针对防火墙IPSec业务不通或业务丢包问题，防火墙如何做流量统计、远程抓包、报文示踪

  system
 [sysname] acl 3555
 [sysname-acl-adv-3555] rule permit icmp source 10.82.100.215 0 destination 10.65.32.204 0
 [sysname-acl-adv-3555] rule permit icmp source 10.65.32.204 0 destination 10.82.100.215 0
 [sysname-acl-adv-3555] rule permit ip source X.X.X.X 0 destination Y.Y.Y.Y 0                            -X.X.X.X是IKE协商本端地址，Y.Y.Y.Y是IKE协商对端地址
 [sysname-acl-adv-3555] rule permit ip source Y.Y.Y.Y 0 destination X.X.X.X 0
 [sysname-acl-adv-3555] quit

[sysname] display firewall session table verbose source inside 10.82.100.215 destination inside 10.65.32.204
[sysname] display firewall session table verbose source inside Y.Y.Y.Y
[sysname] display firewall session table verbose source inside 10.82.100.215 destination inside 10.65.32.204
[sysname] diagnose
[sysname-diagnose] display firewall session table detail source inside 10.82.100.215 destination inside 10.65.32.204
[sysname] display ipsec sa remote Y.Y.Y.Y

[sysname] diagnose
[sysname-diagnose] reset firewall statistics acl all
[sysname-diagnose] firewall statistics acl 3555 enable
[sysname-diagnose] display firewall statistics acl
[sysname-diagnose] undo firewall statistics acl
[sysname-diagnose] reset firewall statistics acl all

system
[sysname] packet-capture ipv4-packet 3555 interface Eth-Trunk1
[sysname] packet-capture ipv4-packet 3555 interface GigabitEthernet1/0/7
[sysname] packet-capture startup packet-len 1500 packet-num 1000
[sysname] packet-capture queue 0 to-file 111.cap
[sysname] undo packet-capture

terminal debugging
terminal monitor
debugging dataplane trace acl 3555 number 10
undo terminal debugging
undo terminal monitor
undo debugging all