IPTables (firewall)

From DocWiki

(Difference between revisions)
Jump to: navigation, search
m (1 revision)
m (Moved content to CCO. Created redirect.)
 
Line 1: Line 1:
-
'''Indication:'''
+
----
-
Traffic/communication issue on a specific port.
+
-
'''Problem:'''
+
=== <br> <br> '''This content has moved!'''<br>  ===
-
Firewall could be blocking port.
+
-
First step is to verify the port information is shown (using CLI or GUI) and that its status is correct. Information about IPTables (firewall) could be obtained through following ways:-
+
'''Its new location is:&nbsp; [https://docs.cisco.com/share/page/site/nextgen-edcs/documentlibrary?file=uccx_b_unified-ccx-db-schema-guide.pdf#filter=path%7C%2FEngineering%2FCCBU%2FUnified_CCX%2FUnified%2520CCX%2520Troubleshooting%2520Tips%7C&page=1 https://docs.cisco.com/share/page/site/nextgen-edcs/documentlibrary?file=uccx_b_unified-ccx-db-schema-guide.pdf#filter=path%7C%2FEngineering%2FCCBU%2FUnified_CCX%2FUnified%2520CCX%2520Troubleshooting%2520Tips%7C&page=1]'''
-
''GUI''
+
'''Please update your bookmark.'''
-
Cisco Unified OS Administration
+
-
  Show->IP Preferences
+
-
''CLI''
+
-
show network ipprefs
+
-
  show network ipprefs all
+
-
  show network ipprefs enabled
+
-
  show network ipprefs public
+
-
 
+
-
Next, verify the port is shown in the firewall rules.  Use the CLI command “utils firewall list”.  Note, if the port is not shown in the list it is being blocked.
+
-
You can verify ports are being blocked by the firewall by turning on the debug mode in the firewall.  Use the CLI command “utils firewall debug”.  This will cause iptables to log every packet it blocks.
+
-
 
+
-
There are logs that detail when changes to the firewall or changes to the port information occur:
+
-
 
+
-
syslog/messages – iptables log
+
-
 
+
-
syslog/secure – will show changes to port information (such as when a port is enabled/disabled).
+
-
 
+
-
Note, the syslog logs are available via RTMT. Same can also be obtained via CLI, following are the commands:-
+
-
file get activelog syslog/messages
+
-
file get activelog syslog/secure
+
-
 
+
-
Note, we throttle the log messages going into the log.  So, if there are lots of packets getting blocked, we might not log all instances.
+
-
Example from syslog messages log:
+
-
Aug  4 10:32:23 bldr-ccm23 kern 4 kernel: dropped packet IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0f:20:6c:a0:c5:08:00 SRC=10.94.150.77 DST=255.255.255.255 LEN=328 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=67 DPT=68 LEN=308
+
-
Aug  4 10:32:25 bldr-ccm23 kern 4 kernel: dropped packet IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0e:7f:b4:3f:52:08:00 SRC=10.94.150.72 DST=10.94.150.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=57931 PROTO=UDP SPT=137 DPT=137 LEN=58
+
-
 
+
-
As a last resort you can temporarily disable the firewall by using the CLI command “utils firewall disable”.
+
-
Note, both the disable and debug mode of the firewall will automatically revert back after a default of 5 minutes.  This time can be extended to a maximum of 24 hours.
+
-
 
+
-
 
+
-
[[Category:Unified_CCX,_Release_8.0]] [[Category:Unified_CCX,_Release_8.5]]
+

Latest revision as of 19:58, 13 September 2017




This content has moved!

Its new location is:  https://docs.cisco.com/share/page/site/nextgen-edcs/documentlibrary?file=uccx_b_unified-ccx-db-schema-guide.pdf#filter=path%7C%2FEngineering%2FCCBU%2FUnified_CCX%2FUnified%2520CCX%2520Troubleshooting%2520Tips%7C&page=1

Please update your bookmark.

Rating: 3.0/5 (2 votes cast)

Personal tools