Juniper Junos 设备 request support information（RSI）日志收集

网络

语法

request support information
<brief>
<cos>
<dot1x>
<evpn-mpls | evpn-vxlan | evpn-vxlan-pfe | evpn-vxlan-xml>
<interface-debug>
<ipsec-vpn>
<security-components>
<with-components>
<with-logs>
<with-options>

语法（ACX 系列路由器）

request support information 
<archive>
<cos>
<dot1x>
<evpn-mpls>
<evpn-vxlan>
<with-components>
<with-logs>
<with-options>

语法（EX 系列交换机）

request support information
<brief>
<cos>
<dot1x>
<evpn-mpls | evpn-vxlan | evpn-vxlan-pfe | evpn-vxlan-xml>
<interface-debug>
<ipsec-vpn>
<security-components>
<with-components>
<with-logs>
<with-options>

语法（MX 系列路由器）

request support information 
<archive>
<cos>
<dot1x>
<evpn-mpls>
<evpn-vxlan>
<with-components>
<with-logs>
<with-options>

语法（PTX 系列路由器）

request support information 
<archive>
<cos>
<dot1x>
<evpn-mpls>
<evpn-vxlan>
<with-components>
<with-logs>
<with-options>

语法（运行 Junos OS Evolved 的 QFX 系列交换机）

request support information
<archive>
<evpn-vxlan-pfe>
<evpn-vxlan-xml>
<with-components>
<with-logs>
<with-options>
<default>
<cos>
<l3-debug>
<evpn-vxlan>

语法（SRX 系列防火墙）

request support information 
<archive>
<dot1x>
<evpn-mpls>
<evpn-vxlan>
<security-components component>
<with-components>
<with-logs>
<with-options>

说明

显示系统的全部配置数据，包括用 apply-flags omit 命令隐藏的数据。联系客户支持前先执行此命令，并将命令输出附在支持请求中。该命令的输出因执行平台而略有不同，但总会执行一系列 show 命令，自动包含适用于当前设备的信息。

该命令的输出可能非常长（数千行），通常需要将输出重定向到文件（如 /var/log/rsi.log），方法如下：

request support information <options> | save filename

运行 Junos OS Evolved 的 QFX 系列交换机默认文件路径为 /var/tmp。

注意：

request support information（RSI）命令会汇集多条运行命令的输出，可能生成很大的文件。运行 RSI 会增加 CPU 负载并可能延迟文件生成，在 CPU 使用率高的系统上尤其明显。运行前请先检查当前 CPU 利用率，避免在流量高峰期执行；尽量使用 brief 或针对具体功能的选项，以降低对系统的影响。

选项

brief （可选）显示精简信息。不加此选项时，输出可能需要很长时间才能完成。
archive 生成一个压缩归档文件（tar.gz），保存在 /var/tmp/rsi 目录，包含 request support information 命令的全部输出。
cos 显示 Class of Service（CoS）详细信息。
dot1x

显示 dot1x 详细状态报告。

注意：

如果以 root 用户登录，此选项会跳过所有用户交互。
evpn-mpls

（可选）显示系统信息，包括 EVPN-MPLS fabric 配置下 EVPN 控制平面和 Packet Forwarding Engine（PFE）的深入状态。输出包括：

  • 各类 EVPN 路由（含 EVPN Type 5 IP 前缀路由）的 EVPN 实例、数据库和路由信息。
  • EVPN 组播和组播侦听信息。
evpn-vxlan

（可选）显示系统信息，包括 EVPN-VXLAN fabric 配置下 EVPN 控制平面和 PFE 的深入状态。输出包括：

  • EVPN 实例、数据库、路由（含 EVPN Type 5 IP 前缀路由）、组播和组播侦听信息。
  • 以太网交换、泛洪、VXLAN 隧道端点（VTEP）状态及下一跳信息。
  • （自 Junos OS 和 Junos OS Evolved 22.4R2、23.1R1 起）EVPN-VXLAN 组播和组播侦听的附加调试信息，包括 optimized intersubnet multicast（OISM）和 assisted replication（AR）功能的命令输出。

