SecBlade IV NGFW(IM-NGFWX-IV）升級版本後出現丟包

現場兩個防火牆模塊插在兩台SR8804X上，做的IRF加冗餘組，從8560p40升級至 9660p51，發現模塊直連PING路由器有丟包

讓現場寫ACLweb頁麵抓包，然後ping測試

測試Ping34個包，命令行上顯示有丟包，但是抓包文件裏34個包有發有收

在防火牆上debug ip packet和aspf，發現隻有IPFW_PACKET，沒有aspf的debug回顯

查看驅動丟包和單核cpu使用情況：

dis process cpu slot 1 | in kdr

       486 0.0% 0.0% 0.0% [kdrvBoardTsk0]

       487 0.0% 0.0% 0.0% [kdrvdp0]

       488 0.0% 0.0% 0.0% [kdrvdp1]

       489 0.0% 0.0% 0.0% [kdrvdp2]

       490 0.0% 0.0% 0.0% [kdrvdp3]

       491 0.0% 0.0% 0.0% [kdrvdp4]

       492 0.0% 0.0% 0.0% [kdrvdp5]

       493 0.0% 0.0% 0.0% [kdrvdp6]

       494 0.0% 0.0% 0.0% [kdrvdp7]

       495 0.0% 0.0% 0.0% [kdrvdp8]

       496 0.0% 0.0% 0.0% [kdrvdp9]

       497 0.0% 0.0% 0.0% [kdrvdp10]

       498 0.0% 0.0% 0.0% [kdrvdp11]

       499 0.0% 0.0% 0.0% [kdrvdp12]

       500 0.0% 0.0% 0.0% [kdrvdp13]

       501 0.0% 0.0% 0.0% [kdrvdp14]

       502 0.0% 0.0% 0.0% [kdrvdp15]

       503 0.0% 0.0% 0.0% [kdrvdp16]

       504 0.0% 0.0% 0.0% [kdrvdp17]

       505 0.0% 0.0% 0.0% [kdrvdp18]

       506 0.0% 0.0% 0.0% [kdrvdp19]

       507 0.0% 0.0% 0.0% [kdrvdp20]

       508 0.0% 0.0% 0.0% [kdrvdp21]

       509 0.0% 0.0% 0.0% [kdrvdp22]

       510 0.0% 0.0% 0.0% [kdrvdp23]

       511 0.0% 0.0% 0.0% [kdrvdp24]

       512 0.0% 0.0% 0.0% [kdrvdp25]

       513 0.0% 0.0% 0.0% [kdrvdp26]

       514 0.0% 0.0% 0.0% [kdrvdp27]

       515 0.0% 0.0% 0.0% [kdrvdp28]

       516 0.0% 0.0% 0.0% [kdrvdp29]

       517 0.0% 0.0% 0.0% [kdrvdp30]

       518 0.0% 0.0% 0.0% [kdrvdp31]

       519 0.0% 0.0% 0.0% [kdrvdp32]

       520 0.0% 0.0% 0.0% [kdrvdp33]

       521 0.0% 0.0% 0.0% [kdrvdp34]

       522 0.0% 0.0% 0.0% [kdrvdp35]

       523 0.0% 0.0% 0.0% [kdrvdp36]

       524 0.0% 0.0% 0.0% [kdrvdp37]

       525 0.0% 0.0% 0.0% [kdrvdp38]

       526 0.0% 0.0% 0.0% [kdrvdp39]

       527 0.0% 0.0% 0.0% [kdrvdp40]

       528 0.0% 0.0% 0.0% [kdrvdp41]

       529 0.0% 0.0% 0.0% [kdrvdp42]

       530 0.0% 0.0% 0.0% [kdrvdp43]

       531 0.0% 0.0% 0.0% [kdrvdp44]

       532 0.0% 0.0% 0.0% [kdrvdp45]

       533 0.0% 0.0% 0.0% [kdrvdp46]

       534 0.0% 0.0% 0.0% [kdrvdp47]

       535 0.0% 0.0% 0.0% [kdrvDataSync0]

       542 0.0% 0.0% 0.0% [kdrvtxtemp0]

       544 0.0% 0.0% 0.0% [kdrvlink0]

現場主備倒換和重啟測試，問題依舊

在路由器側ping防火牆，同時抓包和debug，發現防火牆少回了幾個包

現場回退版本後就沒有問題

升級版本後ping丟包是因為copp限速導致，P51版本合入了copp限速功能，但是因為限速控製存在優化差異導致現場出現copp限速丟包，可以在升級版本後開啟一個traffic qos策略。

Traffic class test

if-match control-plane protocol arp icmp http  

Traff behave test

  Packet-rate 10000(pps)

Qos policy test

 Class test behavior test

Control-plane slot 1 

  Qos apply policy test inbound

也可以等一下後麵的100分支版本再進行升級

可以在升級版本後開啟一個traffic qos策略。

Traffic class test

if-match control-plane protocol arp icmp http  

Traff behave test

  Packet-rate 10000(pps)

Qos policy test

 Class test behavior test

Control-plane slot 1 

  Qos apply policy test inbound

也可以等一下後麵的100分支版本再進行升級