JuniperSRX防火墙系统会话链接的清除-创新互联
Juniper SRX防火墙系统会话链接的清除
维护Juniper防火墙SRX系列防火墙，一段时间后，发现防火墙老是有时候登录不上去，有时候可以登录。
查看用户的时候，发现，系统挂了很多连接会话，怪不得老是无法登录，资料被消耗了。
用户并不多：
{primary:node0}
james@SRX3600-FW-1> show system users
node0:
--------------------------------------------------------------------------
3:58PM up 648 days, 15:42, 3 users, load averages: 0.27, 0.19, 0.14
USER TTY FROM LOGIN@ IDLE WHAT
james p0 10.251.152.212 2:42PM 1:07 ssh 10.244.136
james p1 10.251.152.212 3:53PM - -cli (cli)
node1:
--------------------------------------------------------------------------
3:58PM up 40 days, 10 hrs, 0 users, load averages: 0.17, 0.19, 0.12
连接数倒是很多。。。
james@SRX3600-FW-1> show system connections | match 10.111.141.146.22
tcp4 0 0 10.111.141.146.22 10.251.152.212.1669 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.251.152.212.1281 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.46565 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.24.40582 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.3102 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.27496 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.22894 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.22890 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.21030 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.25413 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.24.51123 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.59378 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.26.40712 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.9228 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.26.7785 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.27143 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.46143 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.9249 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.24.19977 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.54018 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.24.37582 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.39697 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.51267 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.28047 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.36206 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.26.12024 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.19595 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.32237 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.62761 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.8727 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.57345 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.24.7457 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.60782 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.50150 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.24.23601 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.54827 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.28.51074 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.35025 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.26.13587 ESTABLISHED
登录查看是那些进程：
root@SRX3600-FW-1% ps -aux | grep sshd
root 61980 0.1 0.2 6084 2432 ?? S 10:37AM 0:00.30 sshd: nsm [priv] (sshd)
root 3740 0.0 0.2 7288 2484 ?? Is 9Sep15 0:00.76 sshd: kevinw@notty (sshd)
root 3791 0.0 0.2 7288 2484 ?? Is 9Sep15 0:00.50 sshd: kevinw@notty (sshd)
