
Network Configuration
Using this command while trying to establish a connection that may not be working can be a good method of
finding out what is wrong. In this example, 0 packets were blocked by the filter in rule 4 because rules 2 and 3
allowed all packets needed. If there is a misconfiguration, seeing packets being blocked can be a hint of what is
wrong.
IP NAT Rules
Equalizer performs outbound NAT by creating IP NAT rules. These rules are processed when a packet is exiting
the system -unlike IP Filter rules which are processed when a packet is entering the system.
These rules can be displayed using the show sbr command from the eqcli as well:
IP NAT Rules:
List of active MAP/Redirect filters:
map wm0 192.168.211.0/24 -> 10.0.0.68/32 proxy port ftp ftp/tcp
map wm0 192.168.211.0/24 -> 10.0.0.68/32 portmap tcp/udp auto
map wm0 192.168.211.0/24 -> 10.0.0.68/32
map wm0 192.168.105.0/24 -> 10.0.0.68/32 proxy port ftp ftp/tcp
map wm0 192.168.105.0/24 -> 10.0.0.68/32 portmap tcp/udp auto
map wm0 192.168.105.0/24 -> 10.0.0.68/32
List of active sessions:
Three rules are added for each outbound NAT mapping. In this example, there are two mappings: one for the
192.168.211.0/24 local network and the other for the 192.168.105.0/24 destination network.
In this example, the rules specify that any packets that are leaving the system through the wm0 interface with a
source IP address on either the 192.168.211.0/24 or 192.168.105.0/24 network should instead be sent with a
source IP address of 10.0.0.68.
If there are any NAT connections active, they will be displayed in the list of active sessions.
Network Troubleshooting Tools
There are several tools useful for troubleshooting networking configurations on Equalizer. To simplify
troubleshooting, Equalizer includes a single eqcli command (show sbr) that displays the output of these tools.
There are other ways to view the same information in eqcli, however, the show sbr command displays the actual
running state of the system, whereas commands such as show vlan [X] subnet[
Y]
show the configuration
information and not necessarily the running data if there is a problem.
126
Copyright © 2013 Coyote Point Systems. A subsidiary of Fortinet, Inc.
Comentarios a estos manuales