Screen OS

last person joined: 8 months ago 

This is a legacy community with limited Juniper monitoring.

  • 1.  Console Messages & Async traffic flow

    Posted 08-18-2008 03:41

    Hi,

     

    Q1. Can someone tell me how to get console messges to display in my telnet/SSH session on an SSG.  I'm trying to check NSRP sync status and usually when consoled I get the in sync/not in sync msg to exec nsrp sync global-config checksum.  When coming in through ssh I don't see this message.

     

    Q2. I have performed an Netsreen 208 to SSG upgrade in my network.  With the NS208 we had an async traffic flow issue where a traffic between 2 boxes in the DMZ was going from Device A  to Device B in the forward direction but Device B to Netscreen to Device A in the reverse.  The FW routed the traffic and there were no issues.  On upgrade to the SSG and Screen OS 6 this scenario no longer worked and I got the following on the Debug showing a packet drop:-

     

      ethernet0/1:192.168.1.54/2598->192.168.254.231/65405,6<Root>
      no session found
      flow_first_sanity_check: in <ethernet0/1>, out <N/A>

    **** jump to packet:192.168.254.231->192.168.1.54
      skipping pre-frag
      no more encapping needed
      send out through normal path.
      flow_ip_send: eb2d:192.168.254.231->192.168.1.54,6 => ethernet0/1(40) flag 0x0, vlan 0
      no l2info for packet.
      no route for packet
      search route to (null, 0.0.0.0->192.168.1.54) in vr trust-vr for vsd-0/flag-2000/ifp-ethernet0/1
      [ Dest] 3.route 192.168.1.54->192.168.1.54, to ethernet0/1
      route to 192.168.1.54
      arp entry found for 192.168.1.54 mac 0015c5e40daa
      **** pak processing end.
      packet dropped, first pak not sync

      

    Thanks



  • 2.  RE: Console Messages & Async traffic flow

    Posted 08-18-2008 03:50

    Hi,

     

    Try turning off syn checking

     

    unset flow tcp-syn-check

     

    As for seeing the Exec command in telnet and ssh im not sure. Have had the problem in the past but never found a work around, although never looked indepth.

     

    Regards

     

    Andy

     


  • 3.  RE: Console Messages & Async traffic flow
    Best Answer

    Posted 08-18-2008 04:36

    Hi,

     

    Q1: check "get dbuf stream" after "exec nsrp sync ..."

     

    Q2: "unset flow tcp-syn-check" should only be used as last resort, it turns of ... well, SYN-checking

       You should resolve your routing issues, not turn off security features of your firewall.

     

    Klaus



  • 4.  RE: Console Messages & Async traffic flow

    Posted 08-18-2008 06:44
    Thanks AndyC / Klaus