root 4066 0.0 0.2 7288 2488 ?? Is 9Sep15 0:00.18 sshd: james@notty (sshd)
root 4449 0.0 0.2 7288 2484 ?? Is 9Sep15 0:00.38 sshd: kevinw@notty (sshd)
root 6513 0.0 0.2 7288 2484 ?? Is 1Sep15 0:00.29 sshd: kevinw@notty (sshd)
root 17193 0.0 0.2 7288 2484 ?? Is 1Sep15 0:00.29 sshd: kevinw@notty (sshd)
root 17558 0.0 0.2 7288 2484 ?? Is Mon02PM 0:00.26 sshd: kevinw@notty (sshd)
root 18548 0.0 0.2 7288 2484 ?? Is Mon03PM 0:00.16 sshd: kevinw@notty (sshd)
root 21354 0.0 0.2 7288 2484 ?? Is 1Sep15 0:00.41 sshd: kevinw@notty (sshd)
root 21658 0.0 0.2 7288 2484 ?? Is 1Sep15 0:00.25 sshd: kevinw@notty (sshd)
root 27719 0.0 0.2 7288 2484 ?? Is 28Aug15 0:00.39 sshd: kevinw@notty (sshd)
root 28611 0.0 0.2 7288 2484 ?? Is Thu04PM 0:00.23 sshd: kevinw@notty (sshd)
root 33524 0.0 0.2 7288 2484 ?? Is 24Aug15 0:00.19 sshd: kevinw@notty (sshd)
root 36425 0.0 0.2 7288 2484 ?? Is 6Sep15 0:00.26 sshd: kevinw@notty (sshd)
root 36800 0.0 0.2 7288 2484 ?? Is 6Sep15 0:00.27 sshd: kevinw@notty (sshd)
root 42448 0.0 0.2 7300 2496 ?? Is Tue03PM 0:00.13 sshd: kevinw@notty (sshd)
root 42450 0.0 0.2 7300 2496 ?? Is Tue03PM 0:00.13 sshd: kevinw@notty (sshd)
root 42953 0.0 0.2 7300 2496 ?? Is Tue04PM 0:00.31 sshd: kevinw@notty (sshd)
root 45193 0.0 0.2 7288 2484 ?? Is 2Sep15 0:00.62 sshd: kevinw@notty (sshd)
root 47703 0.0 0.2 7288 2484 ?? Is Fri12PM 0:00.83 sshd: kevinw@notty (sshd)
root 50156 0.0 0.2 7300 2496 ?? Is Wed09AM 0:00.13 sshd: kevinw@notty (sshd)
root 51153 0.0 0.2 7300 2496 ?? Is 11:24AM 0:00.13 sshd: kevinw@notty (sshd)
root 51155 0.0 0.2 7300 2496 ?? Is 11:24AM 0:00.13 sshd: kevinw@notty (sshd)
root 54215 0.0 0.2 7300 2496 ?? Is 5:09PM 0:00.13 sshd: kevinw@notty (sshd)
root 54223 0.0 0.2 7300 2496 ?? Is 5:10PM 0:00.13 sshd: kevinw@notty (sshd)
root 56559 0.0 0.2 7288 2484 ?? Is 25Aug15 0:00.24 sshd: james@notty (sshd)
root 58693 0.0 0.2 7288 2484 ?? Is 7Sep15 0:00.70 sshd: kevinw@notty (sshd)
root 60181 0.0 0.2 7288 2484 ?? Is 7Sep15 0:00.31 sshd: kevinw@notty (sshd)
root 60286 0.0 0.2 7288 2484 ?? Is 7Sep15 0:00.21 sshd: kevinw@notty (sshd)
root 60326 0.0 0.2 7288 2484 ?? Is 7Sep15 0:00.19 sshd: kevinw@notty (sshd)
root 61834 0.0 0.2 7288 2484 ?? Is 25Aug15 0:00.37 sshd: kevinw@notty (sshd)
root 61910 0.0 0.2 7292 2480 ?? Ss 10:30AM 0:00.22 sshd: james@ttyp0 (sshd)
sshd 61981 0.0 0.1 5740 1192 ?? I 10:37AM 0:00.11 sshd: nsm [net] (sshd)
root 77273 0.0 0.2 7288 2484 ?? Is 8Sep15 0:00.30 sshd: kevinw@notty (sshd)
root 78136 0.0 0.2 7288 2484 ?? Is 8Sep15 0:00.86 sshd: kevinw@notty (sshd)
root 79456 0.0 0.4 8512 3692 ?? Is 26Aug15 0:01.69 sshd: kevinw@notty (sshd)
root 80979 0.0 0.2 7288 2480 ?? Is 8Sep15 0:01.87 sshd: kevinw@ttyp2 (sshd)
root 86243 0.0 0.2 7288 2488 ?? Is 26Aug15 0:00.25 sshd: james@notty (sshd)
root 93209 0.0 0.2 7288 2488 ?? Is 31Aug15 0:00.56 sshd: andy@notty (sshd)
root 93754 0.0 0.2 7288 2484 ?? Is 31Aug15 0:01.00 sshd: kevinw@notty (sshd)
root 97322 0.0 0.2 7288 2484 ?? Is 31Aug15 0:00.71 sshd: andy@notty (sshd)
root 61994 0.0 0.1 2096 804 p0 R+ 10:37AM 0:00.01 grep sshd
root@SRX3600-FW-1%
root@SRX3600-FW-1%
把进程杀杀杀，全部杀光：
root@SRX3600-FW-1%
root@SRX3600-FW-1% kill -9 4449
kill -9 6513
root@SRX3600-FW-1% kill -9 6513
kill -9 17193
root@SRX3600-FW-1% kill -9 17193
root@SRX3600-FW-1% kill -9 17558
root@SRX3600-FW-1% kill -9 18548
root@SRX3600-FW-1% kill -9 21354
root@SRX3600-FW-1% kill -9 21658
root@SRX3600-FW-1% kill -9 27719