  • 注意：

    如果以 root 用户登录，此选项会跳过所有用户交互。
ipsec-vpn （可选）显示 IPsec VPN 的详细系统信息。
all-members （EX 系列交换机和 MX 系列路由器）（可选）显示 Virtual Chassis 全部成员的系统信息。
local （EX 系列交换机和 MX 系列路由器）（可选）显示本地 Virtual Chassis 成员的系统信息。
l3-debug 显示三层交换的详细信息。
member member-id （EX 系列交换机和 MX 系列路由器）（可选）显示 Virtual Chassis 指定成员的系统信息。EX 系列交换机上将 member-id 替换为该 Virtual Chassis 配置中合适的值；MX 系列路由器上将 member-id 替换为 0 或 1。
secure-gateway （SRX5400、SRX5600 和 SRX5800）（可选）显示安全网关部署场景下的系统信息。
security-components component

（SRX 系列）（可选）显示安全组件的信息。

  • alg——显示 Application Layer Gateway（ALG）的详细安全报告。
  • apbr——显示 Advanced Policy-Based Routing（APBR）的详细安全报告。
  • appid——显示应用识别（AppID）的详细安全报告。
  • application-firewall——显示应用防火墙（AppFW）的详细安全报告。
  • appqoe——显示应用体验质量（AppQoE）的详细安全报告。
  • appqos——显示应用服务质量（AppQoS）的详细安全报告。
  • ha——显示机箱集群防火墙系统的详细安全报告。
  • idp——显示入侵检测与防御（IDP）的详细安全报告。
  • ipsec-vpn——显示 IPsec VPN 的详细安全报告。
  • macsec——显示 MACsec 的详细安全报告。
  • nat——显示 NAT 的详细安全报告。
  • packet-flow——显示报文流的详细安全报告。
  • perf——显示系统性能的详细安全报告。
  • skyatp——显示 Juniper Advanced Threat Prevention Cloud（Juniper ATP Cloud）的详细安全报告。
  • sslfp——显示 SSL 代理的详细安全报告。
  • system——显示防火墙系统的详细安全报告。
  • utm——显示 Content Security 的详细安全报告。
  • web-proxy——显示 Web 代理的详细安全报告。
node

（SRX5400、SRX5600 和 SRX5800）（可选）显示全部节点或指定节点的详细系统状态报告。

  • node-id——显示指定节点的详细系统状态报告，将 node-id 替换为 0 或 1。
  • all——显示全部节点的详细系统状态报告。
  • local——显示本地节点的详细系统状态报告。
  • primary——显示主节点的详细系统状态报告。
with-logs

生成一个压缩归档文件（tar.gz），包含 request support information 命令的全部输出以及 /var/log 目录下的日志文件。

注意：

该压缩归档文件只包含 /var/log 目录下的日志文件，不含 /var/log/trace 目录。
with-components

生成一个压缩归档文件（tar.gz），包含各组件专用 request support information 命令的输出、通用 request support information 命令的输出以及 /var/log 目录下的日志文件。

  • bbe-debug——BBE 专用 RSI 命令，包括 Routing Engine CLI 和 Routing Engine vty CLI。
  • bfd-debug/——包含 BFD 及线卡相关的 BFD 信息。
  • cfm-debug——包含 CFM 相关信息。
  • cos-debug——包含 CoS 相关信息。
  • dcd-debug——包含 dcd-debug 专用报告和日志。
  • erp-debug——包含 ERP 的 RSI 信息。
  • fabric-debug——包含 fabric-debug 专用报告和日志。
  • firewall-debug——包含防火墙相关信息。
  • global-data-shared-memory-debug——包含全局数据共享内存相关信息。
  • ha-debug——包含 GRES、ISSU 和 NSR 信息。
  • ipsec-debug——包含 ipsec-debug 专用报告和日志。
  • jnu-debug——收集 JNU 调试信息。
  • l2-debug——包含二层的 RSI 信息。
  • l3-debug——包含三层相关信息。
  • lacp-debug——包含 LACP 相关信息。
  • lag-debug——包含 LAG 调试命令。
  • ldp-debug——包含 LDP 相关信息。
  • lfm-debug——包含 LFM 相关信息。
  • macsec-debug——MACsec 的 RSI 信息。
  • mclag-debug——包含 mclag-debug 专用报告和日志。
  • mvpn-debug——收集 MVPN 调试信息。
  • netstack-debug——包含三层 / 四层、netkey 和 NTP 调试命令。
  • netstack-infra-debug——包含 Junos netstack infra 和 ifstate 调试命令。
  • pcep-debug——包含 PCEP 相关信息。
  • pfe-debug——包含 DPP PFE 的 RSI 信息。
  • ppmd-debug——包含 PPMD、ppman 相关信息。
  • stp-debug——包含 STP 的 RSI 信息。
  • timing-debug——包含时钟同步相关信息。
  • ui-debug——包含可管理性相关信息。
  • vrrp-debug——包含 VRRP 调试专用报告和日志。
with-options 生成一个压缩归档文件（tar.gz），包含带指定参数的组件专用 request support information 命令的输出。该命令可灵活收集系统信息，并按需定制输出内容。

