Examples
The following is sample output from the
debug
policy-firewall
function-trace command:
Device# debug policy-firewall function-trace
Feb 13 08:13:43: FIREWALL: fw_dp_tcp_init_sis():
Feb 13 08:13:43: FIREWALL: fw_dp_insp_init_sis():
Feb 13 08:13:43: FIREWALL: fw_dp_tcp_inspect(): , i2r = 1
Feb 13 08:13:43: FIREWALL: fw_dp_insp_listen_state():
Feb 13 08:13:43: FIREWALL: fw_dp_insp_ensure_return_traffic():
Feb 13 08:13:43: FIREWALL: fw_dp_insp_process_syn_packet():
Feb 13 08:13:43: FIREWALL: fw_dp_insp_create_tcp_host_entry():
Feb 13 08:13:43: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 0
Feb 13 08:13:43: FIREWALL*: fw_dp_insp_synsent_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 1
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_synrcvd_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_remove_sis_from_host_entry():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_remove_host_entry():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_delete_host_entry():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_handle_icq_control_stream():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 0
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_estab_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_handle_icq_control_stream():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 1
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_estab_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_handle_icq_control_stream():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 0
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_estab_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_handle_icq_control_stream():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 1
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_estab_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_handle_icq_control_stream():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 0
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_estab_state():
Feb 13 08:13:44: FIREWALL*: fw_dp_tcp_inspect(): , i2r = 1
Feb 13 08:13:44: FIREWALL*: fw_dp_insp_estab_state():
Feb 13 08:13:44: %APPFW-6-IM_ICQ_SESSION: im-icq text-chat service session initiator sends 77 bytes session 192.168.3.3:36091 192.168.103.3:5190 on zone-pair zp_test_in class test_im appl-class test_icq_1
The date in each line of the output is the time stamp. This output shows the functions called by the Cisco IOS firewall as
a session is inspected. Entries with an asterisk (*) after the word “FIREWALL” are entries when the fast path is used; otherwise,
the process path is used.
The following is sample output from the
debug policy-firewall object-creation ,
debug policy-firewall object-deletion ,
debug policy-firewall timers, and
debug policy-firewall events commands:
Log Buffer (600000 bytes):
Feb 13 08:16:17: FIREWALL: FW CCE got packet 0x66030694 in process path
Feb 13 08:16:17: FIREWALL: Router gen or router destined pak 0x66030694, let it pass
Feb 13 08:16:17: FIREWALL: FW CCE got packet 0x660311F8 in process path
Feb 13 08:16:17: FIREWALL: Router gen or router destined pak 0x660311F8, let it pass
Feb 13 08:16:17: FIREWALL: FW CCE got packet 0x66030A60 in process path
Feb 13 08:16:17: FIREWALL: Router gen or router destined pak 0x66030A60, let it pass
Feb 13 08:16:19: FIREWALL: FW CCE got packet 0x660328C0 in process path
Feb 13 08:16:19: FIREWALL: Router gen or router destined pak 0x660328C0, let it pass
Feb 13 08:16:21: FIREWALL: FW CCE got packet 0x66031D5C in process path
Feb 13 08:16:21: FIREWALL: Router gen or router destined pak 0x66031D5C, let it pass
Feb 13 08:16:22: FIREWALL: FW CCE got packet 0x66032128 in process path
Feb 13 08:16:22: FIREWALL: Router gen or router destined pak 0x66032128, let it pass
Feb 13 08:16:22: FIREWALL: FW CCE got packet 0x660324F4 in process path
Feb 13 08:16:22: FIREWALL: Router gen or router destined pak 0x660324F4, let it pass
Feb 13 08:16:24: FIREWALL: FW CCE got packet 0x66033424 in process path
Feb 13 08:16:24: FIREWALL: Router gen or router destined pak 0x66033424, let it pass
Feb 13 08:16:25: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:16:25: FIREWALL: fw_dp_insp_sample_session_rate
Feb 13 08:16:26: FIREWALL: FW CCE got packet 0x66032C8C in process path
Feb 13 08:16:26: FIREWALL: Router gen or router destined pak 0x66032C8C, let it pass
Feb 13 08:16:26: FIREWALL: FW CCE got packet 0x6602DCD0 in process path
Feb 13 08:16:26: FIREWALL: Router gen or router destined pak 0x6602DCD0, let it pass
Feb 13 08:16:26: FIREWALL: FW CCE got packet 0x5011DDB4 in process path
Feb 13 08:16:26: FIREWALL: Router gen or router destined pak 0x5011DDB4, let it pass
