UnionPay replacement equipment caused link outage problem resolution record

China UnionPay has two links to access the downlink Shanshi Firewall E2860, which are

Ethernet0/3 telecom interface, local IP:x.x.125.134

Telecom interface peer IP:x.x.125.133

Mobile aggregation interface VLAN212, native IP:x.x.126.134

Mobile aggregation interface peer IP:VLAN212, IP:x.x.126.133

1. On the evening of November 22,2017, Shanghai China UnionPay replaced its access router. After going to work on the morning of November 23rd, I found that the link between our company and UnionPay was disconnected. Shanghai UnionPay could communicate with the local ping through the local IP, but the local IP could not ping the peer IP.

After checking, the MAC address bound to the opposite end IP needs to be updated.

In the web interface of Rock Firewall, in Policy / ARP Defense / ARP binding:

Change the MAC address corresponding to the IP:x.x.125.133 of the telecom interface to x.x.9c00

Change the MAC address corresponding to IP:VLAN212 and IP:x.x.126.133 of mobile aggregation interface to x.x.c200

As shown in the following figure:

After the update, the local end and the peer can communicate with each other through ping.

Xiamen local withholding is normal.

2. The xxx23 and xxx24 ports of UnionPay's access to the x.x.x.213 of the gas system are blocked.

In the policy / NAT/ destination NAT

Article 22 Strategy

X.x.x.213nat points to an error and points to another error IP, causing the port xxx23,xxx24 in UnionPay to the group x.x.x.76 to be blocked.

Disable this policy

As shown in the following figure:

After disabling the 22nd policy

After testing, the link is normal and the business is back to normal.