Complete Tests
The following scenario shows how to place an OSDx router between two machines to allow them to communicate with each other and to provide protection when accessing one another and the external WAN.
Test Simple Ruleset With Queues
Description
Configures the three DUTs that will be used and checks that they are capable of pinging each other but not of connecting via SSH, since these connections are being dropped by the firewall.
Scenario
Step 1: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 2: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=2.44 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 2.440/2.440/2.440/0.000 ms
Step 3: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=1.98 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.981/1.981/1.981/0.000 ms
Step 4: Expect a failure in the following command:
Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 5: Expect a failure in the following command:
Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[Drop].+(SSH not allowed in this network).+$Show output
12/02/2024-20:54:48.310811 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:48.518820 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:48.519237 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:48.938772 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:48.950545 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:49.108318 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:49.163117 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:52512 -> 20.0.0.2:22 12/02/2024-20:54:49.174408 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:52512 -> 20.0.0.2:22 12/02/2024-20:54:49.770790 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22 12/02/2024-20:54:49.782734 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45374 -> 40.0.0.2:22
Test Simple Ruleset With Custom Action-order
Description
Configures the three DUTs that will be used and checks that initially they are capable of pinging each other but after changing the priority of rule actions, ICMP traffic is not passed, but dropped by the firewall.
Scenario
Step 1: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 2: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.875 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.875/0.875/0.875/0.000 ms
Step 3: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=20.1 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 20.056/20.056/20.056/0.000 ms
Step 4: Set the following configuration in DUT0:
set service firewall FW action-order "drop, reject, alert, pass"
Step 5: Expect a failure in the following command:
Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. --- 20.0.0.2 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 6: Expect a failure in the following command:
Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. --- 40.0.0.2 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[Drop].+(ICMP traffic dropped).+$Show output
12/02/2024-20:55:27.309521 [Drop] [**] [1:30:0] ICMP traffic dropped [**] [Classification: (null)] [Priority: 3] {ICMP} 40.0.0.2:8 -> 20.0.0.2:0 12/02/2024-20:55:28.444677 [Drop] [**] [1:30:0] ICMP traffic dropped [**] [Classification: (null)] [Priority: 3] {ICMP} 20.0.0.2:8 -> 40.0.0.2:0
Test Simple Ruleset With Queues IDS Mode
Description
Configures the three DUTs that will be used and checks that they are capable of pinging each other and of connecting via SSH. Since the firewall is set to IDS mode, these connections are not being dropped.
Scenario
Step 1: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base.rules set service firewall FW mode monitor interfaces eth0,eth1 set service firewall FW logging outputs fast
Step 2: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.565 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.565/0.565/0.565/0.000 ms
Step 3: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.487 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.487/0.487/0.487/0.000 ms
Step 4: Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 19:44:04 2024 from 10.0.0.2 admin@osdx$
Step 5: Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 19:29:37 2024 admin@osdx$
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[wDrop].+(SSH not allowed in this network).+$Show output
12/02/2024-20:55:57.769815 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.769909 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.813003 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.837205 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.837865 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.852779 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.852681 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.852773 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.852889 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22 12/02/2024-20:55:57.856043 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55454 -> 40.0.0.2:22
Test Encrypted Ruleset
Description
Configures the three DUTs, encrypts an arbitrary ruleset file and checks that the firewall is handling said file as expected. The firewall behaves the same way as for Test Simple Ruleset With Queues but with an encrypted ruleset.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/base-enc.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 272 100 272 0 0 90666 0 --:--:-- --:--:-- --:--:-- 90666
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base-enc.rules set service firewall FW ruleset file running://base-enc.rules digest sha512 set service firewall FW ruleset file running://base-enc.rules iterations 100000 set service firewall FW ruleset file running://base-enc.rules key-length 256 set service firewall FW ruleset file running://base-enc.rules password 'dV^F$@i!zLWLG#ZLU55ditGi' set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.757 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.757/0.757/0.757/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.663 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.663/0.663/0.663/0.000 ms
Step 5: Expect a failure in the following command:
Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 6: Expect a failure in the following command:
Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[Drop].+(SSH not allowed in this network).+$Show output
12/02/2024-20:56:30.067813 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:30.271683 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:30.271744 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:30.680497 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:30.687629 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:30.871829 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:30.911389 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:45494 -> 20.0.0.2:22 12/02/2024-20:56:30.932092 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:45494 -> 20.0.0.2:22 12/02/2024-20:56:31.507843 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22 12/02/2024-20:56:31.521120 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36422 -> 40.0.0.2:22
Test Encrypted Patch
Description
Configures three DUTs, encrypts a patch that allows SSH communication between the DUTs and enables bypass. The original input file was:
drop ssh any any -> any any (msg: "SSH not allowed in this network"; sid: 2;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)
After applying the following patch:
1c1
< drop ssh any any -> any any (msg: "SSH not allowed in this network"; sid: 2;)
---
> alert ssh any any -> any any (msg: "SSH traffic detected - bypassing"; bypass; sid: 2;)
The resulting file must be:
alert ssh any any -> any any (msg: "SSH traffic detected - bypassing"; bypass; sid: 2;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)
This not only allows SSH traffic but also enables the bypass feature (not tested here yet).