Feb 13 08:16:28: FIREWALL: FW CCE got packet 0x5011D9E8 in process path
Feb 13 08:16:28: FIREWALL: sis 20491840 : Timer Start: Timer: 20491964 Time: 30000 milisecs
Feb 13 08:16:28: FIREWALL: sis 20491840 : Timer Init Leaf
Feb 13 08:16:28: FIREWALL: sis 20491840 : Allocating L7 sis extensionL4 protocol = 1, L7 protocol = 62, granular = 5
Feb 13 08:16:28: FIREWALL: sis 20491840 : create host entry 669F3180 addr 192.168.103.3 bucket 12 (vrf 0:0) fwfo 0x507E39C0
Feb 13 08:16:29: FIREWALL*: sis 20491840 : Timer Start: Timer: 20491964 Time: 3600000 milisecs
Feb 13 08:16:29: %APPFW-6-IM_ICQ_SESSION: im-icq text-chat service session initiator sends 77 bytes session 192.168.3.3:36091 192.168.103.3:5190 on zone-pair zp_test_in class test_im appl-class test_icq_1
Feb 13 08:16:29: %APPFW-6-IM_ICQ_SESSION: im-icq text-chat service session initiator gets 198 bytes session 192.168.103.3:5190 192.168.3.3:36091 on zone-pair zp_test_in class test_im appl-class test_icq_1
Feb 13 08:16:29: FIREWALL: FW CCE got packet 0x20159864 in process path
Feb 13 08:16:29: FIREWALL: Router gen or router destined pak 0x20159864, let it pass
Feb 13 08:16:29: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:16:29: FIREWALL: delete host entry 669F3180 addr 192.168.103.3
Feb 13 08:16:30: FIREWALL: FW CCE got packet 0x66033058 in process path
Feb 13 08:16:30: FIREWALL: Router gen or router destined pak 0x66033058, let it pass
Feb 13 08:16:31: FIREWALL: FW CCE got packet 0x660337F0 in process path
Feb 13 08:16:31: FIREWALL: Router gen or router destined pak 0x660337F0, let it pass
Feb 13 08:16:31: FIREWALL: FW CCE got packet 0x20159C30 in process path
Feb 13 08:16:31: FIREWALL: Router gen or router destined pak 0x20159C30, let it pass
Feb 13 08:16:34: FIREWALL: FW CCE got packet 0x20159FFC in process path
Feb 13 08:16:34: FIREWALL: Router gen or router destined pak 0x20159FFC, let it pass
Feb 13 08:16:35: FIREWALL: FW CCE got packet 0x5011E54C in process path
Feb 13 08:16:35: FIREWALL: Router gen or router destined pak 0x5011E54C, let it pass
Feb 13 08:16:36: FIREWALL: FW CCE got packet 0x665E6304 in process path
Feb 13 08:16:36: FIREWALL: Router gen or router destined pak 0x665E6304, let it pass
Feb 13 08:16:36: FIREWALL: FW CCE got packet 0x5011E180 in process path
Feb 13 08:16:36: FIREWALL: Router gen or router destined pak 0x5011E180, let it pass
Feb 13 08:16:38: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:16:38: FIREWALL: fw_dp_insp_sample_session_rate
Feb 13 08:16:38: FIREWALL: FW CCE got packet 0x2015A3C8 in process path
Feb 13 08:16:38: FIREWALL: Router gen or router destined pak 0x2015A3C8, let it pass
Feb 13 08:16:39: FIREWALL: FW CCE got packet 0x5011E918 in process path
Feb 13 08:16:39: FIREWALL: Router gen or router destined pak 0x5011E918, let it pass
Feb 13 08:16:40: FIREWALL: FW CCE got packet 0x665E6E68 in process path
Feb 13 08:16:40: FIREWALL: Router gen or router destined pak 0x665E6E68, let it pass
Feb 13 08:16:40: FIREWALL: FW CCE got packet 0x2015A794 in process path
Feb 13 08:16:40: FIREWALL: Router gen or router destined pak 0x2015A794, let it pass
Feb 13 08:16:43: FIREWALL: FW CCE got packet 0x665E7234 in process path
Feb 13 08:16:43: FIREWALL: Router gen or router destined pak 0x665E7234, let it pass
Feb 13 08:16:44: FIREWALL: FW CCE got packet 0x5011ECE4 in process path
Feb 13 08:16:44: FIREWALL: Router gen or router destined pak 0x5011ECE4, let it pass
Feb 13 08:16:44: FIREWALL: FW CCE got packet 0x2015AB60 in process path
Feb 13 08:16:44: FIREWALL: Router gen or router destined pak 0x2015AB60, let it pass
Feb 13 08:16:45: FIREWALL: FW CCE got packet 0x665E7600 in process path
Feb 13 08:16:45: FIREWALL: Router gen or router destined pak 0x665E7600, let it pass
Feb 13 08:16:48: FIREWALL: FW CCE got packet 0x665E79CC in process path
Feb 13 08:16:48: FIREWALL: Router gen or router destined pak 0x665E79CC, let it pass
Feb 13 08:16:48: FIREWALL: FW CCE got packet 0x5011F47C in process path
Feb 13 08:16:48: FIREWALL: Router gen or router destined pak 0x5011F47C, let it pass
Feb 13 08:16:49: FIREWALL: FW CCE got packet 0x6602E468 in process path
Feb 13 08:16:49: FIREWALL: Router gen or router destined pak 0x6602E468, let it pass
Feb 13 08:16:50: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:16:50: FIREWALL: fw_dp_insp_sample_session_rate
Feb 13 08:16:50: FIREWALL: FW CCE got packet 0x2015B2F8 in process path
Feb 13 08:16:50: FIREWALL: Router gen or router destined pak 0x2015B2F8, let it pass
Feb 13 08:16:52: FIREWALL: FW CCE got packet 0x6602E09C in process path
Feb 13 08:16:52: FIREWALL: Router gen or router destined pak 0x6602E09C, let it pass
Feb 13 08:16:53: FIREWALL: FW CCE got packet 0x6602EC00 in process path
