Difference between revisions of "Useful commands"
| Line 6: | Line 6: | ||
Sample log filter to use in GUI: | Sample log filter to use in GUI: | ||
(addr.src in 192.168.1.10) and (port.dst eq 21) | (addr.src in 192.168.1.10) and (port.dst eq 21) | ||
| + | |||
| + | Getting system information: | ||
| + | show system info | ||
| + | show system software status | ||
Getting performance status: | Getting performance status: | ||
| Line 40: | Line 44: | ||
To validate if the candidate version is consistent (validating syntax and semantics): | To validate if the candidate version is consistent (validating syntax and semantics): | ||
validate full | validate full | ||
| + | |||
| + | To commit even with errors: | ||
| + | commit force | ||
| + | |||
| + | Troubleshoot IPSec VPN issues: | ||
| + | debug ike global on debug | ||
| + | less mp--log ikemgr.log | ||
If your GUI is presenting some slowness, you can restart the management plane with no impact in your traffic: | If your GUI is presenting some slowness, you can restart the management plane with no impact in your traffic: | ||
Revision as of 01:59, 12 July 2016
Executing ping:
ping host xxx.xxx.xxx.xxx
Sample log filter to use in GUI:
(addr.src in 192.168.1.10) and (port.dst eq 21)
Getting system information:
show system info show system software status
Getting performance status:
show system statistics session show system resources show running resource-monitor
Display routing table:
show routing route
To get MAC address:
show interface all show arp all
Validate if specified traffic will match any firewall/nat rule
test security-policy-match from trust to untrust source 10.4.70.48 destination 200.1.2.100 destination-port 80 protocol 6 test nat-policy-match source 10.1.0.1 destination 200.1.2.100 destination-port 21 protocol 6
To view current host objects based on FQDN or to update the list:
request system fqdn show request system fqdn refresh force yes
Display current connections through the firewall and get detailed info for a specific one:
show session all filter state active show session id xxxxx
To commit the candidate version of configuration:
commit partial vsys vsys1 device-and-network excluded
Check pending changes:
Click on the Device tab > Config audit Select a candidate config on the right
To validate if the candidate version is consistent (validating syntax and semantics):
validate full
To commit even with errors:
commit force
Troubleshoot IPSec VPN issues:
debug ike global on debug less mp--log ikemgr.log
If your GUI is presenting some slowness, you can restart the management plane with no impact in your traffic:
debug software restart management-server
If you are experiencing Commit slowness or failed, you can also restart the management plane with no impact in your traffic:
debug software restart device-server debug software restart log-receiver
Performing a packet capture (sniffering)
debug dataplane packet-diag clear filter all debug dataplane packet-diag clear capture all debug dataplane packet-diag set filter match source 10.1.1.100 destination 200.1.1.100 debug dataplane packet-diag set filter match destination-port 80 debug dataplane packet-diag set filter on debug dataplane packet-diag show setting debug dataplane packet-diag set capture stage transmit file filename_transmit debug dataplane packet-diag set capture stage receive file filename_receive debug dataplane packet-diag set capture stage firewall file filename_firewall debug dataplane packet-diag set capture stage drop file filename_drop
debug dataplane packet-diag set capture on
view-pcap filter-pcap filename_firewall view-pcap follow yes filter-pcap filename_transmit
debug dataplane packet-diag set capture off debug dataplane packet-diag set filter off