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/base-enc.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 272 100 272 0 0 16000 0 --:--:-- --:--:-- --:--:-- 16000
Step 2: Run command file copy http://10.215.168.1/~robot/base-enc.diff1 running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 256 100 256 0 0 85333 0 --:--:-- --:--:-- --:--:-- 85333
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base-enc.rules set service firewall FW ruleset file running://base-enc.rules digest sha512 set service firewall FW ruleset file running://base-enc.rules iterations 100000 set service firewall FW ruleset file running://base-enc.rules key-length 256 set service firewall FW ruleset file running://base-enc.rules password 'dV^F$@i!zLWLG#ZLU55ditGi' set service firewall FW ruleset patch running://base-enc.diff1 set service firewall FW ruleset patch running://base-enc.diff1 digest sha512 set service firewall FW ruleset patch running://base-enc.diff1 iterations 100000 set service firewall FW ruleset patch running://base-enc.diff1 key-length 256 set service firewall FW ruleset patch running://base-enc.diff1 password '5YG9F@H4V!#s&LVKqQ6uehy7' set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=8.52 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 8.522/8.522/8.522/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.762 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.762/0.762/0.762/0.000 ms
Step 6: Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:55:56 2024 from 40.0.0.2 admin@osdx$
Step 7: Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:55:57 2024 from 20.0.0.2 admin@osdx$
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(SSH traffic detected - bypassing).+$Show output
12/02/2024-20:57:07.100957 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:48838 -> 20.0.0.2:22 12/02/2024-20:57:07.550141 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33894 -> 40.0.0.2:22
Test Compressed Ruleset With Patch
Description
Configures three DUTs, places a patch between the DUTs that allows SSH
communication, and enables bypass. In addition, there are two source
rules that are compressed into a tar.gz file whose content is used
by the firewall to define the rules. One of the files is named base.rules``and
is the file that the patch is meant for. The second one
is ``test-performance.rules whose contents are:: The original input file was:
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 4;)
This rule simply bypasses traffic that is deemed “performance traffic”,
which is directly associated with the monitor test performance command.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/ruleset.tar.gz running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 331 100 331 0 0 107k 0 --:--:-- --:--:-- --:--:-- 107k
Step 2: Run command file copy http://10.215.168.1/~robot/base.diff1 running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 238 100 238 0 0 79333 0 --:--:-- --:--:-- --:--:-- 79333
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset compressed running://ruleset.tar.gz set service firewall FW ruleset patch running://base.diff1 set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.762 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.762/0.762/0.762/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.586 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.586/0.586/0.586/0.000 ms
Step 6: Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:57:06 2024 from 40.0.0.2 admin@osdx$
Step 7: Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:57:07 2024 from 20.0.0.2 admin@osdx$
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(SSH traffic detected - bypassing).+$Show output
12/02/2024-20:57:38.128995 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:55246 -> 20.0.0.2:22 12/02/2024-20:57:38.550169 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39676 -> 40.0.0.2:22
Step 9: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 1 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 58912 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 13.6 MBytes 114 Mbits/sec 0 503 KBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-1.00 sec 13.6 MBytes 114 Mbits/sec 0 sender [ 5] 0.00-1.03 sec 11.6 MBytes 94.4 Mbits/sec receiver iperf Done.