补充信息

该命令调用的 show 命令因执行平台而异，输出总是适用于当前设备。例如，表 1 列出在 MX 系列路由器上执行 request support information 时调用的 show 命令。

表 1：在 MX 系列路由器上执行 request support information 命令时调用的 show 命令示例
show chassis alarms no-forwarding show interfaces extensive no-forwarding
show chassis environment no-forwarding show krt queue
show chassis fabric degradation show krt state
show chassis fabric destinations show pfe statistics error
show chassis fabric fpcs show pfe statistics traffic
show chassis fabric plane show route summary
show chassis fabric reachability show system boot-messages no-forwarding
show chassis fabric summary show system buffer no-forwarding
show chassis fpc show system commit
show chassis fpc detail show system core-dumps no-forwarding
show chassis firmware no-forwarding show system processes extensive no-forwarding
show chassis hardware detail no-forwarding show system queues no-forwarding
show chassis hardware extensive no-forwarding show system statistics no-forwarding
show pfe statistics traffic show system storage no-forwarding
show chassis power show system uptime no-forwarding
show chassis routing-engine no-forwarding show system virtual-memory no-forwarding
show configuration | except SECRET-DATA show version detail no-forwarding

注意：

no-forwarding 选项确保在命令仍在运行时按 Ctrl+C 中断输出，与该 show 命令相关的所有 mgd 进程都会被正确终止。

request support information brief 命令不支持 show interfaces extensive no-forwarding 这条 show 命令。

表 2 列出在 MX 系列路由器上执行 request support information ipsec-vpn 时调用的 show 命令。

表 2：在 MX 系列路由器上执行 request support information ipsec-vpn 命令时调用的 show 命令示例
show version no-forwarding | no-more show services ipsec-vpn ipsec statistics | no-more
show system uptime no-forwarding | no-more show security pki local-certificate detail no-forwarding
show system core-dumps no-forwarding | no-more show security pki local-certificate system-generated detail no-forwarding
show system processes extensive no-forwarding | grep ike show security pki ca-certificate detail no-forwarding
show system processes extensive no-forwarding | grep kmd show security pki crl detail no-forwarding
show chassis fpc pic-status show security pki certificate-request detail no-forwarding
show chassis cluster status show security pki statistics no-forwarding | no-more
show chassis cluster interfaces show ipsec memory-usage | no-more
show chassis cluster information show services sessions analysis | no-more
show configuration | no-more show services sessions extensive | no-more
show route forwarding-table | no-more show pfe statistics traffic | no-more
show interfaces extensive | no-more show pfe statistics exceptions | no-more
show services ipsec-vpn ike security-associations detail | no-more show pfe statistics error | no-more
show services ipsec-vpn ike statistics | no-more show extension-provider system processes extensive | match mspmand
show services ipsec-vpn ipsec security-associations detail | no-more show services service-sets statistics packet-drops | no-more
plugin ipsec show stats all plugin ipsec show sadb detail
plugin ipsec show rules all plugin ipsec show rules no-sa
plugin ipsec show sa-trigger-seqno plugin ipsec show invalid-spi brief
plugin ipsec show invalid-spi history show msp pkt-cntrs terse
show msp pkt-cntrs show msp plugins pkt-cntrs
show msp service-sets show msp service-sets summary
show msp service-sets mem-usage show msp ip-stats
show msp mem usage show msp mem ocwm jnx-msp-shm-data mum
show msp mem ocwm jnx-msp-shm-data mum objcache show msp stats ctrl
show msp cpu-throttle show svcs-xlp intf counters
show svcs-xlp exceptions show svcs-xlp exceptions detail
show svcs-xlp cpu stats show svcs-xlp fifo
show svcs-xlp poe stats show svcs-xlp jbuf-stats
plugin ha show ckpt plugin ha show ha-pvt-obj stats
plugin ha show info-ha-plugin plugin ha show stats
plugin ha show udp plugin ha show mtu
plugin ha show junos-sync stats plugin ha show junos-sync stats aggregation
plugin ha show junos-sync stats history

