Juniper SRX Troubleshooting Commands: Show, Log and Flow

When a Juniper SRX firewall misbehaves, the fastest path to the answer is a small set of well-chosen Junos operational commands: flow sessions to see exactly which policy matched a connection, display set to read the configuration as flat lines, rollback compare to see what changed, and traffic monitoring to capture packets. This article collects the most useful SRX troubleshooting commands from TunnelsUP's field guide, with explanations of what each output tells you.

Configuration Inspection

user@SRX1> show | display set

Displays the configuration as single set lines instead of stanzas - much easier to search: show | display set | match interface.

user@SRX1> show | compare rollback 5

Shows the differences between the active configuration and rollback 5 - invaluable for finding who changed what before an incident.

Security Flow Analysis

user@SRX1> show security flow session
Session ID: 18999, Policy name: POL-INSIDE-TO-OUTSIDE/6, Timeout: 1632
  In: 172.16.200.43/37689 --> 199.199.199.199/443;tcp, If: ge-0/0/1.0
  Out: 199.199.199.199/443 --> 200.200.200.200/8915;tcp, If: ge-0/0/0.0

Every active connection with the policy that matched it. Filter with show security flow session destination-port 443 or show security flow session summary for aggregate counts.

Health and Alarms

user@SRX1> show chassis routing-engine

A snapshot of CPU, uptime, memory and temperature for each Routing Engine.

user@SRX1> show chassis craft-interface

Front-panel LED status on SRX models with a craft interface.

Logs and Change History

user@SRX1> show log messages | match "RT_FLOW|UI_COMMIT"

Junos relies heavily on log files under /var/log; the messages file plus commit records show every configuration change with the responsible user: show system commit lists commit history.

Traffic Monitoring (Packet Capture)

user@SRX1> monitor traffic interface ge-0/0/1

Live packet capture on the interface (control-plane traffic only - transit traffic is not shown without special configuration).

user@SRX1> monitor traffic interface ge-0/0/1 write-file test.pcap

Writes the capture to a pcap file for offline analysis.

Routing and Interface Checks

user@SRX1> show route
user@SRX1> show interfaces terse
user@SRX1> show arp

Quick triage when traffic is black-holed: confirm the route exists, the interface is up/up, and the ARP entry resolved.

Related articles: Juniper SRX 防火墙配置教程, Juniper SRX chassis cluster configuration, and SRX 14-step internet configuration.

原文链接：http://www.tunnelsup.com/useful-juniper-srx-troubleshooting-commands