Cisco Cisco ASA 5510 Adaptive Security Appliance Fascicule

            k - Skinny media, M - SMTP data, m - SIP media, n - GUP

            O - outbound data, P - inside back connection, p - Phone-proxy TFTP 

connection,

            q - SQL*Net data, R - outside acknowledged FIN,

            R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,

            s - awaiting outside SYN, T - SIP, t - SIP transient, U - up,

            V - VPN orphan, W - WAAS,

            X - inspected by service module,

            x - per session, Y - director stub flow, y - backup stub flow,

            Z - Scansafe redirection, z - forwarding stub flow

ESP outside: 10.1.227.1/53744 NP Identity Ifc: 10.1.226.1/30604, , flags c, idle 0s, 

uptime 1m21s, timeout 30s, bytes 7544, cluster sent/rcvd bytes 0/0, owners (0,255) 

Traffic received at interface outside Locally received: 7544 (93 byte/s) Traffic 

received at interface NP Identity Ifc Locally received: 0 (0 byte/s) UDP outside: 

10.1.227.1/500 NP Identity Ifc: 10.1.226.1/500, flags -c, idle 1m22s, uptime 1m22s, 

timeout 2m0s, bytes 1580, cluster sent/rcvd bytes 0/0, cluster sent/rcvd total bytes 

0/0, owners (0,255) Traffic received at interface outside Locally received: 864 (10 

byte/s) Traffic received at interface NP Identity Ifc Locally received: 716 (8 byte/s)

연결 흐름 문제를 해결하려면, 유닛에 cluster exec show conn 명령을 입력하여 모든 유닛에 

대한 연결을 우선 확인해야 합니다. 디렉터(Y), 백업(y) 및 전달자(z) 플래그가 있는 흐름을 확인

합니다. 다음 예는 세 ASA 모두에 대한 172.18.124.187:22와 192.168.103.131:44727 간의 SSH 

연결을 보여 줍니다. ASA 1에는 연결의 전달자임을 나타내는 z 플래그가 있고, ASA3에는 연결

의 디렉터임을 나타내는 Y 플래그가 있으며, ASA2에는 특별한 플래그가 없어 소유자임을 나타

냅니다. 아웃바운드 방향에서 이 연결의 패킷은 ASA2의 내부 인터페이스로 들어가 외부 인터페

이스를 나갑니다. 인바운드 방향에서 이 연결의 패킷은 ASA1 및 ASA3의 외부 인터페이스로 들

어가 클러스터 제어 링크를 통해 ASA2로 전달된 다음 ASA2의 내부 인터페이스를 나갑니다.

ciscoasa/ASA1/master# cluster exec show conn

ASA1(LOCAL):**********************************************************

18 in use, 22 most used

Cluster stub connections: 0 in use, 5 most used

TCP outside  172.18.124.187:22 inside  192.168.103.131:44727, idle 0:00:00, bytes 

37240828, flags z

ASA2:*****************************************************************

12 in use, 13 most used

Cluster stub connections: 0 in use, 46 most used

TCP outside  172.18.124.187:22 inside  192.168.103.131:44727, idle 0:00:00, bytes 

37240828, flags UIO

ASA3:*****************************************************************

10 in use, 12 most used

Cluster stub connections: 2 in use, 29 most used

TCP outside  172.18.124.187:22 inside  192.168.103.131:44727, idle 0:00:03, bytes 0, 

flags  Y

show cluster info [conn-distribution | packet-distribution | loadbalance]

show cluster info conn-distribution 

및 show cluster info packet-distribution 명령을 사

용하면 모든 클러스터 유닛 전체의 트래픽 분포가 표시됩니다. 이러한 명령은 외부 로드 밸런

서를 평가하고 조정하는 데 유용합니다.
show cluster info loadbalance 

명령을 사용하면 연결 리밸런싱 통계가 표시됩니다.

show cluster {access-list | conn | traffic | user-identity | xlate} [options]

전체 클러스터에 대한 집계된 데이터를 표시합니다. 사용 가능한 

옵션은 데이터 유형에 따라 

달라집니다.
show cluster access-list 

명령에 대한 내용은 다음 출력을 참조하십시오.