Step 10: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
12/02/2024-20:57:38.128995 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:55246 -> 20.0.0.2:22 12/02/2024-20:57:38.550169 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39676 -> 40.0.0.2:22 12/02/2024-20:57:39.371127 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58910 -> 40.0.0.2:5001 12/02/2024-20:57:39.375324 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58912 -> 40.0.0.2:5001
Test Single File In Compressed Ruleset
Description
Compresses two ruleset files but only chooses the test-performance.rules
from within the compressed file. Lastly, checks that performance traffic is detected but
no message is generated for SSH traffic, indicating that only one file is
being used.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/ruleset.tar.gz running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 331 100 331 0 0 20687 0 --:--:-- --:--:-- --:--:-- 20687
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset compressed running://ruleset.tar.gz set service firewall FW ruleset compressed running://ruleset.tar.gz file test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=2.46 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 2.456/2.456/2.456/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.656 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.656/0.656/0.656/0.000 ms
Step 5: Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:57:38 2024 from 40.0.0.2 admin@osdx$
Step 6: Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:57:39 2024 from 20.0.0.2 admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output does not match the following regular expressions:
(?m)^.+(SSH traffic detected - bypassing).+$Show output
No fast logs yet for client "FW"
Step 8: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 1 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 43584 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 15.4 MBytes 129 Mbits/sec 0 574 KBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-1.00 sec 15.4 MBytes 129 Mbits/sec 0 sender [ 5] 0.00-1.01 sec 12.9 MBytes 107 Mbits/sec receiver iperf Done.
Step 9: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
12/02/2024-20:58:12.845392 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43576 -> 40.0.0.2:5001 12/02/2024-20:58:12.850062 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43584 -> 40.0.0.2:5001
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the previous test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 43000 0 --:--:-- --:--:-- --:--:-- 43000
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q set service firewall FW stream bypass
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.884 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.884/0.884/0.884/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=1.04 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.044/1.044/1.044/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 34322 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 11.6 MBytes 97.0 Mbits/sec 0 426 KBytes [ 5] 1.00-2.01 sec 13.6 MBytes 113 Mbits/sec 0 1022 KBytes [ 5] 2.01-3.00 sec 15.0 MBytes 126 Mbits/sec 0 1.37 MBytes [ 5] 3.00-4.00 sec 26.2 MBytes 221 Mbits/sec 0 2.45 MBytes [ 5] 4.00-5.00 sec 38.8 MBytes 325 Mbits/sec 157 1.38 MBytes [ 5] 5.00-6.00 sec 65.0 MBytes 545 Mbits/sec 30 1.03 MBytes [ 5] 6.00-7.00 sec 61.2 MBytes 514 Mbits/sec 0 1.10 MBytes [ 5] 7.00-8.00 sec 63.8 MBytes 533 Mbits/sec 0 1.15 MBytes [ 5] 8.00-9.00 sec 63.8 MBytes 535 Mbits/sec 0 1.18 MBytes [ 5] 9.00-10.01 sec 58.8 MBytes 492 Mbits/sec 0 1.20 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.01 sec 418 MBytes 350 Mbits/sec 187 sender [ 5] 0.00-10.01 sec 416 MBytes 349 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
12/02/2024-20:58:44.719222 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34314 -> 40.0.0.2:5001 12/02/2024-20:58:44.722354 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34322 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 7166 0 --:--:-- --:--:-- --:--:-- 7166
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=8.57 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 8.565/8.565/8.565/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.689 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.689/0.689/0.689/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 32956 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 15.6 MBytes 131 Mbits/sec 0 653 KBytes [ 5] 1.00-2.00 sec 26.2 MBytes 220 Mbits/sec 0 1.80 MBytes [ 5] 2.00-3.00 sec 10.0 MBytes 83.9 Mbits/sec 0 2.00 MBytes [ 5] 3.00-4.00 sec 23.8 MBytes 199 Mbits/sec 17 1.54 MBytes [ 5] 4.00-5.00 sec 47.5 MBytes 400 Mbits/sec 0 1.74 MBytes [ 5] 5.00-6.00 sec 57.5 MBytes 482 Mbits/sec 0 1.85 MBytes [ 5] 6.00-7.00 sec 52.5 MBytes 440 Mbits/sec 116 1.37 MBytes [ 5] 7.00-8.00 sec 57.5 MBytes 480 Mbits/sec 0 1.45 MBytes [ 5] 8.00-9.00 sec 66.2 MBytes 556 Mbits/sec 77 1.08 MBytes [ 5] 9.00-10.00 sec 81.2 MBytes 685 Mbits/sec 0 1.15 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 438 MBytes 367 Mbits/sec 210 sender [ 5] 0.00-10.02 sec 435 MBytes 364 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
12/02/2024-20:59:31.062092 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:32948 -> 40.0.0.2:5001 12/02/2024-20:59:31.064379 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:32956 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
