Cisco Cisco ASA 5510 Adaptive Security Appliance Leaflet

Cisco ASA Series 명령 참조, S 명령      

4장      show bgp through show cpu 명령

클러스터링의 경우 연결 흐름 문제를 해결하려면 먼저 마스터 디바이스에서 cluster exec show 

 명령을 입력하여 모든 디바이스의 연결을 확인합니다. 디렉터(Y), 백업(y) 및 전달자(z) 플래

그가 있는 흐름을 확인합니다. 다음 예에서는 세 ASA 모두에 대한 172.18.124.187:22와 
192.168.103.131:44727 간의 SSH 연결을 보여 줍니다. ASA 1에는 연결의 전달자임을 나타내는 z 
플래그가 있고, ASA3에는 연결의 디렉터임을 나타내는 Y 플래그가 있으며, ASA2에는 특별한 플
래그가 없어 소유자임을 나타냅니다. 아웃바운드 방향에서 이 연결의 패킷은 ASA2의 내부 인터페
이스로 들어가 외부 인터페이스를 나갑니다. 인바운드 방향에서 이 연결의 패킷은 ASA1 및 ASA3
의 외부 인터페이스로 들어가 클러스터 제어 링크를 통해 ASA2로 전달된 다음 ASA2의 내부 인터
페이스를 나갑니다.

ciscoasa/ASA1/master# cluster exec show conn

ASA1(LOCAL):**********************************************************

18 in use, 22 most used

Cluster stub connections: 0 in use, 5 most used

TCP outside  172.18.124.187:22 inside  192.168.103.131:44727, idle 0:00:00, bytes 

37240828, flags z

ASA2:*****************************************************************

12 in use, 13 most used

Cluster stub connections: 0 in use, 46 most used

TCP outside  172.18.124.187:22 inside  192.168.103.131:44727, idle 0:00:00, bytes 

37240828, flags UIO

ASA3:*****************************************************************

10 in use, 12 most used

Cluster stub connections: 2 in use, 29 most used

TCP outside  172.18.124.187:22 inside  192.168.103.131:44727, idle 0:00:03, bytes 0, flags  

Y

ASA2에 대한 show conn detail의 출력에서는 가장 최근 전달자가 ASA1이었음을 보여 줍니다.

ciscoasa/ASA2/slave# show conn detail

12 in use, 13 most used

Cluster stub connections: 0 in use, 46 most used

Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,

       B - initial SYN from outside, b - TCP state-bypass or nailed, C - CTIQBE media,

       D - DNS, d - dump, E - outside back connection, F - outside FIN, f - inside FIN,

       G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,

       i - incomplete, J - GTP, j - GTP data, K - GTP t3-response

       k - Skinny media, M - SMTP data, m - SIP media, n - GUP

       O - outbound data, P - inside back connection, p - Phone-proxy TFTP connection,

       q - SQL*Net data, R - outside acknowledged FIN,

       R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,

       s - awaiting outside SYN, T - SIP, t - SIP transient, U - up,

       V - VPN orphan, W - WAAS, Z - Scansafe redirection,

       X - inspected by service module

       Y - director stub flow

       y - backup stub flow

       z - forwarder stub flow

TCP outside: 172.18.124.187/22 inside: 192.168.103.131/44727,

    flags UIO , idle 0s, uptime 25s, timeout 1h0m, bytes 1036044, cluster sent/rcvd bytes 

0/1032983, cluster sent/rcvd total bytes 0/1080779, owners (1,255)

Traffic received at interface outside

        Locally received: 0 (0 byte/s)

        From most recent forwarder ASA1: 1032983 (41319 byte/s)

Traffic received at interface inside

        Locally received: 3061 (122 byte/s)