我最近购买了 Juniper SRX 210BE；到目前为止我一直在使用 Cisco ASA 5505，但我真的想转换到 Juniper 世界（FreeBSD 的忠实粉丝等等）。
我有 FTTC（光纤到网）互联网接入，该接入进入调制解调器，将 VDSL 信号转换为以太网，然后我从调制解调器使用以太网电缆连接 Juniper，并在 Juniper 上执行 PPPoE 身份验证。
一切正常，但是...根据 ping 和 traceroute，我遇到了严重的数据包丢失。真正奇怪的是，这个 PL 似乎只出现在 ICMP / traceroute 消息上，而且不是永久的，而是间歇性的。例如。我会丢失 10 个数据包，然后它会在大约 40 秒内没问题，然后又会出现一次 PL 突发。
PL 包括第一跳，即 Juniper 本身！请参见下文。
Host Loss% Snt Last Avg Best Wrst StDev
1. 10.17.17.62 29.3% 454 1.3 1.5 0.9 21.6 1.7
2. 109.224.191.50 13.2% 453 14.8 17.3 14.5 111.8 9.0
3. 149.6.9.170 12.8% 453 15.3 18.5 14.5 149.1 13.2
4. gi8-10.mag01.lhr01.atlas.cogentco.com 13.7% 453 15.4 25.8 14.6 218.9 33.1
5. te0-5-0-5.rcr21.lhr01.atlas.cogentco.com 12.6% 453 16.3 17.5 15.0 69.7 6.5
6. be2040.ccr41.lon13.atlas.cogentco.com 13.5% 453 16.7 17.9 16.0 72.4 4.9
7. be2194.ccr41.ams03.atlas.cogentco.com 12.6% 453 23.9 25.8 23.4 74.6 6.1
8. be2186.ccr41.ham01.atlas.cogentco.com 12.8% 453 33.7 35.6 32.5 94.6 8.3
9. be2147.rcr21.ber01.atlas.cogentco.com 13.7% 453 36.9 39.8 36.2 104.3 9.1
10. te3-1.ccr01.poz01.atlas.cogentco.com 13.2% 453 41.1 58.7 40.4 251.0 41.1
11. 149.6.28.22 13.2% 453 48.8 52.0 46.8 126.8 9.9
12. 81.210.127.195 13.5% 453 55.7 57.6 53.0 110.2 8.4
13. 83.238.250.131 38.9% 453 52.6 54.4 51.7 98.0 5.8
14. GdynR005RT01-RedaR001RT01.inetia.pl 17.9% 453 53.5 54.8 52.4 93.4 5.9
15. ???
16. rtr4.rtr-int-1.adm.wp-sa.pl 13.7% 453 55.5 57.3 54.7 120.9 6.8
17. www.wp.pl 13.5% 453 55.3 56.8 54.5 111.9 6.3
10.17.17.62 是 Juniper 的内部 IP —— 多么奇怪啊，不是吗？该配置与原有配置基本一致，配置了 PPPoE 身份验证和 NAT。见下文：
## Last commit: 2014-10-17 23:19:14 BST by root
version 12.1X44-D40.2;
system {
time-zone Europe/London;
root-authentication {
encrypted-password "xxx"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http {
interface vlan.16;
}
https {
system-generated-certificate;
interface vlan.16;
}
}
dhcp {
domain-name lon.domain;
pool 10.17.17.0/26 {
address-range low 10.17.17.32 high 10.17.17.55;
default-lease-time 7200;
name-server {
8.8.8.8;
8.8.4.4;
}
router {
10.17.17.62;
}
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
interfaces {
interface-range interfaces-trust {
member ge-0/0/1;
member fe-0/0/3;
member fe-0/0/4;
member fe-0/0/5;
member fe-0/0/6;
member ge-0/0/0;
member fe-0/0/2;
unit 0 {
family ethernet-switching;
}
}
ge-0/0/0 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/1 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/2 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/3 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/4 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/5 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/6 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/7 {
unit 0 {
encapsulation ppp-over-ether;
}
}
pp0 {
traceoptions {
flag all;
}
unit 0 {
point-to-point;
ppp-options {
chap {
default-chap-secret "xxx"; ## SECRET-DATA
local-name "xxx";
passive;
}
}
pppoe-options {
underlying-interface fe-0/0/7.0;
idle-timeout 0;
auto-reconnect 30;
client;
}
no-keepalives;
family inet {
negotiate-address;
}
}
}
vlan {
unit 16 {
family inet {
address 10.17.17.62/26;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 {
next-hop pp0.0;
metric 0;
}
}
}
protocols {
stp {
disable;
interface ge-0/0/0.0 {
disable;
}
interface ge-0/0/1.0 {
disable;
}
interface fe-0/0/2.0 {
disable;
}
interface fe-0/0/3.0 {
disable;
}
interface fe-0/0/4.0 {
disable;
}
interface fe-0/0/5.0 {
disable;
}
interface fe-0/0/6.0 {
disable;
}
}
}
security {
flow {
tcp-mss {
all-tcp {
mss 1380;
}
}
}
screen {
ids-option untrust-screen {
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 10.17.17.0/26;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.16 {
host-inbound-traffic {
system-services {
dhcp;
all;
}
}
}
fe-0/0/5.0;
}
}
security-zone untrust {
interfaces {
pp0.0 {
host-inbound-traffic {
system-services {
ssh;
ping;
traceroute;
}
}
}
}
}
}
}
vlans {
vlan-trust {
vlan-id 16;
l3-interface vlan.16;
}
}
当我从 Juniper 本身对任何设备执行 ping 操作时，有时 ping 正常，但有时我也会收到 PL。甚至我的 GW 也是如此。如果我切换回 Cisco ASA 5505 — — 我实际上没有收到 PL。
有人有什么建议吗？我尝试了不同的端口，清除配置并重试等。没有任何帮助。鉴于其他协议在 ICMP/traceroute 的 PL 期间运行良好，我怀疑某种限制正在起作用，但如何找出是哪一个？我很确定我禁用了所有屏幕等......
任何建议，不胜感激。
编辑：我正在运行最新推荐的软件版本--12.1X44-D40.2
root> show version
Model: srx210be
JUNOS Software Release [12.1X44-D40.2]
编辑 2：我刚刚做了一个测试；我将 Raspberry PI 直接连接到接口并开始对其进行 MTR。以下是结果：
Packets Pings
Host Loss% Snt Last Avg Best Wrst StDev
1. 10.17.17.62 47.3% 112 1.2 1.2 1.0 3.3 0.3
2. 10.50.50.2 0.0% 111 1.7 1.9 1.3 14.4 1.7
10.17.17.62 再次成为 GW。
经过进一步测试，似乎 ICMP 实际上并未受到影响。只有 MTR 使用 UDP 进行路由跟踪。但是，我无法真正找出到底是什么限制/丢弃了它。