Feb 13 08:16:53: FIREWALL: Router gen or router destined pak 0x6602EC00, let it pass
Feb 13 08:16:54: FIREWALL: FW CCE got packet 0x6602EFCC in process path
Feb 13 08:16:54: FIREWALL: Router gen or router destined pak 0x6602EFCC, let it pass
Feb 13 08:16:55: FIREWALL: FW CCE got packet 0x6602F764 in process path
Feb 13 08:16:55: FIREWALL: Router gen or router destined pak 0x6602F764, let it pass
Feb 13 08:16:57: FIREWALL: FW CCE got packet 0x6602F398 in process path
Feb 13 08:16:57: FIREWALL: Router gen or router destined pak 0x6602F398, let it pass
Feb 13 08:16:57: FIREWALL: FW CCE got packet 0x6602FB30 in process path
Feb 13 08:16:57: FIREWALL: Router gen or router destined pak 0x6602FB30, let it pass
Feb 13 08:16:59: FIREWALL: FW CCE got packet 0x66030E2C in process path
Feb 13 08:16:59: FIREWALL: Router gen or router destined pak 0x66030E2C, let it pass
Feb 13 08:16:59: FIREWALL: FW CCE got packet 0x66030694 in process path
Feb 13 08:16:59: FIREWALL: Router gen or router destined pak 0x66030694, let it pass
Feb 13 08:17:00: FIREWALL*: sis 20491840 : Timer Start: Timer: 20491964 Time: 5000 milisecs
Feb 13 08:17:00: FIREWALL*: sis 20491840 : Timer Start: Timer: 20491964 Time: 1000 milisecs
Feb 13 08:17:01: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:17:01: FIREWALL: sis 20491840 : Idle Timer Expires: Timer: 20491964
Feb 13 08:17:01: FIREWALL: sis 20491840 : Delete sis half_open 0
Feb 13 08:17:01: FIREWALL: sis 20491840 : Timer Stop: Timer: 20491964
Feb 13 08:17:01: FIREWALL: sis 20491840 : Delete sis
Feb 13 08:17:01: FIREWALL: sis 20491840 : session on temporary delete list
Feb 13 08:17:01: FIREWALL: sis 20491840 : Calling l4 cleanup
Feb 13 08:17:01: FIREWALL: FW CCE got packet 0x660311F8 in process path
Feb 13 08:17:01: FIREWALL: Router gen or router destined pak 0x660311F8, let it pass
Feb 13 08:17:02: FIREWALL: FW CCE got packet 0x66030A60 in process path
Feb 13 08:17:02: FIREWALL: Router gen or router destined pak 0x66030A60, let it pass
Feb 13 08:17:02: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:17:02: FIREWALL: fw_dp_insp_sample_session_rate
Feb 13 08:17:04: FIREWALL: FW CCE got packet 0x66031990 in process path
Feb 13 08:17:04: FIREWALL: Router gen or router destined pak 0x66031990, let it pass
Feb 13 08:17:04: FIREWALL: FW CCE got packet 0x660315C4 in process path
Feb 13 08:17:04: FIREWALL: Router gen or router destined pak 0x660315C4, let it pass
Feb 13 08:17:06: FIREWALL: FW CCE got packet 0x660328C0 in process path
Feb 13 08:17:06: FIREWALL: Router gen or router destined pak 0x660328C0, let it pass
Feb 13 08:17:07: FIREWALL: FW CCE got packet 0x66031D5C in process path
Feb 13 08:17:07: FIREWALL: Router gen or router destined pak 0x66031D5C, let it pass
Feb 13 08:17:08: FIREWALL: FW CCE got packet 0x66033424 in process path
Feb 13 08:17:08: FIREWALL: Router gen or router destined pak 0x66033424, let it pass
Feb 13 08:17:09: FIREWALL: FW CCE got packet 0x66032C8C in process path
Feb 13 08:17:09: FIREWALL: Router gen or router destined pak 0x66032C8C, let it pass
Feb 13 08:17:11: FIREWALL: FW CCE got packet 0x6602DCD0 in process path
Feb 13 08:17:11: FIREWALL: Router gen or router destined pak 0x6602DCD0, let it pass
Feb 13 08:17:11: FIREWALL: FW CCE got packet 0x5011DDB4 in process path
Feb 13 08:17:11: FIREWALL: Router gen or router destined pak 0x5011DDB4, let it pass
Feb 13 08:17:13: FIREWALL: FW CCE got packet 0x20159498 in process path
Feb 13 08:17:13: FIREWALL: Router gen or router destined pak 0x20159498, let it pass
Feb 13 08:17:13: FIREWALL: FW CCE got packet 0x665E5F38 in process path
Feb 13 08:17:13: FIREWALL: Router gen or router destined pak 0x665E5F38, let it pass
Feb 13 08:17:14: FIREWALL: fw_dp_insp_handle_timer_event
Feb 13 08:17:14: FIREWALL: fw_dp_insp_sample_session_rate
Feb 13 08:17:16: FIREWALL: FW CCE got packet 0x5011D9E8 in process path
Feb 13 08:17:16: FIREWALL: Router gen or router destined pak 0x5011D9E8, let it pass
Feb 13 08:17:16: FIREWALL: FW CCE got packet 0x20159864 in process path
Feb 13 08:17:16: FIREWALL: Router gen or router destined pak 0x20159864, let it pass
The following is sample output from the
debug policy-firewall protocol icq command:
The event debug output declares the packet path from which the firewall got the packet. The packet path can be either Cisco
Express Forwarding or the process path. The
debug
policy-firewall command is used when the firewall sends out a packet that acts like a proxy.
The timer debug output specifies timer-related events. Timers are used to close the sessions created by the firewall. Whenever
a timeout happens, the timer debugging output specifies whether it needs to close the session or keep it open for longer.