自 20.2R1 起，Junos OS 为 request support information 命令新增 ipsec-vpn 选项。request support information ipsec-vpn 命令显示 Routing Engine 和业务卡层面的全部配置、状态和统计信息，便于调试 IPsec VPN 相关问题；信息收集更精简，输出文件也更小。

表 3 列出在 EX9200 系列交换机上执行 request support information 时调用的 show 命令。表中未列出 request support information 本身使用的 no-forwarding 选项。

表 3：在 EX9200 系列交换机上执行 request support information 命令时调用的 show 命令示例
show chassis alarms show interfaces extensive
show chassis environment
show chassis firmware show pfe statistics traffic
show chassis fpcdetail show spanning-tree bridge detail
show chassis hardware detail show spanning-tree interface
show chassis routing-engine
show configuration | except SECRET-DATA | display omit show system boot-messages
show dhcp-security binding show system queues
show dhcp-security ipv6 binding show system processes extensive
show system queues
show ethernet-switching interface detail show system statistics
show ethernet-switching table show vlans extensive
show vrrp summary

表 4 列出在 SRX 系列防火墙上执行 request support information 时调用的 show 命令。

表 4：在 SRX 系列防火墙上执行 request support information 命令时调用的 show 命令示例
show pfe statistics traffic show interfaces queue
show chassis environment no-forwarding show security monitoring fpc 0
show chassis fpc detail show system license
show system storage no-forwarding show security policies hit-count no-forwarding
show system virtual-memory no-forwarding show security policies information no-forwarding
show system buffer no-forwarding show security dns-cache
show system queues no-forwarding show security flow statistics
show chassis hardware extensive no-forwarding show security flow status
show krt queue show security flow session summary no-forwarding
show route summary show security utm anti-virus status
show version no-forwarding show system processes extensive no-forwarding
show system uptime no-forwarding show chassis fpc pic-status
show system core-dumps no-forwarding show chassis cluster status
show chassis cluster interfaces show chassis cluster information
show route forwarding-table show interfaces extensive
show security pki local-certificate detail no-forwarding show security pki local-certificate system-generated detail no-forwarding
show security pki ca-certificate detail no-forwarding show security pki crl detail no-forwarding
show security pki certificate-request detail no-forwarding show security pki statistics no-forwarding
show security internal-security-association no-forwarding show security ike security-associations detail no-forwarding
show security ike active-peer stats no-forwarding show security ike stats no-forwarding
show security ipsec security-associations detail no-forwarding show security ipsec statistics no-forwarding
show security ipsec tunnel-distribution no-forwarding show security ipsec tunnel-distribution summary no-forwarding
show security ipsec next-hop-tunnels no-forwarding show security ipsec tunnel-events-statistics no-forwarding
show security ipsec inactive-tunnels no-forwarding show pfe statistics traffic
show usp ipsec sa show usp ipsec pmi-sa
show usp ipsec global-stat show usp ipsec pkt-stat
show usp ipsec stat show usp ipsec spd table
show usp ipsec spd stats show usp ipsec traffic-selector stats
show usp ipsec traffic-selector pkt-stats show usp ipsec tunnel-distribution
show usp ipsec nsp-tunnel-table show usp ipsec nhtb
show usp ipsec ager stats show talus number stats all
show talus number drop-pkt show talus number queue-bp
show jspec talus number registers cntr fi_bp number show jspec talus number registers cntr fi_bp number
show jspec talus number registers cntr fi_bp number show jspec talus number registers cntr fi_bp number
show jspec talus number registers cntr fo_free number show jspec talus number registers cntr fo_free number
show jspec talus number registers cntr fo_free number show jspec talus number registers cntr fo_free number
show jspec talus number registers cntr ing_eop number show jspec talus number registers cntr ing_eop number
show jspec talus number registers cntr ing_eop number show jspec talus number registers cntr ing_eop number
show security nat destination pool all show security nat destination pool all all-logical-systems-tenants
show security nat destination rule all show security nat destination summary
show security nat destination summary no-forwarding all-logical-systems-tenants show security nat interface-nat-ports no-forwarding all-logical-systems-tenants
show security nat resource-usage source-pool all show security nat source deterministic
show security nat source paired-address all-logical-systems-tenants show security nat source persistent-nat-table all all-logical-systems-tenants
show security nat source persistent-nat-table summary show security nat source pool all
show security nat source pool all all-logical-systems-tenants show security nat source port-block all-logical-systems-tenants
show security nat source rule all show security nat source summary
show security nat source summary no-forwarding all-logical-systems-tenants show security nat static rule all no-forwarding all-logical-systems-tenants

