【正文】 de negotiation with a 28800second lifetime.===================================IKE Debug Example, P2 :Initiate===================================IKE Phase 2: Initiated Quick Mode negotiation.IKE Construct ISAKMP header.IKE Construct [HASH]IKE Construct [SA] for IPSECIKE Construct [NONCE] for IPSecIKE Construct [KE] for PFSIKE Construct [ID] for Phase 2IKE Construct [ID] for Phase 2IKE Xmit*: [HASH] [SA] [NONCE] [KE] [ID] [ID]IKE ****** Recv packet if ethernet6 of vsys Root ******IKE Recv*: [HASH] [SA] [NONCE] [KE] [ID] [ID]IKE Process [SA]:IKE Process [KE]:IKE Process [NONCE]:IKE Process [ID]:IKE Process [ID]:IKE Phase 2 msgid 75702632: Completed Quick Mode negotiation with SPI9234d791, tunnel ID 1, and lifetime 3600 seconds/0 KB.IKE Construct ISAKMP header.IKE Construct [HASH] in QMIKE Xmit*: [HASH]=====================================IKE Debug Example, P1 :Responser=====================================IKE ****** Recv packet if ethernet6 of vsys Root ******IKE Recv : [SA] [VID] [VID]IKE Process [VID]:IKE Process [VID]:IKE Process [SA]:IKE Construct ISAKMP header.IKE Construct [SA] for ISAKMPIKE Construct NetScreen [VID]IKE Construct custom [VID]IKE Xmit : [SA] [VID] [VID]IKE ****** Recv packet if ethernet6 of vsys Root ******IKE Recv : [KE] [NONCE]IKE Process [KE]:IKE Process [NONCE]:IKE Construct ISAKMP header.IKE Construct [KE] for ISAKMPIKE Construct [NONCE]IKE Xmit : [KE] [NONCE]IKE ****** Recv packet if ethernet6 of vsys Root ******IKE Recv*: [ID] [HASH]IKE Process [ID]:IKE Process [HASH]:IKE Construct ISAKMP header.IKE Construct [ID] for ISAKMPIKE Construct [HASH]IKE Xmit*: [ID] [HASH]IKE Phase 1: Completed Main mode negotiation with a 28800second lifetime.======================================IKE Debug Example, P2 :Responser======================================IKE ****** Recv packet if ethernet6 of vsys Root ******IKE Recv*: [HASH] [SA] [NONCE] [KE] [ID] [ID]IKE Process [SA]:IKE Process [KE]:IKE Process [NONCE]:IKE Process [ID]:IKE Process [ID]:IKE Construct ISAKMP header.IKE Construct [HASH]IKE Construct [SA] for IPSECIKE Construct [NONCE] for IPSecIKE Construct [KE] for PFSIKE Construct [ID] for Phase 2IKE Construct [ID] for Phase 2IKE Xmit*: [HASH] [SA] [NONCE] [KE] [ID] [ID]IKE ****** Recv packet if ethernet6 of vsys Root ******IKE Recv*: [HASH]IKE Phase 2 msgid 75702632: Completed Quick Mode negotiation with SPISNOOP 范例：ns5gt snoop ?returndetail snoop detail configurationfilter snoop filter configurationinfo show snoop informationoff turn off snoop?? Note: Snoop uses an AND algorithm in the filter.ns5gt snoop filter ?delete delete snoop filterethernet snoop specified