Device# debug policy-firewall protocol icq
Apr 2 23:55:21: CCE*: I2R = 1, state_object = 0x0, data_len = 0
Apr 2 23:55:21: CCE*: ICQ protocol found...
Apr 2 23:55:21: CCE*: cce_dp_named_db_inspect_icq_create_cso
Apr 2 23:55:21: CCE*: I2R = 0, state_object = 0x508A1014, data_len = 10
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 1 , Packet length = 4
Apr 2 23:55:21: CCE*: I2R = 1, state_object = 0x508A1014, data_len = 270
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 1 , Packet length = 264
Apr 2 23:55:21: CCE*: ICQ:Find the client version
Apr 2 23:55:21: CCE*: ICQ:Get the client string
Apr 2 23:55:21: CCE*: ICQ:Object Type = 6,Object Length = 256
Apr 2 23:55:21: CCE*: icq_setstate_on_servicetype
Apr 2 23:55:21: CCE*: ICQ:Obj Data Skipping :prev state =4
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 0,Curr state = 1 , Prev state = 0
Apr 2 23:55:21: CCE*: I2R = 0, state_object = 0x508A1014, data_len = 42
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 2 , Packet length = 36
Apr 2 23:55:21: CCE*: ICQ:Family Service Id = 1,Subtype Id = 3
Apr 2 23:55:21: CCE*: ICQ:curr state = 9
Apr 2 23:55:21: CCE*: I2R = 1, state_object = 0x508A1014, data_len = 56
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 2 , Packet length = 50
Apr 2 23:55:21: CCE*: ICQ:Family Service Id = 1,Subtype Id = 23
Apr 2 23:55:21: CCE*: ICQ:curr state = 22
Apr 2 23:55:21: CCE*: ICQ:service = 1 , version = 4
Apr 2 23:55:21: CCE*: ICQ:service = 19 , version = 4
Apr 2 23:55:21: CCE*: ICQ:service = 2 , version = 1
Apr 2 23:55:21: CCE*: ICQ:service = 3 , version = 1
Apr 2 23:55:21: CCE*: ICQ:service = 21 , version = 1
Apr 2 23:55:21: CCE*: ICQ:Detected ICQ Protocol
Apr 2 23:55:21: CCE*: I2R = 1, state_object = 0x508A1014, data_len = 230
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 2 , Packet length = 224
Apr 2 23:55:21: CCE*: ICQ:Family Service Id = 4,Subtype Id = 6
Apr 2 23:55:21: CCE*: ICQ:curr state = 14
Apr 2 23:55:21: CCE*: icq_process_client_message
Apr 2 23:55:21: CCE*: ICQ:Message Channel ID = 2
Apr 2 23:55:21: CCE*: icq_skip_client_msg
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 5
Apr 2 23:55:21: CCE*: ICQ:length = 190,obj length = 186
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 4,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 3
Apr 2 23:55:21: CCE*: ICQ:length = 0,obj length = 0
Apr 2 23:55:21: CCE*: I2R = 1, state_object = 0x508A1014, data_len = 66
Apr 2 23:55:21: CCE*: ICQ:state = 21
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 2 , Packet length = 60
Apr 2 23:55:21: CCE*: ICQ:Family Service Id = 4,Subtype Id = 6
Apr 2 23:55:21: CCE*: ICQ:curr state = 14
Apr 2 23:55:21: CCE*: icq_process_client_message
Apr 2 23:55:21: CCE*: ICQ:Message Channel ID = 2
Apr 2 23:55:21: CCE*: icq_skip_client_msg
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 5
Apr 2 23:55:21: CCE*: ICQ:length = 26,obj length = 26
Apr 2 23:55:21: CCE*: ICQ:Obj Data Skipping :prev state =19
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 0,Curr state = 1 , Prev state = 0
Apr 2 23:55:21: CCE*: ICQ:service found = 2
Apr 2 23:55:21: CCE*: ICQ: Found IM default service
Apr 2 23:55:21: %APPFW-6-IM_ICQ_SESSION: im-icq un-recognized service session initiator sends 66 bytes session 192.168.5.3:25610 63.147.175.30:5190 on zone-pair zp_test_in class test_im appl-class test_icq_1
Apr 2 23:55:21: CCE*: I2R = 0, state_object = 0x508A1014, data_len = 36
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 2 , Packet length = 30
Apr 2 23:55:21: CCE*: ICQ:Family Service Id = 4,Subtype Id = 12
Apr 2 23:55:21: CCE*: ICQ:curr state = 9
Apr 2 23:55:21: CCE*: I2R = 0, state_object = 0x508A1014, data_len = 285
Apr 2 23:55:21: CCE*: ICQ:state = 1
Apr 2 23:55:21: CCE*: ICQ:FLAP Channel = 2 , Packet length = 279
Apr 2 23:55:21: CCE*: ICQ:Family Service Id = 4,Subtype Id = 7
Apr 2 23:55:21: CCE*: ICQ:curr state = 14
Apr 2 23:55:21: CCE*: icq_process_client_message
Apr 2 23:55:21: CCE*: ICQ:Message Channel ID = 2
Apr 2 23:55:21: CCE*: icq_skip_client_msg
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 1
Apr 2 23:55:21: CCE*: ICQ:length = 241,obj length = 2
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 239,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 6
Apr 2 23:55:21: CCE*: ICQ:length = 235,obj length = 4
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 231,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 5
Apr 2 23:55:21: CCE*: ICQ:length = 227,obj length = 4
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 223,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 15
Apr 2 23:55:21: CCE*: ICQ:length = 219,obj length = 4
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 215,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 3
Apr 2 23:55:21: CCE*: ICQ:length = 211,obj length = 4
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 207,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 5
Apr 2 23:55:21: CCE*: ICQ:length = 203,obj length = 190
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 13,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 22
Apr 2 23:55:21: CCE*: ICQ:length = 9,obj length = 4
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 5,Curr state = 19 , Prev state = 19
Apr 2 23:55:21: CCE*: ICQ:TLV Service Type = 19
Apr 2 23:55:21: CCE*: ICQ:length = 1,obj length = 1
Apr 2 23:55:21: CCE*: ICQ:Obj Data Skipping :prev state =19
Apr 2 23:55:21: CCE*: ICQ:ICQ Data length = 0,Curr state = 1 , Prev state = 0
Apr 2 23:56:10: CCE*: I2R = 1, state_object = 0x508A1014, data_len = 0
Apr 2 23:56:11: FIREWALL sis 65A1C100: Sis extension deleted
Apr 2 23:56:11: CCE: cce_dp_named_db_inspect_icq_delete_cso
The sample output from the
debug
policy-firewall
protocol
winmsgr command includes information about the instant messenger (IM) service. For example, the following lines declare that the
type of IM service the user is running is Windows Messenger (WINMSGR):
The debug output details the different states that the state machine sees while parsing the Layer 7 I Seek You (ICQ) payload.