-- Logs begin at Mon 2024-12-02 20:59:15 UTC, end at Mon 2024-12-02 20:59:41 UTC. -- Dec 02 20:59:15.502022 osdx systemd-journald[31677]: Runtime journal (/run/log/journal/1d07d1333cb24d498692b025d3740112) is 4.0M, max 16.0M, 11.9M free. Dec 02 20:59:15.550307 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'system journal clear'. Dec 02 20:59:16.597238 osdx osdx-coredump[18712]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Dec 02 20:59:16.624409 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'system coredump delete all'. Dec 02 20:59:17.986431 osdx OSDxCLI[18241]: User 'admin' entered the configuration menu. Dec 02 20:59:18.189084 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Dec 02 20:59:18.336678 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Dec 02 20:59:18.450930 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Dec 02 20:59:18.570464 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Dec 02 20:59:18.699908 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Dec 02 20:59:18.828505 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Dec 02 20:59:19.024464 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Dec 02 20:59:19.108465 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Dec 02 20:59:19.148348 osdx systemd-udevd[18835]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable. Dec 02 20:59:19.148416 osdx systemd-udevd[18835]: Using default interface naming scheme 'v240'. Dec 02 20:59:19.196556 osdx systemd-udevd[18835]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable. Dec 02 20:59:19.423733 osdx cfgd[1120]: [18241]Completed change to active configuration Dec 02 20:59:19.487594 osdx OSDxCLI[18241]: User 'admin' committed the configuration. Dec 02 20:59:19.556918 osdx OSDxCLI[18241]: User 'admin' left the configuration menu. Dec 02 20:59:22.821405 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Dec 02 20:59:22.996095 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Dec 02 20:59:23.146144 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Dec 02 20:59:24.096643 osdx file_operation[18920]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Dec 02 20:59:24.143148 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Dec 02 20:59:24.430705 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Dec 02 20:59:24.658378 osdx OSDxCLI[18241]: User 'admin' entered the configuration menu. Dec 02 20:59:24.807438 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Dec 02 20:59:25.007253 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Dec 02 20:59:25.186047 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Dec 02 20:59:25.364400 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Dec 02 20:59:25.504139 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Dec 02 20:59:25.661122 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy in FW_PWAN'. Dec 02 20:59:25.811687 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy out FW_PWAN'. Dec 02 20:59:25.947359 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Dec 02 20:59:26.104606 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Dec 02 20:59:26.228888 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Dec 02 20:59:26.329619 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW_PWAN'. Dec 02 20:59:26.472627 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN'. Dec 02 20:59:26.625866 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE'. Dec 02 20:59:26.777158 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Dec 02 20:59:26.896029 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Dec 02 20:59:27.035328 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Dec 02 20:59:27.377019 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Dec 02 20:59:27.527077 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Dec 02 20:59:27.669652 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Dec 02 20:59:27.779078 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Dec 02 20:59:28.159614 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Dec 02 20:59:28.306993 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Dec 02 20:59:28.534118 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Dec 02 20:59:28.642891 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Dec 02 20:59:28.779746 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Dec 02 20:59:28.949615 osdx OSDxCLI[18241]: User 'admin' added a new cfg line: 'set traffic policy FW_PWAN rule 1 action enqueue FW_Q'. Dec 02 20:59:29.786702 osdx systemd[1]: Reloading. Dec 02 20:59:29.917638 osdx systemd[1]: Starting Suricata client "FW" service... Dec 02 20:59:29.938004 osdx systemd[1]: Started Suricata client "FW" service. Dec 02 20:59:30.302337 osdx INFO[19066]: Rules successfully loaded Dec 02 20:59:30.307657 osdx cfgd[1120]: [18241]Completed change to active configuration Dec 02 20:59:30.313601 osdx OSDxCLI[18241]: User 'admin' committed the configuration. Dec 02 20:59:30.362101 osdx OSDxCLI[18241]: User 'admin' left the configuration menu. Dec 02 20:59:31.064470 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=45593 DF PROTO=TCP SPT=32948 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Dec 02 20:59:31.064568 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=42314 DF PROTO=TCP SPT=32956 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Dec 02 20:59:34.149764 osdx zebra[1073]: [WPPMZ-G9797] if_zebra_speed_update: eth1.201 old speed: 0 new speed: 4294967295 Dec 02 20:59:34.191166 osdx zebra[1073]: [WPPMZ-G9797] if_zebra_speed_update: eth1.101 old speed: 0 new speed: 4294967295 Dec 02 20:59:41.563910 osdx OSDxCLI[18241]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then, the test is broaden by configuring “Capture bypass drop” to also avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 9923 0 --:--:-- --:--:-- --:--:-- 9923
