确认它至少有一个在已建立状态与思科 APIC 织物 IP
admin@aci-pan-67> show netstat all yes numeric-hosts yes verbose yes | match 10.46.32.221 => Replace the IP matching your configuration
tcp 0 0 10.46.56.67:51955 10.46.32.221:https ESTABLISHED
tcp 32 0 10.46.56.67:58400 10.46.32.221:https CLOSE_WAIT
tcp 32 0 10.46.56.67:58511 10.46.32.221:https CLOSE_WAIT
tcp 32 0 10.46.56.67:59814 10.46.32.221:https CLOSE_WAIT
tcp 32 0 10.46.56.67:38142 10.46.32.221:https CLOSE_WAIT
tcp 0 0 10.46.56.67:51944 10.46.32.221:https ESTABLISHED
tcp 32 0 10.46.56.67:34968 10.46.32.221:https CLOSE_WAIT
tcp 32 0 10.46.56.67:33555 10.46.32.221:https CLOSE_WAIT
tcp 0 0 10.46.56.67:51992 10.46.32.221:https ESTABLISHED
tcp 32 0 10.46.56.67:60270 10.46.32.221:https CLOSE_WAIT
tcp 0 0 10.46.56.67:51954 10.46.32.221:https ESTABLISHED - 检查插件计数器。不存储任何历史值。 计数器可按需清除。 提供增量选项
admin@aci-pan-67> show plugins cisco counters
Name Value Rate Severity Category Aspect Description
---------------------------------------------------------------------------------------------------------------
Tag_push_fail 2 0 error tag-proc tag_push Number of failed tag updates pushed to configd process
apic1_full_ret_success 111065 0 info tag-ret api-call Number of successful full endpoint retrievals from apic1.
apic1_invalid_ep 488114 0 info tag-ret api-call Number of endpoints retrieved outside of EPGs with apic1.
dashboard_data_update_success 111065 0 info tag-ret db-access Number of successful dashboard data update in Dashboard DB.
10.46.32.221_login_success 111081 0 info tag-ret api-call Number of successful logins with APIC 10.46.32.221.
ip_tag_queue_update_success 111065 0 info tag-ret db-access Number of successful IP/tag updates in Queue DB.
epg_update_success 111075 0 info tag-ret api-call Number of successful epg updates
admin@aci-pan-67> clear plugins cisco counters
Counters were successfully cleared! - 获取数据包捕获 panorama 并确认有数据包来回
admin@aci-pan-67> tcpdump filter "host 10.46.32.221 and port 443" => Repace the host and use ctrl+c to stop capture
admin@aci-pan-67> view-pcap no-dns-lookup yes no-port-lookup yes mgmt-pcap mgmt.pcap
12:29:32.953737 IP 10.46.56.67.51955 > 10.46.32.221.443: Flags [.], ack 4223802298, win 173, length 0
12:29:32.954200 IP 10.46.32.221.443 > 10.46.56.67.51955: Flags [.], ack 1, win 245, length 0
12:29:52.855441 IP 10.46.56.67.51954 > 10.46.32.221.443: Flags [P.], seq 1974128972:1974129407, ack 1545978313, win 330, length 435
12:29:52.859215 IP 10.46.32.221.443 > 10.46.56.67.51954: Flags [P.], seq 1:683, ack 435, win 430, length 682
12:29:52.859247 IP 10.46.56.67.51954 > 10.46.32.221.443: Flags [.], ack 683, win 330, length 0
12:29:52.859593 IP 10.46.56.67.51954 > 10.46.32.221.443: Flags [P.], seq 435:870, ack 683, win 330, length 435
12:29:52.862859 IP 10.46.32.221.443 > 10.46.56.67.51954: Flags [P.], seq 683:1365, ack 870, win 438, length 682
12:29:52.903740 IP 10.46.56.67.51954 > 10.46.32.221.443: Flags [.], ack 1365, win 330, length 0Additional Information
思科 ACI 插件 Panorama 允许您 policy ACI 使用动态地址组（DAG） 为思科织物构建安全性。 插件监控 Policy 您的思科环境中应用基础设施控制器 APIC （） 织物的变化 ACI ，并与 Cisco 共享这些信息 Panorama 。 思科 ACI 插件的工作原理与其他 panorama 插件（如插件）略有不同 AZURE AWS GCP 。 思科 ACI 插件与控制器保持 Web 插座连接 ACI ，并监控来自 ACI 端点更新的通知消息。 思科 ACI 插件将在 APIC 60 秒内提取报告端点变化的织物，每 10 分钟与所有 APIC 完全同步。