华为交换机：禁止设备间的icmp包，bfd还能建立bfd会话吗 答案：可以 （display bfd session all）

华为交换机：禁止设备间的icmp包，bfd还能建立bfd会话吗  答案：可以  （display bfd session all）

答案：可以，因为bfd建立会话用不到icmp的包

sw1:
bfd
bfd 1 bind peer-ip 192.168.2.1
 discriminator local 10
 discriminator remote 20
#
ip route-static 0.0.0.0 0.0.0.0 192.168.1.254
#
interface GE1/0/1
 undo portswitch
 undo shutdown
 ip address 192.168.1.1 255.255.255.0
#

sw2:
bfd
bfd 1 bind peer-ip 192.168.1.1
 discriminator local 20
 discriminator remote 10
#
ip route-static 0.0.0.0 0.0.0.0 192.168.2.254
interface GE1/0/2
 undo portswitch
 undo shutdown
 ip address 192.168.2.1 255.255.255.0
 
 防火墙：
 security-policy                           
 default action permit
 #
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
 add interface GigabitEthernet1/0/1
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet1/0/2
#
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 192.168.1.254 255.255.255.0            
 service-manage ping permit
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 192.168.2.254 255.255.255.0
 service-manage ping permit

<sw1>display bfd session all

重新修改安全策略：

security-policy
 rule name trust-to-untrust
  source-zone trust
  destination-zone untrust
  source-address address-set 192.168.1.1/32
  destination-address address-set 192.168.2.1/32
  action permit
 rule name untrust-to-trust
  source-zone untrust
  destination-zone trust
  source-address address-set 192.168.2.1/32
  destination-address address-set 192.168.1.1/32
  action permit

display bfd session all

禁止sw1与sw2互ping

security-policy
 rule name deny-trust-to-untrust
  source-zone trust
  destination-zone untrust
  source-address address-set 192.168.1.1/32
  destination-address address-set 192.168.2.1/32
  service icmp
  action deny
 rule name deny-untrust-to-trust
  source-zone untrust
  destination-zone trust
  source-address address-set 192.168.2.1/32
  destination-address address-set 192.168.1.1/32
  service icmp
  action deny
 rule name trust-to-untrust
  source-zone trust
  destination-zone untrust                
  source-address address-set 192.168.1.1/32
  destination-address address-set 192.168.2.1/32
  action permit
 rule name untrust-to-trust
  source-zone untrust
  destination-zone trust
  source-address address-set 192.168.2.1/32
  destination-address address-set 192.168.1.1/32
  action permit

结果：bfd建立会话用不到icmp的包

BFD、NQA、SLA（列表、list、全）bfdlist、nqalist、slalist
http://www.zh-cjh.com/wenzhangguilei/976.html
文章归类、所有文章列表、LISTLIST
http://www.zh-cjh.com/wangzhangonggao/2195.html