Apr 3 00:21:46: CCE*: WINMSGR:service found = 2
Apr 3 00:21:46: CCE*: WINMSGR: Found IM default service
The following is sample output from the
debug policy-firewall protocol winmsgr command:
Device# debug policy-firewall protocol winmsgr
Apr 3 00:21:46: CCE*: I2R = 1, state_object = 0x0, data_len = 0
Apr 3 00:21:46: CCE*: WINMSGR protocol found...
Apr 3 00:21:46: CCE*: cce_dp_named_db_inspect_winmsgr_create_cso
Apr 3 00:21:46: CCE*: I2R = 1, state_object = 0x660CF5B4, data_len = 19
Apr 3 00:21:46: CCE*: WINMSGR:datalen=19,matchflag=11,matchlen=19
Apr 3 00:21:46: CCE*: WINMSGR:Initial trafficfound
Apr 3 00:21:46: CCE*: I2R = 0, state_object = 0x660CF5B4, data_len = 19
Apr 3 00:21:46: CCE*: WINMSGR:datalen=19,matchflag=11,matchlen=19
Apr 3 00:21:46: CCE*: WINMSGR:Initial trafficfound
Apr 3 00:21:46: CCE*: I2R = 1, state_object = 0x660CF5B4, data_len = 82
Apr 3 00:21:46: CCE*: WINMSGR:datalen=82,matchflag=6,matchlen=4
Apr 3 00:21:46: CCE*: WINMSGR:version msg : CVR 31 0x0409 winnt 5.0 i386 MSMSGS 5.1.0701 WindowsMessenger fwuser@example.com
Apr 3 00:21:46: CCE*: I2R = 0, state_object = 0x660CF5B4, data_len = 96
Apr 3 00:21:46: CCE*: WINMSGR:datalen=96,matchflag=6,matchlen=4
Apr 3 00:21:46: CCE*: I2R = 1, state_object = 0x660CF5B4, data_len = 33
Apr 3 00:21:46: CCE*: WINMSGR:datalen=33,matchflag=12,matchlen=33
Apr 3 00:21:46: CCE*: WINMSGR:Initial trafficfound
Apr 3 00:21:46: CCE*: I2R = 0, state_object = 0x660CF5B4, data_len = 162
Apr 3 00:21:46: CCE*: I2R = 1, state_object = 0x660CF5B4, data_len = 324
Apr 3 00:21:46: CCE*: I2R = 0, state_object = 0x660CF5B4, data_len = 37
Apr 3 00:21:46: CCE*: WINMSGR:datalen=37,matchflag=12,matchlen=37
Apr 3 00:21:46: CCE*: WINMSGR:Initial trafficfound
Apr 3 00:21:46: CCE*: I2R = 1, state_object = 0x660CF5B4, data_len = 307
Apr 3 00:21:46: CCE*: WINMSGR:datalen=307,matchflag=5,matchlen=118
Apr 3 00:21:46: CCE*: WINMSGR:service found = 2
Apr 3 00:21:46: CCE*: WINMSGR: Found IM default service
Apr 3 00:21:46: %APPFW-6-IM_WINMSGR_SESSION: im-winmsgr un-recognized service session initiator sends 307 bytes session 192.168.5.3:24601 209.165.200.230:1863 on zone-pair zp_test_in class test_im appl-class test_winmsgr_1
Apr 3 00:21:46: CCE*: I2R = 0, state_object = 0x660CF5B4, data_len = 320
Apr 3 00:21:46: CCE*: I2R = 0, state_object = 0x660CF5B4, data_len = 332
Apr 3 00:21:46: CCE*: WINMSGR:datalen=332,matchflag=5,matchlen=143
Apr 3 00:21:46: CCE*: WINMSGR:service found = 2
Apr 3 00:21:46: CCE*: WINMSGR: Found IM default service
Apr 3 00:21:46: %APPFW-6-IM_WINMSGR_SESSION: im-winmsgr un-recognized service session initiator gets 332 bytes session 209.165.200.230:1863 192.168.5.3:24601 on zone-pair zp_test_in class test_im appl-class test_winmsgr_1
Apr 3 00:23:11: CCE*: I2R = 1, state_object = 0x660CF5B4, data_len = 0
Apr 3 00:23:11: FIREWALL sis 65A1D540: Sis extension deleted
The following is sample output from the
debug
policy-firewall
control-plane command:
Device# debug policy-firewall control-plane
policy_fw:
Policy-Firewall control-plane debugging is on
voice-gw-118.03#
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited,
0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 247 messages logged, xml disabled,
filtering disabled
Logging Exception size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled
Trap logging: level informational, 44 message lines logged
Log Buffer (60000000 bytes):
FIREWALL CP: fw_cp_prot_num_to_name() l4 1, l7 5, gran 0
FIREWALL CP: fw_cp_get_flow_policy_and_class() Flow policy does not exist
FIREWALL CP: fw_cp_check_create_default_l7_policy() Could not retrieve flow policy for L4 policy l4-pmap L4 class l4-cmap
FIREWALL CP: fw_classmap_filter_update_in_policymap() Adding filter 0x650187F0 to class l4-cmap in policy l4-pmap
FIREWALL CP: fw_policy_action_cmd() PPM create action inspect with params 0x64CAF8E8
FIREWALL CP: fw_inspect_class_params() inspect config-plane CLASS-ADD action 0x66315C5C,params 0x64CAF8E8
FIREWALL CP: fw_validate_class_for_matchprot() Validating protocols in class l4-cmap
FIREWALL CP: fw_validate_class_for_matchprot() protocol filter found