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765 set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.734 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.734/0.734/0.734/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=7.37 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 7.369/7.369/7.369/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 52546 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 12.3 MBytes 103 Mbits/sec 0 454 KBytes [ 5] 1.00-2.00 sec 6.90 MBytes 57.9 Mbits/sec 0 624 KBytes [ 5] 2.00-3.00 sec 13.8 MBytes 115 Mbits/sec 1 1.41 KBytes [ 5] 3.00-4.00 sec 8.75 MBytes 73.4 Mbits/sec 0 1.29 MBytes [ 5] 4.00-5.00 sec 10.0 MBytes 83.9 Mbits/sec 1 1.50 MBytes [ 5] 5.00-6.00 sec 23.8 MBytes 199 Mbits/sec 301 522 KBytes [ 5] 6.00-7.00 sec 65.0 MBytes 545 Mbits/sec 0 826 KBytes [ 5] 7.00-8.00 sec 90.0 MBytes 755 Mbits/sec 0 1.06 MBytes [ 5] 8.00-9.00 sec 75.0 MBytes 629 Mbits/sec 0 1.27 MBytes [ 5] 9.00-10.00 sec 97.5 MBytes 817 Mbits/sec 0 1.45 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 403 MBytes 338 Mbits/sec 303 sender [ 5] 0.00-10.02 sec 399 MBytes 334 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
12/02/2024-21:00:17.442045 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52542 -> 40.0.0.2:5001 12/02/2024-21:00:17.455735 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52546 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
icmp 1 18 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=374 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=374 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=52542 dport=5001 packets=18 bytes=1390 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=52542 packets=15 bytes=1097 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=52546 dport=5001 packets=290671 bytes=436002201 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=52546 packets=17599 bytes=917028 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=58484 dport=2055 packets=1 bytes=114 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=2055 dport=58484 packets=0 bytes=0 mark=0 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=74 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=74 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.5 (conntrack-tools): 5 flow entries have been shown.
Step 9: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 458 0 --:--:-- --:--:-- --:--:-- 459
Step 10: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 11: Set the following configuration in DUT0:
set service firewall FW ruleset file running://drop-performance.rules set service firewall FW bypass action drop set connmark mark 147652983 set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 12: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 13: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
12/02/2024-21:00:17.442045 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52542 -> 40.0.0.2:5001 12/02/2024-21:00:17.455735 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52546 -> 40.0.0.2:5001 12/02/2024-21:00:33.734868 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47458 -> 40.0.0.2:5000
Step 14: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=47458 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=47458 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 conntrack v1.4.5 (conntrack-tools): 1 flow entries have been shown.
Step 15: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP 4 5 210 270 2 FW_SEL_ENQUEUE 1 1 60 60 --------------------------------------------------------------------- Total 5 5 270 270 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP 6 9 499 700 2 FW_SEL_ENQUEUE 3 3 201 201 --------------------------------------------------------------------- Total 9 9 700 700
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 8600 0 --:--:-- --:--:-- --:--:-- 8600
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765 set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set service firewall FW stream bypass action accept set conntrack offload-flag set system offload timeout 60 set system conntrack timeout tcp established 60 set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.08 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.082/1.082/1.082/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=4.83 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 4.828/4.828/4.828/0.000 ms
Step 6: Run command monitor test performance server port 5001 at DUT1.
Step 7: Run command monitor test performance client 40.0.0.2 duration 10 port 5001 at DUT2.
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
12/02/2024-21:01:13.249402 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51714 -> 40.0.0.2:5001 12/02/2024-21:01:13.251514 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51716 -> 40.0.0.2:5001
Step 9: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=77 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=77 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=377 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=377 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=51716 dport=5001 packets=2785 bytes=4173201 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=51716 packets=625 bytes=32580 [ASSURED] [OFFLOAD, packets=2777 bytes=4165500 packets=623 bytes=32468] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=51714 dport=5001 packets=9 bytes=617 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=51714 packets=8 bytes=428 [ASSURED] [OFFLOAD, packets=6 bytes=416 packets=5 bytes=263] mark=129834765 use=2 conntrack v1.4.5 (conntrack-tools): 4 flow entries have been shown.