自 Junos OS 15.1X49-D110 起，SRX5400、SRX5600 和 SRX5800 上的 request support information 命令新增 secure-gateway 选项，显示安全网关部署场景所需的全部相关信息。在 Junos OS 15.1X49-D100 及更早版本中，request support information 会显示所有功能的信息，其中很多与安全网关部署无关。

自 Junos OS 20.2R1 起，request support information security-components 命令新增 ipsec-vpn 选项，显示调试 IPsec VPN 相关问题所需的全部配置、状态和统计信息。

所需权限级别

maintenance, view, and view-configuration

输出字段

输出字段的说明，请查看输出中所列的具体命令的说明。

示例输出

  • request support information | save
  • request support information security-components nat (SRX Series Firewall)
  • request support information (SRX Series Firewall)
  • request support information ipsec-vpn (MX Series Router)

request support information | save

user@host> request support information | save hostA
Wrote 1143 lines of output to 'hostA'

user@host>
request support information security-components nat (SRX Series Firewall)
user@host> request support information security-components nat
root@host> show security nat source pool all

Total pools: 1
Pool name          : p1
Pool id            : 4
Routing instance   : default
Host address base  : 0.0.0.0
Port               : [1024, 63487]
Twin port          : [63488, 65535]
Port overloading   : 1
Address assignment : no-paired
Total addresses    : 4
Translation hits   : 0
Address range                        Single Ports   Twin Ports
           10.0.0.0 - 10.0.0.3           0              0
Total used ports   :                     0              0


root@host> show security nat source rule all

Total rules: 1
Total referenced IPv4/IPv6 ip-prefixes: 1/0
source NAT rule: r1
  Rule set                   : src_rs1
  Rule Id                    : 2
  Rule position              : 1
  From zone                  : trust
  To zone                    : untrust
  Match
    Source addresses         : 0.0.0.0         - 255.255.255.255
  Action                        : p1
    Persistent NAT type         : N/A
    Persistent NAT mapping type : address-port-mapping
    Inactivity timeout          : 0
    Max session number          : 0
    Persistent NAT block session: disabled
  Translation hits           : 0
    Successful sessions      : 0
  Number of sessions         : 0


root@host> show security nat source summary

Total port number usage for port translation pool: 258048
Maximum port number for port translation pool: 268435456
Total pools: 1
Pool                 Address                  Routing              PAT  Total
Name                 Range                    Instance                  Address
p1                   10.0.0.0-10.0.0.3        default              yes  4

