pCyzQq,防火墙RBM+静态路由双主，同一个NAT下，内网部分服务器访问同一台外网服务器业务不通。

1678375365,CRM论坛（CRMbbs.com）——一个让用户更懂CRM的垂直性行业内容平台,CRM论坛致力于互联网、客户管理、销售管理、SCRM私域流量内容输出5年。 如果您有好的内容，欢迎向我们投稿，共建CRM多元化生态体系，创建CRM客户管理一体化生态解决方案。内容来源：知了社区

问题描述：

 防火墙1

NAT address-group 179 name for_byzoro1 address 134.84.76.179 134.84.76.179 #

 nat remote-backup port-alloc primary#

 object-group ip address 179 1 network range 172.18.5.3 172.18.5.6 #

 interface Route-Aggregation1 ip address 192.168.101.2 255.255.255.252 nat outbound

 acl basic

防火墙2

nat address-group 179 name for_byzoro1 address 134.84.76.179 134.84.76.179 #

 nat remote-backup port-alloc secondary#

 object-group ip address 179 1 network range 172.18.5.3 172.18.5.6 #

 interface Route-Aggregation1 ip address 192.168.101.2 255.255.255.252 nat outbound

 acl basic

故障现象：172.18.5.6 访问134.64.49.80的业务不通，但可以ping通；172.18.5.3 、172.18.5.4访问134.64.49.80正常

dis session table ipv4 source-ip 172.18.5.6 destination-ip 134.64.49.80 verbose Slot 1: Initiator: Source IP/port: 172.18.5.6/60

dis session table ipv4 source-ip 172.18.5.3 destination-ip 134.64.49.80 verbose Slot 1: Initiator: Source IP/port: 172.18.5.3/50472 Destination IP/port: 134.64.49.80/8088 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- Protocol: TCP(6) Inbound interface: Route-Aggregation2 Source security zone: Trust Responder: Source IP/port: 134.64.49.80/8088 Destination IP/port: 134.84.76.179/44792 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- Protocol: TCP(6) Inbound interface: Route-Aggregation1 Source security zone: Untrust State: TCP_ESTABLISHED Application: GENERAL_TCP Rule ID: 1 Rule name: trust-untrust Start time:

RBM_P<F5000-1>dis session table ipv4 source-ip 172.18.5.4 destination-ip 134.64.49.80 verbose Slot 1: Initiator: Source IP/port: 172.18.5.4/39708 Destination IP/port: 134.64.49.80/8088 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- Protocol: TCP(6) Inbound interface: Route-Aggregation2 Source security zone: Trust Responder: Source IP/port: 134.64.49.80/8088 Destination IP/port: 134.84.76.179/44831 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- Protocol: TCP(6) Inbound interface: Route-Aggregation1 Source security zone: Untrust State: TCP_ESTABLISHED Application: GENERAL_TCP Rule ID: 1 Rule name: trust-untrust Start time:

组网及组网描述：

10小时前提问

看着是发出去了没回应。可写4条acl抓包和debug看看。

10小时前回答

暂无

你正在,防火墙RBM+静态路由双主，同一个NAT下，内网部分服务器访问同一台外网服务器业务不通。