Verifica

Verifica

BIG-IP

Tunnel

Eseguire su ciascuna unità per i propri tunnel:

tmsh

show net tunnels tunnel xc-ddos-c1t1-v4
show net tunnels tunnel xc-ddos-c1t1-v6
show net tunnels tunnel xc-ddos-c1t2-v4
show net tunnels tunnel xc-ddos-c1t2-v6
show net tunnels tunnel xc-ddos-c2t1-v4
show net tunnels tunnel xc-ddos-c2t1-v6
show net tunnels tunnel xc-ddos-c2t2-v4
show net tunnels tunnel xc-ddos-c2t2-v6
list net tunnels tunnel xc-ddos-c1t1-v4 all-properties

IP autonomi

tmsh

list net self xc-ddos-*

Verifica del percorso

Da ciascuna unità:

tmsh

# BIG-IP-A tunnels
ping xXC_C1_T1_INNER_V4x source xBIGIP_C1_T1_INNER_V4x
ping xXC_C2_T1_INNER_V4x source xBIGIP_C2_T1_INNER_V4x

# BIG-IP-B tunnels
ping xXC_C1_T2_INNER_V4x source xBIGIP_C1_T2_INNER_V4x
ping xXC_C2_T2_INNER_V4x source xBIGIP_C2_T2_INNER_V4x

BGP

In imish su ciascuna unità:

imish

show ip bgp summary
show ipv6 bgp summary
show ip bgp
show ipv6 bgp

# BIG-IP-A neighbors
show ip bgp neighbors xXC_C1_T1_INNER_V4x
show ip bgp neighbors xXC_C2_T1_INNER_V4x
show ip bgp neighbors xXC_C1_T1_INNER_V4x advertised-routes
show ip bgp neighbors xXC_C1_T1_INNER_V4x received-routes

# BIG-IP-B neighbors
show ip bgp neighbors xXC_C1_T2_INNER_V4x
show ip bgp neighbors xXC_C2_T2_INNER_V4x
show ip bgp neighbors xXC_C1_T2_INNER_V4x advertised-routes
show ip bgp neighbors xXC_C1_T2_INNER_V4x received-routes

show ip route
show ipv6 route

Lista di controllo per la risoluzione dei problemi

Se BGP non si stabilisce:

1. Verificare che il tunnel GRE sia attivo: show net tunnels tunnel dovrebbe mostrare lo stato up.
2. Confermare che allow-service includa tcp:179 sull’IP autonomo interno.
3. Eseguire il ping dell’IP interno remoto attraverso il tunnel.
4. Verificare che la password BGP corrisponda su entrambi i lati (causa comune di errori NOTIFICATION).
5. Verificare che le prefix-list e le route-map siano applicate correttamente.
6. Controllare show ip bgp neighbors <IP> per l’ultimo errore/motivo di reset.
7. Su ciascuna unità HA, verificare che i tunnel dell’unità stessa siano attivi e che i propri vicini BGP siano configurati (non quelli dell’altra unità).

Console XC

Accedere a DDoS and Transit Services > DDoS Protection > Visibility per visualizzare:

• Traffico per rete, zona, applicazione.
• Traffico bloccato rispetto a quello consentito.
• Dettagli degli attacchi e azioni di scrubbing.