Total rules: 1
Rule name : r1
    Rule set  : src_rs1
    Action    : p1
    From      : trust                 To : untrust


root@host> show security nat destination pool all

Total destination-nat pools: 0


root@host> show security nat destination rule all

Total destination-nat rules: 0
Total referenced IPv4/IPv6 ip-prefixes: 0/0


root@host> show security nat destination summary

Total pools: 0

Total rules: 0


root@host> show security nat source deterministic



root@host> show security nat resource-usage source-pool all


PAT pools(including address-shared pool) port utilization:
  Pool : p1
  Address :         4 Used :         0 Avail :    258048 Total :    258048 Usage :    0%


root@host> show security nat source persistent-nat-table summary

  binding total    : 524288
  binding in use   : 0
  enode total      : 16777216
  enode in use     : 0


root@host> show chassis cluster information detail | match "mode:"

error: Chassis cluster is not enabled.


root@host> show security nat source summary no-forwarding all-logical-systems-tenants

Logical system: root-logical-system
Total port number usage for port translation pool: 258048
Maximum port number for port translation pool: 268435456
Total pools: 1
Pool                 Address                  Routing              PAT  Total
Name                 Range                    Instance                  Address
p1                   10.0.0.0-10.0.0.3        default              yes  4

Total rules: 1

Logical system: root-logical-system
Rule name : r1
    Rule set  : src_rs1
    Action    : p1
    From      : trust                 To : untrust


root@host> show security nat destination summary no-forwarding all-logical-systems-tenants

Total pools: 0

Total rules: 0


root@host> show security nat static rule all no-forwarding all-logical-systems-tenants

Total static-nat rules: 0
Total referenced IPv4/IPv6 ip-prefixes: 0/0


root@host> show security nat interface-nat-ports no-forwarding all-logical-systems-tenants

Logical system: root-logical-system
Pool   Total  Single ports  Single ports  Twin ports  Twin ports
index  ports     allocated     available   allocated   available
    0  64510             0         63486           0        1024
    1  64510             0         63486           0        1024
    2  64510             0         63486           0        1024
    3  64510             0         63486           0        1024
    4  64510             0         63486           0        1024
    5  64510             0         63486           0        1024
    6  64510             0         63486           0        1024
    7  64510             0         63486           0        1024
    8  64510             0         63486           0        1024
    9  64510             0         63486           0        1024
   10  64510             0         63486           0        1024
   11  64510             0         63486           0        1024
   12  64510             0         63486           0        1024
   13  64510             0         63486           0        1024
   14  64510             0         63486           0        1024
   15  64510             0         63486           0        1024
   16  64510             0         63486           0        1024
   17  64510             0         63486           0        1024
   18  64510             0         63486           0        1024
   19  64510             0         63486           0        1024
   20  64510             0         63486           0        1024
   21  64510             0         63486           0        1024
   22  64510             0         63486           0        1024
   23  64510             0         63486           0        1024
   24  64510             0         63486           0        1024
   25  64510             0         63486           0        1024
   26  64510             0         63486           0        1024
   27  64510             0         63486           0        1024
   28  64510             0         63486           0        1024
   29  64510             0         63486           0        1024
   30  64510             0         63486           0        1024
   31  64510             0         63486           0        1024
   32  64510             0         63486           0        1024
   33  64510             0         63486           0        1024
   34  64510             0         63486           0        1024
   35  64510             0         63486           0        1024
   36  64510             0         63486           0        1024
   37  64510             0         63486           0        1024
   38  64510             0         63486           0        1024
   39  64510             0         63486           0        1024
   40  64510             0         63486           0        1024
   41  64510             0         63486           0        1024
   42  64510             0         63486           0        1024
   43  64510             0         63486           0        1024
   44  64510             0         63486           0        1024
   45  64510             0         63486           0        1024
   46  64510             0         63486           0        1024
   47  64510             0         63486           0        1024
   48  64510             0         63486           0        1024
   49  64510             0         63486           0        1024
   50  64510             0         63486           0        1024
   51  64510             0         63486           0        1024
   52  64510             0         63486           0        1024
   53  64510             0         63486           0        1024
   54  64510             0         63486           0        1024
   55  64510             0         63486           0        1024
   56  64510             0         63486           0        1024
   57  64510             0         63486           0        1024
   58  64510             0         63486           0        1024
   59  64510             0         63486           0        1024
   60  64510             0         63486           0        1024
   61  64510             0         63486           0        1024
   62  64510             0         63486           0        1024
   63  64510             0         63486           0        1024