FIREWALL CP: fw_inspect_class_params() Attached config-plane action_params 0x663BD280
FIREWALL CP: fw_cp_create_attach_flow_policy()
FIREWALL CP: fw_cp_get_string_from_random_num() Random number generated is 2697258553
FIREWALL CP: fw_cp_generate_random_string() Allocated random str 2697258553 for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_get_random_string() Found random string for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_get_random_string() Found random string for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_get_random_string() Found random string for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_prot_num_to_name() l4 2, l7 5, gran 0
FIREWALL CP: fw_inspect_int_class_params()
FIREWALL CP: fw_create_attach_template_class()
FIREWALL CP: fw_create_attach_template_class() Creating template class for trigger 15udp_2697258553 in 15_2697258553
FIREWALL CP: fw_create_attach_template_class() Trying to create a PPM filter with id 0x64CA73EC
FIREWALL CP: fw_cp_prot_num_to_name() l4 4, l7 5, gran 0
FIREWALL CP: fw_inspect_int_class_params()
FIREWALL CP: fw_create_attach_template_class()
FIREWALL CP: fw_create_attach_template_class() Creating template class for trigger 15icmp_2697258553 in 15_2697258553
FIREWALL CP: fw_create_attach_template_class() Trying to create a PPM filter with id 0x64CA73EC
FIREWALL CP: fw_cp_create_attach_vtcp_classes() Create policy 15
FIREWALL CP: fw_cp_create_tcp_15()
FIREWALL CP: fw_cp_vtcp_support_get_tcp_init_class() Creating TCP Class with Pure SYN filter
FIREWALL CP: fw_inspect_int_class_params()
FIREWALL CP: fw_create_attach_template_class()
FIREWALL CP: fw_create_attach_template_class() Creating template class for trigger 15tcp_2697258553 in 15_2697258553
FIREWALL CP: fw_create_attach_template_class() Trying to create a PPM filter with id 0x64CA73A4
FIREWALL CP: fw_cp_create_attach_flow_policy() Success-creating flow policy
FIREWALL CP: fw_cp_create_attach_flow_policy() Attach flow policy to trigger class as child policy
FIREWALL CP: fw_cp_create_attach_flow_policy() Success- Attached flow policy to trigger class
FIREWALL CP: fw_cp_create_attach_flow_policy() Creating P20 & P21 for vtcp
FIREWALL CP: fw_cp_generate_random_string() Found random string for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_get_flow_policy_and_class() Found flow policy 0x64FFC838
FIREWALL CP: fw_cp_get_random_string() Found random string for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_get_random_string() Found random string for policy l4-pmap class l4-cmap
FIREWALL CP: fw_cp_get_flow_policy_and_class() Found flow TCP 0x6585718C and UDP 0x645D1794 classes
FIREWALL CP: fw_cp_check_create_default_l7_class() Checking the class l4-cmap
FIREWALL CP: fw_reverse_policy_handle_zp_event()
FIREWALL CP: fw_reverse_policy_handle_zp_event() Reverse_policy Zone pair add event
FIREWALL CP: fw_get_ppm_policy_on_zp() Did not find ppm policy on zp zp p_type 0x7
FIREWALL CP: fw_get_name_type_and_client_of_first_class_in_policy()
FIREWALL CP: fw_create_cp_dynamic_class()
FIREWALL CP: fw_create_cp_dynamic_class() Trying to create a PPM filter with id 0x10000000
FIREWALL CP: fw_create_cp_dynamic_class() Success
FIREWALL CP: fw_drop_class_params() action 0x6637A5C0, cmd_params 0x64CA7550, event 0x21
FIREWALL CP: fw_create_noop_feature_object()
FIREWALL CP: fw_create_inspect_feature_object()
FIREWALL CP: fw_create_fo_internal() Create FO for class 0xC0000002 target_class 0xA0000000 action CCE_INSPECT_CONFIGURED
FIREWALL CP: fw_cp_get_inspect_params()
FIREWALL CP: fw_cp_get_inspect_params() Creating the FO with default parameters
FIREWALL CP: fw_create_fo_internal() Created FO with id 0xAAAA0006 action CCE_INSPECT_CONFIGURED
FIREWALL CP: fw_cp_store_fo_id() Enqueue 0xAAAA0006 to fo_param_list
FIREWALL CP: fw_create_noop_feature_object()
FIREWALL CP: fw_create_inspect_int_feature_object()
FIREWALL CP: fw_create_fo_internal() Create FO for class 0xC0000005 target_class 0xA0000000 action CCE_INSPECT
FIREWALL CP: fw_cp_get_inspect_params()
FIREWALL CP: fw_cp_get_inspect_params() Creating the FO with default parameters
