测试山石防火墙 接口中 逆向路由 设置与urpf是否有关

测试山石防火墙 接口中 逆向路由 设置与urpf是否有关

对于山石防火墙接口上的 "逆向路由"设置一直不理解.
问了几次,专业回复都说是 这是"会话保持"功能. 与"urpf"功能无关.
个人总是感觉有些怀疑.今天我来用虚拟机测试一下.

防火墙使用的是
SG6000-CloudEdge-5.5R4P21-VM01.qcow2

• 所有测试只判断去向数据包的处理结果.
  如果被drop就说明不转发.
  如果建立了session就说它是转发.
  没有讨论反向回来数据的转发情况.

---

设备连接结构
(192.168.200.2/24 linux pc 192.168.1.254/24) - (192.168.1.1/24 Hillstone FW 192.168.2.1/24)-虚拟机网卡up但没连接任何设备.

---

linux pc 设置路由. 到192.168.2.8经过 192.168.1.1

#ip route show
192.168.2.0/24 via 192.168.1.1 dev tap1a

pc执行的测试命令为. 发个tcp dstip 192.168.2.8 dport 23 srcip 192.168.200.2
#hping3 --scan 23 -S 192.168.2.8 -a 192.168.200.2

---

防火墙设置.
interface ethernet0/0 local
zone “trust”
ip address 192.168.1.1 255.255.255.0
manage ssh
manage ping
manage snmp
manage https
exit
interface ethernet0/1
zone “trust”
ip address 192.168.2.1 255.255.255.0
manage ssh
manage ping
manage https
exit

rule id 1
action permit
src-zone “Any”
dst-zone “Any”
src-addr “Any”
dst-addr “Any”
service “Any”
name “any”
exit

C>* 192.168.1.0/24 is directly connected, ethernet0/0
H>* 192.168.1.1/32 [0/0/1] is local address, ethernet0/0
C>* 192.168.2.0/24 is directly connected, ethernet0/1
H>* 192.168.2.1/32 [0/0/1] is local address, ethernet0/1

---

测试1
源目标接口在相同安全域下(trust). 接口开启"逆向路由"设置时debug

结论: 路由表中无源ip的路由信息. 开启"逆向路由"设置. 不转发.

SG-6000(config)# show logging debug
2020-11-03 09:21:50, DEBUG@FLOW: core 1 (sys up 0x2c5073 ms): rx_handle_prepare: 529d.0f82.509d->5254.0001.0a01, size 54, type 0x800, vid 0, port ethernet0/0
dp_prepare_if_for_pak
Switchid is 30(interface ethernet0/0) port ethernet0/0 ,pak iif=ethernet0/0
Not from apm packet, return.
Not ha apm heart beat message.
rx_handle_prepare i_if is ethernet0/0
Start l3 forward
Packet: 192.168.200.2 -> 192.168.2.8, id: 24162, ip size 40, prot: 6(TCP): 1805 -> 23
ad_vector_for_fast_flow: zonename trust, proto_flag[1] 0, proto 6
dp_prepare_pak_lookup srcip: 192.168.200.2, dstip: 192.168.2.8, src-port:1805, dst-port:23, prot 6
No session found, try to create session
dp_first_crt_sess_init_flow0_from_pak_iif: set cpuid 0
-----------------First path creating new session-----------------
dp_sess_sm_transtion: Do session state machine transtion, id 293, state: 0, event: 0!
allocate pending session and install flow0
begin lookup predefine prot:6 port:23
Identified as app TELNET (prot=6). timeout 1800.
-----