Network engineers and security administrators troubleshooting connectivity issues on Juniper SSG devices.
Investigating why traffic between two specific hosts is being dropped or misrouted through the firewall.
Use cases
About
The Juniper SSG - ScreenOS Running "debug flow basic" mind map template provides a 12-step procedure for network engineers to safely capture and analyze packet flow debug output on Juniper SSG firewalls running ScreenOS. It covers essential commands such as 'set console dbuf', 'set ffilter src-ip x.x.x.x dst-ip y.y.y.y', and 'get db stream', along with buffer management and filter cleanup. This template serves as a practical cheat sheet for troubleshooting connectivity issues, ensuring debugs are captured without overwhelming the CPU. The structured step-by-step layout includes command syntax, descriptions, and optional settings like increasing the debug buffer to 4096 KB. By following this guide, engineers can efficiently isolate flow problems and export debug data via TFTP for further analysis.
Terms and ConditionsWhen to use this template
Security operations teams performing change validation or post-deployment testing.
Validating that new firewall policies or NAT rules are applied correctly before production deployment.
Senior network troubleshooters and support engineers handling complex escalations.
Capturing detailed packet flow logs for root cause analysis of intermittent network problems.
How to use this template
Step 1
Open and Prepare the Debugging Environment
Open the template in Xmind and follow the initial steps to clear existing debugs and set the console buffer for safe data capture.
Step 2
Configure Flow Filters and Capture Traffic
Input your specific source and destination IP addresses into the flow filter commands and execute the capture sequence as outlined in the map.
Step 3
Analyze Results and Document Findings
Use the 'get db stream' command to view the output and then customize the template by attaching your specific debug notes or screenshots.
Frequently asked questions
The 'debug flow basic' command enables packet flow debugging on ScreenOS, allowing engineers to trace how packets are processed through the firewall. It helps identify issues like policy mismatches, NAT problems, or routing errors.
Using 'set console dbuf' redirects debug output to the debug buffer instead of the console, preventing high CPU usage. The command 'get console' should then show 'debug:buffer' to confirm the setting.
Use 'set ffilter src-ip <source> dst-ip <destination>' to filter packets between two IPs. Repeat the command with swapped IPs to capture bidirectional traffic. Verify with 'get ffilter'.
Yes, use 'set db size 4096' to set the buffer to 4 MB (maximum). The buffer is circular, so a larger size helps capture more data before overwriting. Check with 'get db info'.
After stopping debugs with 'undebug all', use 'get db stream > tftp <server-ip> <filename>' to send the buffer contents to a TFTP server for offline analysis.
Run 'unset ffilter' twice to remove both flow filters, then 'unset db size' to reset the buffer to default. Verify with 'get ffilter' and 'get db info'.
Got an inspiring template?
Share your mind map templates with creators around the world and start earning from your work.
Free template