FIREWALL CP: fw_create_fo_internal() Created FO with id 0xAAAA0007 action CCE_INSPECT
FIREWALL CP: fw_cp_store_fo_id() Enqueue 0xAAAA0007 to fo_param_list
FIREWALL CP: fw_create_noop_feature_object()
FIREWALL CP: fw_create_inspect_int_feature_object()
FIREWALL CP: fw_create_fo_internal() Create FO for class 0xC0000007 target_class 0xA0000000 action CCE_INSPECT
FIREWALL CP: fw_cp_get_inspect_params()
FIREWALL CP: fw_cp_get_inspect_params() Creating the FO with default parameters
FIREWALL CP: fw_create_fo_internal() Created FO with id 0xAAAA0008 action CCE_INSPECT
FIREWALL CP: fw_cp_store_fo_id() Enqueue 0xAAAA0008 to fo_param_list
FIREWALL CP: fw_create_noop_feature_object()
FIREWALL CP: fw_create_inspect_int_feature_object()
FIREWALL CP: fw_create_fo_internal() Create FO for class 0xC0000009 target_class 0xA0000000 action CCE_INSPECT
FIREWALL CP: fw_cp_get_inspect_params()
FIREWALL CP: fw_cp_get_inspect_params() Creating the FO with default parameters
FIREWALL CP: fw_create_fo_internal() Created FO with id 0xAAAA0009 action CCE_INSPECT
FIREWALL CP: fw_cp_store_fo_id() Enqueue 0xAAAA0009 to fo_param_list
FIREWALL CP: fw_create_drop_feature_object()
FIREWALL CP: fw_create_fo_internal() Create FO for class 0xC0000003 target_class 0xA0000000 action CCE_FW_DROP
FIREWALL CP: fw_create_fo_internal() Created FO with id 0xAAAA000A action CCE_FW_DROP
FIREWALL CP: fw_create_internal_reverse_policy()
FIREWALL CP: fw_create_ppm_reverse_policy()
FIREWALL CP: fw_get_name_type_and_client_of_first_class_in_policy()
FIREWALL CP: fw_create_cp_dynamic_class()
FIREWALL CP: fw_create_noop_feature_object()
FIREWALL CP: fw_create_noop_feature_object()
%SYS-5-CONFIG_I: Configured from console by console
FIREWALL CP: fw_cp_prot_num_to_name() l4 1, l7 5, gran 0
FIREWALL CP: fw_drop_class_params() action 0x6637A5C0, cmd_params 0x00000000, event 0x40
FIREWALL CP: fw_get_ppm_policy_on_zp() Found ppm policy l4-pmap on zp zp p_type 0x7
The following is sample output from the
debug
policy-firewall
L2-transparent command:
Device# debug policy-firewall L2-transparent
*Apr 4 08:28:23.554: L2FW*:insp_l2_fast_inspection: pak 673DBD90, input-interface FastEthernet1/1, output-interface FastEthernet1/0
*Apr 4 08:28:23.554: L2FW*:Src 17.3.39.1 dst 17.3.39.3 protocol tcp
*Apr 4 08:28:23.554: TBAP: Check AuthProxy is configured on idb=FastEthernet1/1 path=1 linktype=38
*Apr 4 08:28:23.554: L2FW:Input ACL not configured or the ACL is bypassed
*Apr 4 08:28:23.554: L2FW:Output ACL is not configured or ACL is bypassed
*Apr 4 08:28:23.554: L2FW*:IP inspect firewall is not cfged on input or output interface.PASS
*Apr 4 08:28:23.554: L2FW* 2:insp_l2_fast_inspection: pak 673DBD90, input-interface FastEthernet1/1, output-interface FastEthernet1/0
*Apr 4 08:28:23.554: CCE L2 FW
*Apr 4 08:28:23.554: L2FW* -3:insp_l2_fast_inspection: pak 673DBD90, input-interface FastEthernet1/1, output-interface FastEthernet1/0
The following is sample output from the
debug policy-firewall detailed command:
Device# debug policy-firewall detailed
Log Buffer (600000 bytes):
Feb 13 08:40:01: FIREWALL: ret_val 0 is not FW_DP_INSP_PASS_PAK
<snip>
Feb 13 08:41:22: FIREWALL: ret_val 0 is not FW_DP_INSP_PASS_PAK
Feb 13 08:41:24: FIREWALL: ret_val 0 is not FW_DP_INSP_PASS_PAK
Feb 13 08:41:25: FIREWALL*: Searching for FSO in class 0x50793C20class group 0x10000000,
target 0x1, cce class type 0x2B
Feb 13 08:41:25: FIREWALL*: not found
Feb 13 08:41:25: FIREWALL*: Try to create session in fastpath
Feb 13 08:41:25: FIREWALL: Searching for FSO in class 0x50793C20class group 0x10000000,
target 0x1, cce class type 0x2B
Feb 13 08:41:25: FIREWALL: not found
Feb 13 08:41:25: FIREWALL: Create FSO
Feb 13 08:41:25: FIREWALL: sis 204925C0 : fw_dp_state_object_link
Feb 13 08:41:25: FIREWALL: sis 204925C0 : FO class 0x50793C20 class group 0x10000000, target 0x1, FO 0x20255D80
Feb 13 08:41:25: FIREWALL: sis 204925C0 : alert = 1, audit_trail = 0
Feb 13 08:41:25: FIREWALL: sis 204925C0 : l7 protocol 62, granular = 5
Feb 13 08:41:25: FIREWALL: sis 204925C0 : fw_dp_state_object_attach_forward
Feb 13 08:41:25: FIREWALL: sis 204925C0 : fw_dp_state_object_create_and_attach_reverse
