ScreenOS Firewalls (NOT SRX)
Reply
Contributor
Telnet-1
Posts: 198
Registered: ‎05-05-2010
0
Accepted Solution

Debug filter Question

 

if i have pc1 on trust zone with ip= 10.10.10.2   , pc2 at untrust zone with ip= 10.20.20.2

 

now ,  i run ping from  pc1 to pc2   & i need to see traffic flow using debug

 

if i put  ffilter with : src-ip  pc1 & dst-ip pc2 , will i be able to see bot icmp requset & icmp reply ? or i need to put a filter at the reverse direction ( src-ip pc2 & dst-ip pc1 )  to see the reply

 

 

Super Contributor
mnarine
Posts: 179
Registered: ‎10-03-2009
0

Re: Debug filter Question

Put a reverse filter also.

 

-Mike

Contributor
Rontu
Posts: 17
Registered: ‎12-15-2009
0

Re: Debug filter Question

set ff src-ip <x.x.x.x> dst-ip <y.y.y.y>

set ff src-ip <y.y.y.y> dst-ip <x.x.x.x>

 

to unset the filters

unset ff ( repeat for the number of the filters you have )

Cheers,
Rog
Contributor
Telnet-1
Posts: 198
Registered: ‎05-05-2010
0

Re: Debug filter Question

 

Thnaks

 

But while the ping is working from ip1 to ip2    +  putting filter with only  src-ip  ip2   to dst-ip ip1  , i can see that the debug output is empty ?

 

 

I just want to make sure i'm getting the debug concept right  ,   if i'm suspecting that the ping reply is not received back  , what debug  filter will show me the reply only (  without showing me the requset ) ?

Super Contributor
mnarine
Posts: 179
Registered: ‎10-03-2009
0

Re: Debug filter Question

[ Edited ]

Did you do a "debug flow basic" to turn on flow debug?

 

-Mike

Contributor
Telnet-1
Posts: 198
Registered: ‎05-05-2010
0

Re: Debug filter Question

 

Yes ,

 

i just want to know the following :

 

when pinging from ip1 to  ip2  :

 

filter with src-ip ip1 & dst-ip ip2  will show both the request &  the reply ? 

Contributor
Telnet-1
Posts: 198
Registered: ‎05-05-2010
0

Re: Debug filter Question

Hi ...........

Distinguished Expert
echidov
Posts: 858
Registered: ‎11-02-2009
0

Re: Debug filter Question

Hi,

Yes, you'll see both request and response, because you are debugging a FLOW, not separate packets (debug flow basic etc.).

I prefer simpler tools for simpler tasks. So, you can configure a temporary policy for such a test and enable both logging options - on session init and on session close. If you see "Close - AGE OUT" in the ping entries, then for sure  there was no response.

 

Kind regards

Edouard

Kind regards,
Edouard
Contributor
Telnet-1
Posts: 198
Registered: ‎05-05-2010
0

Re: Debug filter Question

Thanks Echidov

 

What if i want to cheack only the reply using debug , is that possible ?

Distinguished Expert
echidov
Posts: 858
Registered: ‎11-02-2009
0

Re: Debug filter Question

Hi,

 

You can always filter the output using this command:

 

get db stream | include <string> 

<string> is a regular expression

You should play a little bit with the command to learn which <string> would be the best choice for you.

The debug output can also be sent to a tftp server using redirect > or saved to the usb stick for further use with a text editor.

 

Kind regards,

Edouard

Kind regards,
Edouard
Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.