ethernetid snoop filter idip snoop ip packetoff turn off snoop filteron turn on snoop filtertcp snoop tcp packetudp snoop udp packet配置例子：ns5gt snoop infoSnoop: ONFilters Defined: 2, Active Filters 2Detail: OFF, Detail Display length: 96Snoop filter based on:id 1(on): IP srcip dstip dir(B)id 2(on): IP srcip dstip dir(B)ns5gt get db s: 2(i):000ae6f2ad4f0010db3b84e2/0800, tlen=60vhl=45, tos=00, id=15610, frag=0000, ttl=128icmp:type=8, code=0: 1(o):0010db3b84e1080020fdb2e7/0800, tlen=60vhl=45, tos=00, id=15610, frag=0000, ttl=127icmp:type=8, code=0: 1(i):080020fdb2e70010db3b84e1/0800, tlen=60vhl=45, tos=00, id=49050, frag=4000, ttl=255icmp:type=0, code=0: 2(o):0010db3b84e2000ae6f2ad4f/0800, tlen=60vhl=45, tos=00, id=49050, frag=4000, ttl=254icmp:type=0, code=01 = untrust interface 2 = trust interface(i) = ining (o) = outgoing: 1(o):0010db3b84e1ffffffffffff/0806q 0010db3b84e1/: 1(i):00121e0334200010db3b84e1/0806r 00121e033420/1 = untrust interface 2 = trust interface(i) = ining (o) = outgoing六、 Juniper防火墻設(shè)備恢復處理方法為防止Juniper防火墻設(shè)備故障情況下造成網(wǎng)絡(luò)中斷，保障用戶業(yè)務(wù)不間斷運行，現(xiàn)針對Juniper防火墻故障情況下的快速恢復做具體描述。 Juniper防火墻在工作期間出現(xiàn)運行異常時，如需進行系統(tǒng)復位，可通過console線纜使用reset命令對防火墻進行重啟，重啟動期間可以在操作終端上查看防火墻相關(guān)啟動信息。 日常維護期間可將防火墻操作系統(tǒng)ScreenOS備份到本地設(shè)備，操作方式為：啟動tftp 服務(wù)器并在命令行下執(zhí)行：save software from flash to tftp filename。 當防火墻工作發(fā)生異常時，可通過兩種方式快速恢復防火墻操作系統(tǒng)： 1) 命令行方式：save software from tftp filename to flash； 2) web方式：Configuration Update ScreenOS/Keys下選中Firmware Update (ScreenOS)選項，并在Load File欄選中保存在本地的ScreenOS文件，然后點擊apply按鈕，上傳ScreenOS后防火墻將自動進行重啟。 正常維護期間可將防火墻配置信息備份到本地以便于故障時的恢復，操作方式有三種： 1) 啟動tftp 服務(wù)器并在命令行下執(zhí)行：save config from flash to tftp filename。 2) 通過超級終端遠程telnet/ssh到防火墻，通過log記錄方式將get config配置信息記錄到本地。 3) 通過web頁面進行配置文件備份：Configuration Update Config File，點擊save to file。 防火墻當前配置信息若存在錯誤，需進行配置信息快速恢復，操作方式有三種： 1) tftp 服務(wù)器并在命令行下執(zhí)行：save config from tftp filename to flash，配置文件上傳后需執(zhí)行reset命令進行重啟。 2) 通過web頁面進行配置文件恢復：Configuration Update Config File，選中Replace Current Configuration，并從本地設(shè)備中選中供恢復的備份配置文件，點擊apply后系統(tǒng)將進行重啟動使新配置生效。 3) 超級終端遠程telnet/ssh到防火墻，通過unset all 命令清除防火墻配置，并進行重啟，重啟后將備份的配置命令粘貼到防火墻中。 console線纜連接到防火墻，通過reset命令對防火墻進行重啟，并使用防火墻的16位序列號作為賬號/口令進行登陸，可將防火墻配置快速恢復為出廠值。（注意保存配置） 當防火墻出現(xiàn)故障時，且已經(jīng)排除配置故障和ScreenOS軟件故障，可通過NSRP切換到備用設(shè)備來恢復網(wǎng)絡(luò)運行，并進一步定位硬件故障。切換方式為 拔掉主用防火墻的上下行網(wǎng)線（僅在設(shè)備關(guān)閉電源的情況下，才需要拔掉該設(shè)備的HA連線），防火墻將自動進行主備切換。或在主用設(shè)備上執(zhí)行：exec nsrp vsdgroup id 0 mode backup,手動執(zhí)行防火墻主備切換。 （RMA）如經(jīng)Juniper公司確認防火墻發(fā)生硬件故障，請及時聯(lián)系設(shè)備代理商。設(shè)備代理商將根據(jù)報修流程，由Juniper公司對保修期內(nèi)的損壞部件或設(shè)備進行RMA（設(shè)備返修）。73