root@SRX3600-FW-1% kill -9 28611
root@SRX3600-FW-1% kill -9 33524
root@SRX3600-FW-1% kill -9 36425
root@SRX3600-FW-1% kill -9 36800
root@SRX3600-FW-1%
root@SRX3600-FW-1% kill -9 42448
root@SRX3600-FW-1% kill -9 42450
root@SRX3600-FW-1% kill -9 42953
root@SRX3600-FW-1% kill -9 45193
root@SRX3600-FW-1% kill -9 47703
root@SRX3600-FW-1% kill -9 50156
root@SRX3600-FW-1% kill -9 51153
kill -9 51155
root@SRX3600-FW-1% kill -9 51155
root@SRX3600-FW-1% kill -9 54215
root@SRX3600-FW-1% kill -9 54223
root@SRX3600-FW-1% kill -9 58693
root@SRX3600-FW-1% kill -9 60181
root@SRX3600-FW-1% kill -9 60286
root@SRX3600-FW-1% kill -9 60326
root@SRX3600-FW-1% kill -9 61834
root@SRX3600-FW-1% kill -9 61981
61981: No such process
root@SRX3600-FW-1% kill -9 77273
root@SRX3600-FW-1%
root@SRX3600-FW-1% kill -9 78136
root@SRX3600-FW-1% kill -9 79456
root@SRX3600-FW-1% kill -9 80979
kill -9 93209
kill -9 93754
kill -9 97322
root@SRX3600-FW-1% kill -9 93209
root@SRX3600-FW-1% kill -9 93754
root@SRX3600-FW-1% kill -9 97322
root@SRX3600-FW-1%
root@SRX3600-FW-1%
root@SRX3600-FW-1% ps -aux | grep sshd
root 4066 0.0 0.2 7288 2488 ?? Is 9Sep15 0:00.18 sshd: james@notty (sshd)
root 56559 0.0 0.2 7288 2484 ?? Is 25Aug15 0:00.24 sshd: james@notty (sshd)
root 61910 0.0 0.2 7292 2480 ?? Ss 10:30AM 0:00.29 sshd: james@ttyp0 (sshd)
root 62018 0.0 0.2 7300 2492 ?? Ss 10:40AM 0:00.13 sshd: kevinw@ttyp1 (sshd)
root 62046 0.0 0.2 6084 2432 ?? S 10:43AM 0:00.18 sshd: nsm [priv] (sshd)
sshd 62047 0.0 0.1 5740 1192 ?? I 10:43AM 0:00.11 sshd: nsm [net] (sshd)
root 86243 0.0 0.2 7288 2488 ?? Is 26Aug15 0:00.25 sshd: james@notty (sshd)
root 62049 0.0 0.1 2168 868 p0 S+ 10:43AM 0:00.01 grep sshd
root@SRX3600-FW-1% kill -9 4066
root@SRX3600-FW-1% kill -9 56559
root@SRX3600-FW-1% ps -aux | grep sshd
root 62055 0.3 0.2 6084 2432 ?? S 10:44AM 0:00.33 sshd: nsm [priv] (sshd)
root 61910 0.0 0.2 7292 2480 ?? Ss 10:30AM 0:00.30 sshd: james@ttyp0 (sshd)
root 62018 0.0 0.2 7300 2492 ?? Ss 10:40AM 0:00.17 sshd: kevinw@ttyp1 (sshd)
sshd 62056 0.0 0.1 5740 1192 ?? I 10:44AM 0:00.11 sshd: nsm [net] (sshd)
root 86243 0.0 0.2 7288 2488 ?? Is 26Aug15 0:00.25 sshd: james@notty (sshd)
root 62058 0.0 0.1 2096 740 p0 R+ 10:44AM 0:00.01 grep sshd
root@SRX3600-FW-1% kill -9 86243
root@SRX3600-FW-1% ps -aux | grep sshd
root 62060 20.0 0.2 6084 2432 ?? S 10:44AM 0:00.62 sshd: nsm [priv] (sshd)
sshd 62061 5.1 0.1 5740 1192 ?? S 10:44AM 0:00.11 sshd: nsm [net] (sshd)
root 61910 0.0 0.2 7292 2480 ?? Ss 10:30AM 0:00.31 sshd: james@ttyp0 (sshd)
root 62018 0.0 0.2 7300 2492 ?? Ss 10:40AM 0:00.19 sshd: kevinw@ttyp1 (sshd)
root 62063 0.0 0.1 2124 848 p0 R+ 10:44AM 0:00.01 grep sshd
root@SRX3600-FW-1%
……
杀光后，发现世界干净很多了。。^_^
{primary:node0}
james@SRX3600-FW-1> show system connections
node0:
--------------------------------------------------------------------------
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 10.111.141.146.55847 10.251.143.1.7804 ESTABLISHED
tcp4 0 0 10.111.141.146.56422 10.244.136.250.22 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.30.48485 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.251.152.212.4002 ESTABLISHED
tcp4 0 0 10.111.141.146.22 10.101.149.27.9228 TIME_WAIT
tcp4 0 0 10.111.141.146.60840 10.251.139.21.23 FIN_WAIT_1
tcp4 0 0 10.111.141.146.22 10.101.149.24.23601 TIME_WAIT
tcp4 0 0 10.111.141.146.22 10.101.149.27.35025 TIME_WAIT
