问题描述
针对防火墙IPSec业务不通或业务丢包问题，防火墙如何做流量统计、远程抓包、报文示踪
解决方案
1）配置流统和远程抓包用的ACL；
system[sysname] acl 3555[sysname-acl-adv-3555] rule permit icmp source 10.82.100.215 0 destination 10.65.32.204 0[sysname-acl-adv-3555] rule permit icmp source 10.65.32.204 0 destination 10.82.100.215 0[sysname-acl-adv-3555] rule permit ip source X.X.X.X 0 destination Y.Y.Y.Y 0 -X.X.X.X是IKE协商本端地址，Y.Y.Y.Y是IKE协商对端地址[sysname-acl-adv-3555] rule permit ip source Y.Y.Y.Y 0 destination X.X.X.X 0[sysname-acl-adv-3555] quit
2）查看会话：
[sysname] display firewall session table verbose source inside 10.82.100.215 destination inside 10.65.32.204[sysname] display firewall session table verbose source inside Y.Y.Y.Y[sysname] display firewall session table verbose source inside 10.82.100.215 destination inside 10.65.32.204[sysname] diagnose[sysname-diagnose] display firewall session table detail source inside 10.82.100.215 destination inside 10.65.32.204[sysname] display ipsec sa remote Y.Y.Y.Y
3）流量统计：
[sysname] diagnose[sysname-diagnose] reset firewall statistics acl all[sysname-diagnose] firewall statistics acl 3555 enable[sysname-diagnose] display firewall statistics acl[sysname-diagnose] undo firewall statistics acl[sysname-diagnose] reset firewall statistics acl all
4）远程抓包：
system[sysname] packet-capture ipv4-packet 3555 interface Eth-Trunk1[sysname] packet-capture ipv4-packet 3555 interface GigabitEthernet1/0/7[sysname] packet-capture startup packet-len 1500 packet-num 1000[sysname] packet-capture queue 0 to-file 111.cap[sysname] undo packet-capture
5）报文示踪：
terminal debuggingterminal monitordebugging dataplane trace acl 3555 number 10undo terminal debuggingundo terminal monitorundo debugging all
