Dell Networking |SONiC |SONiC 交換器無法註冊至 SCG

下面是一個示例網路圖。

以下是根據部分準則將 SONiC 交換器註冊至 SCG 的程序。

1.從以下連結檢查相容性矩陣。

     安全連線閘道 5.x — Virtual Edition 支援矩陣 （P45）

2.驗證 SONiC 交換器和 SCG 之間的網路連線能力。

test_SCG:~ # ping 10.123.4.141
PING 10.123.4.141 (10.123.4.141) 56(84) bytes of data.
64 bytes from 10.123.4.141: icmp_seq=1 ttl=63 time=0.201 ms
64 bytes from 10.123.4.141: icmp_seq=2 ttl=63 time=0.240 ms
64 bytes from 10.123.4.141: icmp_seq=3 ttl=63 time=0.208 ms
64 bytes from 10.123.4.141: icmp_seq=4 ttl=63 time=0.215 ms

3.確認 SCG 可透過 SSH 登入 SONiC 交換器。

test_SCG:~ # ssh admin@10.123.4.141
Debian GNU/Linux 10
admin@10.123.4.141's password:
Linux S5448F-ON-1 5.10.0-21-amd64 #1 SMP Debian 5.10.162-1 (2023-01-21) x86_64
You are on
  ____   ___  _   _ _  ____
 / ___| / _ \| \ | (_)/ ___|
 \___ \| | | |  \| | | |
  ___) | |_| | |\  | | |___
 |____/ \___/|_| \_|_|\____|

-- Software for Open Networking in the Cloud --

Unauthorized access and/or use are prohibited.
All access and/or use are subject to monitoring.

Help:    http://azure.github.io/SONiC/

Last login: Mon Feb 24 08:58:43 2025 from 10.89.248.92
admin@S5448F-ON-1:~$
admin@S5448F-ON-1:~$ show version

SONiC Software Version: SONiC-OS-4.2.0-Enterprise_Premium
Product: Enterprise SONiC Distribution by Dell Technologies
Distribution: Debian 10.13
Kernel: 5.10.0-21-amd64
Config DB Version: version_4_2_1
Build commit: b3aea3ecc9
Build date: Wed Nov 29 17:28:10 UTC 2023
Built by: sonicbld@bld-lvn-csg-02

Platform: x86_64-dellemc_s5448f-r0
HwSKU: DellEMC-S5448f-C48O8
ASIC: broadcom

4.確認 SONiC 交換器以及 SONiC 交換器和 SCG 之間的任何裝置允許 TCP 8080。 

[This is the case where TCP 8080 is denied by SONiC switch or between SONiC switch and SCG.]
test_SCG:~ # telnet 10.123.4.141 8080
Trying 10.123.4.141...
^C

[This is the case where TCP 8080 is permitted by SONiC switch.]
test_SCG:~ # telnet 10.123.4.141 8080
Trying 10.123.4.141...
Connected to 10.123.4.141.
Escape character is '^]'.

Connection closed by foreign host.

5.將 SONiC 交換器新增至 SCG。

如有必要，請在註冊 SONiC 交換器之前建立新帳戶。 

如果沒有 ACL 來封鎖 SCG 和 SONiC 交換器之間的 TCP 連接埠 8080 （gNMI） 和 22 （SSH），SONiC 交換器就會成功註冊，如下所示。

這是在 SONiC 交換器上擷取的封包。

如果 SONiC 交換器拒絕 TCP 連接埠 8080，SONiC 交換器的註冊將會失敗，並出現以下錯誤，如下方螢幕擷取畫面所示。

S5448F-ON-1# show running-configuration line vty
!
line vty
 service-policy type qos in oob-qos-policy
  ip access-group controlplane in

S5448F-ON-1# show ip access-lists
ip access-list controlplane
    seq 1 permit tcp host 10.123.5.143 host 10.123.4.141 eq 8080
    seq 2 permit tcp host 10.123.5.143 host 10.123.4.141 eq 443
    seq 3 deny tcp any host 10.123.4.141 eq 8080
    seq 4 deny tcp any host 10.123.4.141 eq 443
    seq 10 permit tcp any any
S5448F-ON-1# configure terminal
S5448F-ON-1(config)# ip access-list controlplane
S5448F-ON-1(config-ipv4-acl)# no seq 1