tcp4 0 0 129.16.0.1.51627 130.16.1.22.49713 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.24.49713 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.24.64910 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.22.64910 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.22.56881 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.22.58046 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.24.56881 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 130.16.1.24.58046 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.22.49713 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.22.64910 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.24.49713 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.22.56881 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.22.58046 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.24.64910 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.24.56881 ESTABLISHED
tcp4 0 0 129.16.0.1.51627 129.16.1.24.58046 ESTABLISHED
tcp4 0 0 *.22 *.* LISTEN
tcp4 0 0 129.16.0.1.9000 129.16.0.1.61057 ESTABLISHED
tcp4 0 0 129.16.0.1.61057 129.16.0.1.9000 ESTABLISHED
tcp4 0 0 *.7000 *.* LISTEN
tcp4 0 0 *.6156 *.* LISTEN
tcp4 0 0 *.666 *.* LISTEN
tcp4 0 0 *.6159 *.* LISTEN
tcp4 0 0 129.16.0.1.9000 129.16.0.1.53096 ESTABLISHED
tcp4 0 0 129.16.0.1.53096 129.16.0.1.9000 ESTABLISHED
tcp4 0 0 *.9000 *.* LISTEN
tcp4 0 0 *.51627 *.* LISTEN
tcp4 0 0 *.6161 *.* LISTEN
tcp4 0 0 *.31343 *.* LISTEN
tcp4 0 0 *.31341 *.* LISTEN
tcp4 0 0 *.2049 *.* LISTEN
tcp4 0 0 *.6666 *.* LISTEN
tcp4 0 0 *.830 *.* LISTEN
tcp4 0 0 *.514 *.* LISTEN
tcp4 0 0 *.513 *.* LISTEN
tcp4 0 0 *.6234 *.* LISTEN
udp4 0 0 *.49299 *.*
udp46 0 0 *.514 *.*
udp4 0 0 *.514 *.*
udp4 72 0 *.55829 *.*
udp4 0 0 129.16.0.1.123 *.*
udp4 0 0 *.123 *.*
udp4 0 0 *.31342 *.*
udp46 0 0 *.64560 *.*
udp4 0 0 10.111.141.146.64967 *.*
udp46 0 0 *.161 *.*
udp4 0 0 *.161 *.*
udp46 0 0 *.4500 *.*
udp4 0 0 *.4500 *.*
udp46 0 0 *.500 *.*
udp4 0 0 *.500 *.*
udp46 0 0 *.49152 *.*
udp46 0 0 *.4784 *.*
udp46 0 0 *.3784 *.*
udp4 0 0 *.49152 *.*
udp4 0 0 *.4784 *.*
udp4 0 0 *.3784 *.*
udp4 0 0 *.31340 *.*
udp4 0 0 *.31340 *.*
udp4 0 0 *.2049 *.*
udp4 0 0 *.6666 *.*
udp4 0 0 *.6333 *.*
ip4 0 0 *.* *.*
ip4 0 0 *.* *.*
ip4 0 0 *.* *.*
ip4 0 0 *.* *.*
ip4 0 0 *.* *.*
node1:
--------------------------------------------------------------------------
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 *.7000 *.* LISTEN
tcp4 0 0 *.9000 *.* LISTEN
tcp4 0 0 *.6161 *.* LISTEN
tcp4 0 0 *.31343 *.* LISTEN
tcp4 0 0 *.31341 *.* LISTEN
tcp4 0 0 *.2049 *.* LISTEN
tcp4 0 0 *.6666 *.* LISTEN
tcp4 0 0 *.830 *.* LISTEN
tcp4 0 0 *.22 *.* LISTEN
tcp4 0 0 *.514 *.* LISTEN
tcp4 0 0 *.513 *.* LISTEN
tcp4 0 0 *.6234 *.* LISTEN
udp46 0 0 *.514 *.*
udp4 0 0 *.514 *.*
udp46 0 0 *.59430 *.*
udp4 0 0 10.111.141.146.63851 *.*
udp4 0 0 *.31342 *.*
udp46 0 0 *.161 *.*
udp4 0 0 *.161 *.*
udp46 0 0 *.49152 *.*
udp46 0 0 *.4784 *.*
udp46 0 0 *.3784 *.*
udp4 0 0 *.49152 *.*
udp4 0 0 *.4784 *.*
udp4 0 0 *.3784 *.*
udp4 0 0 *.31340 *.*
udp4 0 0 *.31340 *.*
udp4 0 0 130.16.0.1.123 *.*
udp4 0 0 *.123 *.*
udp4 0 0 *.2049 *.*
udp4 0 0 *.6666 *.*
udp4 0 0 *.6333 *.*
ip4 0 0 *.* *.*
ip4 0 0 *.* *.*
{primary:node0}
james@SRX3600-FW-1>
另外有需要云服务器可以了解下创新互联scvps.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。
当前名称：JuniperSRX防火墙系统会话链接的清除-创新互联
浏览地址：http://mswzjz.cn/article/hdghg.html