Dell Networking |SONiC |无法将 SONiC 交换机注册到 SCG

下面是一个示例网络图。

以下是将 SONiC 交换机注册到 SCG 的过程，并符合一些条件。

1.通过以下链接查看兼容性表。

     安全连接网关5.x — 虚拟版本支持矩阵 （P45）

2.验证 SONiC 交换机与 SCG 之间的网络连接。

test_SCG:~ # ping 10.123.4.141
PING 10.123.4.141 (10.123.4.141) 56(84) bytes of data.
64 bytes from 10.123.4.141: icmp_seq=1 ttl=63 time=0.201 ms
64 bytes from 10.123.4.141: icmp_seq=2 ttl=63 time=0.240 ms
64 bytes from 10.123.4.141: icmp_seq=3 ttl=63 time=0.208 ms
64 bytes from 10.123.4.141: icmp_seq=4 ttl=63 time=0.215 ms

3.验证 SCG 可以通过 SSH 登录 SONiC 交换机。

test_SCG:~ # ssh admin@10.123.4.141
Debian GNU/Linux 10
admin@10.123.4.141's password:
Linux S5448F-ON-1 5.10.0-21-amd64 #1 SMP Debian 5.10.162-1 (2023-01-21) x86_64
You are on
  ____   ___  _   _ _  ____
 / ___| / _ \| \ | (_)/ ___|
 \___ \| | | |  \| | | |
  ___) | |_| | |\  | | |___
 |____/ \___/|_| \_|_|\____|

-- Software for Open Networking in the Cloud --

Unauthorized access and/or use are prohibited.
All access and/or use are subject to monitoring.

Help:    http://azure.github.io/SONiC/

Last login: Mon Feb 24 08:58:43 2025 from 10.89.248.92
admin@S5448F-ON-1:~$
admin@S5448F-ON-1:~$ show version

SONiC Software Version: SONiC-OS-4.2.0-Enterprise_Premium
Product: Enterprise SONiC Distribution by Dell Technologies
Distribution: Debian 10.13
Kernel: 5.10.0-21-amd64
Config DB Version: version_4_2_1
Build commit: b3aea3ecc9
Build date: Wed Nov 29 17:28:10 UTC 2023
Built by: sonicbld@bld-lvn-csg-02

Platform: x86_64-dellemc_s5448f-r0
HwSKU: DellEMC-S5448f-C48O8
ASIC: broadcom

4.验证 SONiC 交换机以及 SONiC 交换机与 SCG 之间的任何设备是否允许 TCP 8080。 

[This is the case where TCP 8080 is denied by SONiC switch or between SONiC switch and SCG.]
test_SCG:~ # telnet 10.123.4.141 8080
Trying 10.123.4.141...
^C

[This is the case where TCP 8080 is permitted by SONiC switch.]
test_SCG:~ # telnet 10.123.4.141 8080
Trying 10.123.4.141...
Connected to 10.123.4.141.
Escape character is '^]'.

Connection closed by foreign host.

5.将 SONiC 交换机添加到 SCG 中。

如有必要，请在注册 SONiC 交换机之前创建一个新帐户。 

如果没有 ACL 阻止 SCG 和 SONiC 交换机之间的 TCP 端口 8080 （gNMI） 和 22 （SSH），则 SONiC 交换机注册将成功，如下所示。

这是在 SONiC 交换机上捕获的数据包。

如果 SONiC 交换机拒绝 TCP 端口 8080，则 SONiC 交换机的注册将失败，并显示以下错误，如下面的屏幕截图所示。

S5448F-ON-1# show running-configuration line vty
!
line vty
 service-policy type qos in oob-qos-policy
  ip access-group controlplane in

S5448F-ON-1# show ip access-lists
ip access-list controlplane
    seq 1 permit tcp host 10.123.5.143 host 10.123.4.141 eq 8080
    seq 2 permit tcp host 10.123.5.143 host 10.123.4.141 eq 443
    seq 3 deny tcp any host 10.123.4.141 eq 8080
    seq 4 deny tcp any host 10.123.4.141 eq 443
    seq 10 permit tcp any any
S5448F-ON-1# configure terminal
S5448F-ON-1(config)# ip access-list controlplane
S5448F-ON-1(config-ipv4-acl)# no seq 1