root@host> show security nat source pool all all-logical-systems-tenants

Total pools: 1
Logical system: root-logical-system
Pool name          : p1
Pool id            : 4
Routing instance   : default
Host address base  : 0.0.0.0
Port               : [1024, 63487]
Twin port          : [63488, 65535]
Port overloading   : 1
Address assignment : no-paired
Total addresses    : 4
Translation hits   : 0
Address range                        Single Ports   Twin Ports
           10.0.0.0 - 10.0.0.3           0              0
Total used ports   :                     0              0


root@host> show security nat destination pool all all-logical-systems-tenants

Total destination-nat pools: 0


root@host> show security nat source port-block all-logical-systems-tenants


root@host> show security nat source paired-address all-logical-systems-tenants


root@host> show security nat source persistent-nat-table all all-logical-systems-tenants


root@host> show security nat resource-usage source-pool all


PAT pools(including address-shared pool) port utilization:
  Pool : p1
  Address :         4 Used :         0 Avail :    258048 Total :    258048 Usage :    0%
fwdd is not online, Skipping..

request support information (SRX Series Firewall)

user@host> request support information 
root@host> show security dns-cache 
DNS entry number: 0

root@host> show security utm web-filtering statistics

 UTM web-filtering statistics:
    Web-filtering sessions in total:    512000
    Web-filtering sessions in use:      0
    Fallback:                       log-and-permit           block
          Default                       0               0
          Timeout                       0               0
     Connectivity                       0               0
Too-many-requests                       0               0

root@host> show security utm session

 UTM session info:
 Maximum sessions:                256000
 Total allocated sessions:        0
 Total freed sessions:            0
 Active sessions:                 0

root@host> show system uptime no-forwarding

Current time: 2017-07-09 21:38:01 PDT
Time Source:  LOCAL CLOCK
System booted: 2017-07-09 20:58:06 PDT (00:39:55 ago)
Protocols started: 2017-07-09 20:58:07 PDT (00:39:54 ago)
Last configured: 2017-06-30 08:56:45 PDT (1w2d 12:41 ago) by user
 9:38PM  up 40 mins, 1 user, load averages: 0.10, 0.07, 0.04
...
request support information ipsec-vpn (MX Series Router)
user@host> request support information ipsec-vpn
root@mobst480e> show services ipsec-vpn ike security-associations detail | no-more
IKE peer 10.0.1.2
  Role: Responder, State: Matured
  Initiator cookie: 9425c926b3614be5, Responder cookie: 1bcf54a314423b3f
  Exchange type: IKEv2, Authentication method: Pre-shared-keys
  Local gateway interface: ge-4/3/3.0
  Local: 10.0.1.1, Remote: 10.0.1.2
  Lifetime: Expires in 1923 seconds
  Peer ike-id: ipv4(any:0,[0..3]=10.0.1.2)
  Algorithms:
   Authentication        : hmac-sha1-96
   Encryption            : 3des-cbc
   Pseudo random function: hmac-sha1
   Diffie-Hellman group  : 2
  Traffic statistics:
   Input  bytes  :                 8024
   Output bytes  :                 7744
   Input  packets:                   52
   Output packets:                   52
  Flags: IKE SA created
  IPSec security associations: 34 created, 36 deleted

root@mobst480e> show services ipsec-vpn ike statistics | no-more
IKE peer 10.0.1.2
  Initiator cookie: 9425c926b3614be5, Responder cookie: 1bcf54a314423b3f
  Local: 10.0.1.1, Remote: 10.0.1.2
  IPSec security associations: 34 created, 36 deleted
  IPSec tunnel rekeys: 17
  Exchange type: IKEv2
  Traffic statistics:
   Input  bytes  :                                       8024
   Output bytes  :                                       7744
   Input  packets:                                         52
   Output packets:                                         52
  Delete IPsec SA payload statistics:
   Delete IPsec SA payloads received:                      18
   Delete IPsec SA payloads sent    :                      17
  DPD statistics:
   DPD request received           :                        18
   DPD request sent               :                         0
   DPD response received          :                         0
   DPD response sent              :                        18
   DPD response missed            :                         0
   Worst case DPD response delay  :                         0 msec
   DPD sequential response missed :                         0
  Invalid SPI notification statistics:
   Notifications received:                                  0
   Notifications sent    :                                  0

root@mobst480e> show services ipsec-vpn ipsec security-associations detail | no-more
Service set: ss1, IKE Routing-instance: default

