NSE7 Troubleshooting and Diagnostics — All Questions With Answers

Refer to the exhibit.

```
diagnose debug flow filter saddr 10.0.1.100
diagnose debug flow filter daddr 10.0.2.200
diagnose debug flow trace start 100
diagnose debug enable

# Output:
id=20085 trace_id=1 func=print_pkt_detail line=5757 msg="vd-root:0 received a packet from port1. src=10.0.1.100 dst=10.0.2.200 sport=12345 dport=80 proto=6"
id=20085 trace_id=1 func=resolve_ip_tuple line=3485 msg="tuple: 10.0.1.100->10.0.2.200, vd=0"
id=20085 trace_id=1 func=fw_pre_route_handler line=162 msg="no matching policy"
id=20085 trace_id=1 func=run_fw_handler line=59 msg="packet dropped"
```

Refer to the exhibit.

```
config firewall policy
    edit 1
        set name "Allow Web"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.0/24"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end
```

Refer to the exhibit.

FGT # diagnose sys session list

session info: proto=6 proto_state=01 duration=826 expire=3579 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper= 
reply-shaper= 
per_ip_shaper= 
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=log may_dirty npu bcm npu_flag=01
statistic(bytes/packets/err): org=1234/10/0 reply=5678/20/0
orgs:10.1.1.10/1234->20.2.2.20/80 vlan=10
reply:20.2.2.20/80->10.1.1.10/1234 vlan=10

FGT #

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Allow-Web"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.100"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end

diag debug flow show function-name show-verbose

--- flow debug output ---
proton_state=0, reason=session-denied
id=20085 trace_id=155 func=print_pkt_detail line=4945 msg="vd-root:0 received a packet from port1: 10.0.1.5:45231 -> 10.0.2.100:80, proto 6."
id=20085 trace_id=155 func=resolve_ip_tuple line=4125 msg="Find an existing session, id 00001234, original direction"
id=20085 trace_id=155 func=__ip_session_match_tuple line=2818 msg="Session state: not ready"
id=20085 trace_id=155 func=__ip_session_find_by_session_id line=2773 msg="session session_deny because state proto is not ready"