Feb 13 08:41:25: FIREWALL: sis 204925C0 : FSO bind success for reverse class 0x50793C80class group 0x10000000, target 0x1
Feb 13 08:41:25: FIREWALL: sis 204925C0 :Session Info :
Feb 13 08:41:25: session->fwfo 0x507E39C0
Feb 13 08:41:25: class type 0x2B, target 0x1, policy id 0x10000000, class id 0x50793C20
Feb 13 08:41:25: class type 0x2B, reverse target 0x1, reverse policy id 0x10000000, reverse class id 0x50793C80
Feb 13 08:41:25: src addr 192.168.3.3, port 36091, vrf id 0
Feb 13 08:41:25: dst addr 192.168.103.3, port 5190, vrf id 0
Feb 13 08:41:25: L4 Protocol : TCP
Feb 13 08:41:25: FIREWALL: sis 204925C0 : L4 inspection returned 3
Feb 13 08:41:25: FIREWALL*: FSO feature object 0x204925C0 found
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : L4 inspection returned 3
Feb 13 08:41:25: FIREWALL*: FSO feature object 0x204925C0 found
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : max_sessions 2147483647; current sessions 0
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : IM : Token set for L7 named-db
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : cce_sb 0x66A5BA00, pak 0x50028974, data_len 0 in_fast_path 1, dir = 1
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : p_app_data = C174268, p_data_len = 6p_offset = 0
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : Found particle offset token, data1 = 0
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : Opening 0 channels for icq
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : icq L7 inspect result: PASS packet
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : L4 inspection returned 3
Feb 13 08:41:25: FIREWALL*: FSO feature object 0x204925C0 found
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : cce_sb 0x66A5BA00, pak 0x5004CAC8, data_len 10 in_fast_path 1, dir = 2
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : p_app_data = C210848, p_data_len = Ap_offset = 0
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : Found particle offset token, data1 = 0
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : Opening 0 channels for icq
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : icq L7 inspect result: PASS packet
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : L4 inspection returned 3
Feb 13 08:41:25: FIREWALL*: FSO feature object 0x204925C0 found
Feb 13 08:41:25: FIREWALL*: sis 204925C0 : cce_sb 0x66A5BA00, pak 0x50028974, data_len 270 in_fast_path 1, dir = 1
The following is sample output from the
debug policy-firewall ha command
Device# debug policy-firewall ha
*May 19 14:17:19.991: FIREWALL: IOS FW RF stat event: status: RF_STATUS_PEER_COMM
my state: STANDBY HOT peer state: ACTIVE
*May 19 14:17:19.995: FIREWALL: IOS FW RF stat event: status: RF_STATUS_PEER_PRESENCE
my state: STANDBY HOT peer state: DISABLED
*May 19 14:17:19.995: FIREWALL: RG with ID:1 state STANDBY: found
*May 19 14:17:19.995: FIREWALL: Event for RG-1: RF_PROG_ACTIVE_FAST
*May 19 14:17:19.995: FIREWALL: RG with ID:1 state ACTIVE: found
*May 19 14:17:19.995: FIREWALL: Standbyhot to Active transition for RG 1
*May 19 14:17:19.995: FIREWALL sis 30CEEF40: Timer Start: Timer: 30CEEFD4 Time: 30000 ms
*May 19 14:17:19.995: FIREWALL: RG 1 trasitioned to Active
*May 19 14:17:19.995: FIREWALL: RG with ID:1 state ACTIVE: found
*May 19 14:17:19.995: FIREWALL: RG with ID:1 state ACTIVE: found
*May 19 14:17:19.995: FIREWALL: RG with ID:1 state ACTIVE: found
May 19 14:17:30.003: FIREWALL: Event for RG-1: RF_PROG_STANDBY_BULK Configuring Zone Based Firewall Redundancy Draft Copy Cisco systems, Inc. Company Confidential
*May 19 14:17:30.003: FIREWALL: ret_val 0 is not PASS_PAK
*May 19 14:17:30.003: FIREWALL: RG with ID:1 state ACTIVE: found
*May 19 14:17:30.003: FIREWALL: Starting BulkSync for RG 1
*May 19 14:17:30.003: FIREWALL sis 30CEEF40: Bulk sync session 30CEEF40 needs to be failed over(add)
*May 19 14:17:30.003: FIREWALL: ret_val 0 is not PASS_PAK
*May 19 14:17:30.003: FIREWALL sis 30CEEF40: Send add session message (192.168.7.205:32424:0)=>(192.168.107.1:23:0) l4_prot tcp
*May 19 14:17:30.003: FIREWALL: BulkSync done; Send BulkEnd