  Rule: ipsec_vpn_rules_1, Term: term1, Tunnel index: 1
  Local gateway: 10.0.1.1, Remote gateway: 10.0.1.2
  IPSec inside interface: ms-2/0/0.1, Tunnel MTU: 1500
  UDP encapsulate: Disabled, UDP Destination port: 0
  Local identity: ipv4_subnet(any:0,[0..7]=192.168.60.0/24)
  Remote identity: ipv4_subnet(any:0,[0..7]=192.168.70.0/24)
  NATT Detection: Not Detected, NATT keepalive interval: 0
  Total uptime:  0 days 2 hrs 45 mins 21 secs

    Direction: inbound, SPI: 2957881284, AUX-SPI: 0
    Mode: tunnel, Type: dynamic, State: Installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
    Soft lifetime: Expires in 48 seconds
    Hard lifetime: Expires in 88 seconds
    Anti-replay service: Enabled, Replay window size: 4096
    Copy ToS: Enabled
    Copy TTL: Disabled, TTL value: 64
    SA lifetime: 180 seconds

    Direction: outbound, SPI: 3292864325, AUX-SPI: 0
    Mode: tunnel, Type: dynamic, State: Installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
    Soft lifetime: Expires in 48 seconds
    Hard lifetime: Expires in 88 seconds
    Anti-replay service: Enabled, Replay window size: 4096
    Copy ToS: Enabled
    Copy TTL: Disabled, TTL value: 64
    SA lifetime: 180 seconds

root@mobst480e> show services ipsec-vpn ipsec statistics | no-more

PIC: ms-2/0/0, Service set: ss1

ESP Statistics:
  Encrypted bytes:                0
  Decrypted bytes:                0
  Encrypted packets:              0
  Decrypted packets:              0
AH Statistics:
  Input bytes:                    0
  Output bytes:                   0
  Input packets:                  0
  Output packets:                 0
Errors:
  AH authentication failures:     0
  ESP authentication failures:    0
  ESP decryption failures:        0
  Bad headers: 0, Bad trailers: 0
  Replay before window drops: 0, Replayed pkts: 0
  IP integrity errors: 0, Exceeds tunnel MTU: 0
  Rule lookup failures: 0, No SA errors: 0
  Flow errors: 0, Misc errors: 0

版本信息

该命令在 Junos OS 7.4 之前引入。

brief 选项在 Junos OS 13.2 中引入。

secure-gateway 选项在 Junos OS 15.1X49-D110 中为 SRX5400、SRX5600 和 SRX5800 引入。

security-components 和 ipsec-vpn 选项在 Junos OS 20.2R1 中引入。

evpn-mpls 和 evpn-vxlan 选项在 Junos OS 和 Junos OS Evolved 21.2R3、21.4R2、21.4R3 和 22.2R1 中引入。

Junos OS 和 Junos OS Evolved 22.4R2、23.1R1 在 evpn-vxlan 选项输出中增加了 EVPN 组播调试信息。

archive、with-logs、with-components 和 with-options 选项在 Junos OS 和 Junos OS Evolved 24.2R1 中引入。

Junos OS Evolved 24.4R1 在 with-components 选项中增加 timing-debug，输出时钟同步相关信息。

nat 选项在 Junos OS 25.1R1 中引入。

cos 和 l3-debug 选项在 Junos OS Evolved 25.2R1 中为 QFX 系列交换机引入。

3 次浏览 更新于 2026-11-08

没有找到想要的答案？

上传日志让 AI 帮你诊断，或者在控制台里直接向 AI 提问。

上传日志诊断 AI 智能问答