[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Verifying the Output of ALG Sessions

This section contains examples of successful output from ALG sessions and information on system log configuration. You can compare the results of your sessions to check whether the configurations are functioning correctly.

FTP Example

This example analyzes the output during an active FTP session. It consists of four different flows; two are control flows and two are data flows. The example consists of the following parts:

Sample Output

The following is a complete sample output from the show services stateful-firewall conversations application-protocol ftp operational mode command:


user@host>show services stateful-firewall conversations application-protocol ftp
Interface: sp-1/3/0, Service set: CLBJI1-AAF001
Conversation: ALG protocol: ftp
  Number of initiators: 2, Number of responders: 2
Flow                                                State    Dir       Frm count
TCP           1.1.79.2:14083 ->        2.2.2.2:21    Watch    I              13
    NAT source        1.1.79.2:14083   ->   194.250.1.237:50118   
TCP           1.1.79.2:14104 ->        2.2.2.2:20    Forward  I               3
    NAT source        1.1.79.2:14104   ->   194.250.1.237:50119   
TCP            2.2.2.2:21    ->  194.250.1.237:50118 Watch    O              12
    NAT dest     194.250.1.237:50118   ->        1.1.79.2:14083   
TCP            2.2.2.2:20    ->  194.250.1.237:50119 Forward  O               5
    NAT dest     194.250.1.237:50119   ->        1.1.79.2:14104

For each flow, the first line shows flow information, including protocol (TCP), source address, source port, destination address, destination port, flow state, direction, and frame count.

The second line shows the NAT information.

FTP System Log Messages

System log messages are generated during an FTP session. For more information about system logs, see System Log Messages.

The following system log messages are generated during creation of the FTP control flow:

Analysis

Control Flows

The control flows are established after the three-way handshake is complete.

Data Flows

A data port of 20 is negotiated for data transfer during the course of the FTP control protocol. These two flows are data flows between the FTP client and the FTP server: 

TCP           1.1.79.2:14104 ->        2.2.2.2:20    Forward  I               3
    NAT source        1.1.79.2:14104   ->   194.250.1.237:50119
TCP            2.2.2.2:20    ->  194.250.1.237:50119 Forward  O               5
    NAT dest     194.250.1.237:50119   ->        1.1.79.2:14104

Troubleshooting Questions

  1. How do I know if the FTP ALG is active?
  2. What do I need to check if the FTP connection is established but data transfer does not take place?
  3. How do I interpret each flow? What does each flow mean?

RTSP ALG Example

The following is an example of an RTSP conversation. The RealAudio application uses the RTSP protocol for control connection. Once the connection is set up, the media is sent using UDP protocol (RTP).

This example consists of the following:

Sample Output

Here is the output from the show services stateful-firewall conversations operational mode command:


user@host# show services stateful-firewall conversations
Interface: sp-3/2/0, Service set: svc_set
Conversation: ALG protocol: rtsp
  Number of initiators: 5, Number of responders: 5
Flow                                                State    Dir       Frm count
TCP            1.1.1.3:58795 ->        2.2.2.2:554   Watch    I               7
UDP            1.1.1.3:1028  ->        2.2.2.2:1028  Forward  I               0
UDP            1.1.1.3:1029  ->        2.2.2.2:1029  Forward  I               0
UDP            1.1.1.3:1030  ->        2.2.2.2:1030  Forward  I               0
UDP            1.1.1.3:1031  ->        2.2.2.2:1031  Forward  I               0
TCP            2.2.2.2:554   ->        1.1.1.3:58795 Watch    O               5
UDP            2.2.2.2:1028  ->        1.1.1.3:1028  Forward  O               6
UDP            2.2.2.2:1029  ->        1.1.1.3:1029  Forward  O               0
UDP            2.2.2.2:1030  ->        1.1.1.3:1030  Forward  O               3
UDP            2.2.2.2:1031  ->        1.1.1.3:1031  Forward  O               0

Analysis

An RTSP conversation should consist of TCP flows corresponding to the RTSP control connection. There should be two flows, one in each direction, from client to server and from server to client: 

TCP            1.1.1.3:58795 ->        2.2.2.2:554   Watch    I               7
TCP            2.2.2.2:554   ->        1.1.1.3:58795 Watch    O               5

The UDP flows correspond to RTP media sent over the RTSP connection.

Troubleshooting Questions

  1. Media does not work when the RTSP ALG is configured. What do I do?

    Note: The state of the flow is displayed as Watch, because the ALG processing is taking place and the client is essentially “watching” or processing payload corresponding to the application. For FTP and RTSP ALG flows, the control connections are always Watch flows.

  2. How do I check for ALG errors?

System Log Messages

Enabling system log generation and checking the system log are also helpful for ALG flow analysis. This section contains the following:

System Log Configuration

You can configure the enabling of system log messages at a number of different levels in the JUNOS CLI. As shown in the following sample configurations, the choice of level depends on how specific you want the event logging to be and what options you want to include. For details on the configuration options, see the JUNOS System Basics Configuration Guide (system level) or the JUNOS Services Interfaces Configuration Guide (all other levels).

  1. At the topmost global level:
    user@host# show system syslog
    file messages {
    any any;
    }
  2. At the AS PIC level:
    user@host# show interfaces sp-3/2/0
    services-options {
    syslog {
    host local {
    services any;
    }
    }
    open-timeout 3600;
    inactivity-timeout 3600;
    }
    unit 0 {
    family inet;
    }
  3. At the service set level:
    user@host# show services service-set svc_set
    syslog {
    host local {
    services any;
    }
    }
    stateful-firewall-rules allow_rtsp;
    interface-service {
    service-interface sp-3/2/0;
    }
  4. At the service rule level:
    user@host# show services stateful-firewall rule allow_rtsp
    match-direction input-output;
    term 0 {
    from {
    applications junos-rtsp;
    }
    then {
    accept;
    syslog;
    }
    }

System Log Output

System log messages are generated during flow creation, as shown in the following examples:

The following system log message indicates that the ASP matched an accept rule:

Oct 25 16:11:37 (FPC Slot 3, PIC Slot 2) {svc_set}[FWNAT]: ASP_SFW_RULE_ACCEPT: proto 6 (TCP) application: rtsp, ge-2/0/1.0:1.1.1.2:35595 -> 2.2.2.2:554, Match SFW accept rule-set: , rule: allow_rtsp, term: 0

The following system log message indicates that the AS PIC created a valid flow:

Oct 25 16:11:37 (FPC Slot 3, PIC Slot 2) {svc_set}[FWNAT]: ASP_SFW_CREATE_ACCEPT_FLOW: proto 6 (TCP) application: rtsp, ge-2/0/1.0:1.1.1.2:35595 -> 2.2.2.2:554, creating forward or watch flow

The following system log message indicates that the packet did not match any rule on the AS PIC:

Oct 25 16:03:13 (FPC Slot 3, PIC Slot 2) {svc_set}[FWNAT]: ASP_SFW_NO_RULE_DROP: proto 17 (UDP), ge-2/0/3.0:2.2.2.2:1334 -> 1.1.1.78:1334, No matching SFW rule

If the AS PIC does not create data flows and starts receiving data, this message is logged. It represents an error condition for ALG processing.

For a complete listing of system log messages, see the JUNOS System Log Messages Reference.

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

[an error occurred while processing this directive]