Test Selectors
Description
Builds a scenario with three DUTs in which some selectors are applied to traffic depending on the network detected. This allows specific selector-based rules to be applied to traffic and with only one firewall instance.
To demonstrate this behavior, two labels will be set:
WANlabel that is applied to every packet going outside the local network.
LANlabel that marks every packet present in the underlying network.
For this purpose, a whole scenario will be used to enable all the features to work:
A compressed, encrypted ruleset will be created that contains
base.rulesas well astest-performance.rules.A patch that will upgrade
base.rulesso it contains rules based on labels. The expected final result will be:alert ssh any any -> any any (msg: "Local SSH traffic - bypassing..."; selector: LOCAL; bypass; sid: 1; flow: established, to_server;) drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23; selector: WAN;) pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;) drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; selector: WAN, LOCAL; sid: 4; flow: established, to_server;)
Hence, the following will be tested:
SSH connection is working between the LAN nodes - DUT1 and DUT2
It is impossible to get the
nids.htmlfile (i.e., a malicious file) from the WAN.ICMP messages are allowed from any node within the network.
Traffic performance tests are allowed for both the WAN and LOCAL selectors but not on port 5000.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/ruleset.tar.gz.aes256 running://ruleset.tar.gz force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 352 100 352 0 0 88000 0 --:--:-- --:--:-- --:--:-- 88000
Step 2: Run command file copy http://10.215.168.1/~robot/base.diff2-aes256 running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 528 100 528 0 0 171k 0 --:--:-- --:--:-- --:--:-- 171k
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset compressed running://ruleset.tar.gz set service firewall FW ruleset compressed running://ruleset.tar.gz digest sha512 set service firewall FW ruleset compressed running://ruleset.tar.gz iterations 100000 set service firewall FW ruleset compressed running://ruleset.tar.gz key-length 256 set service firewall FW ruleset compressed running://ruleset.tar.gz password 'dV^F$@i!zLWLG#ZLU55ditGi' set service firewall FW ruleset patch running://base.diff2-aes256 set service firewall FW ruleset patch running://base.diff2-aes256 digest sha512 set service firewall FW ruleset patch running://base.diff2-aes256 iterations 100000 set service firewall FW ruleset patch running://base.diff2-aes256 key-length 256 set service firewall FW ruleset patch running://base.diff2-aes256 password '5YG9F@H4V!#s&LVKqQ6uehy7' set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic label LOCAL set traffic label WAN set traffic group address LAN element 40.0.0.0/24 set traffic group address LAN element 20.0.0.0/24 set traffic selector LAN rule 1 destination address-group LAN set traffic selector LAN rule 1 source address-group LAN set traffic policy FW_PLAN rule 1 selector LAN set traffic policy FW_PLAN rule 1 set label LOCAL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 set label WAN set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=2.26 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 2.258/2.258/2.258/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=5.83 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 5.829/5.829/5.829/0.000 ms
Step 6: Init an SSH connection from DUT1 to IP address 20.0.0.2 with the user admin:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:58:11 2024 from 40.0.0.2 admin@osdx$
Step 7: Init an SSH connection from DUT2 to IP address 40.0.0.2 with the user admin:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.10.1.10 This system includes free software. Contact Teldat for licenses information and source code. Last login: Mon Dec 2 20:58:12 2024 from 20.0.0.2 admin@osdx$
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Local SSH traffic - bypassing...).+$Show output
12/02/2024-21:01:51.452626 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:41482 -> 20.0.0.2:22 12/02/2024-21:01:52.060073 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35092 -> 40.0.0.2:22
Step 9: Expect a failure in the following command:
Init an SSH connection from DUT1 to IP address 10.215.168.1 with the user admin:
admin@DUT1$ ssh admin@10.215.168.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 10: Expect a failure in the following command:
Init an SSH connection from DUT2 to IP address 10.215.168.1 with the user admin:
admin@DUT2$ ssh admin@10.215.168.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Outgoing TCP traffic to port 22 from LAN to WAN).+$Show output
12/02/2024-21:01:51.452626 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:41482 -> 20.0.0.2:22 12/02/2024-21:01:52.060073 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35092 -> 40.0.0.2:22 12/02/2024-21:01:52.795611 [Drop] [**] [1:5:0] Outgoing TCP traffic to port 22 from LAN to WAN [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:33050 -> 10.215.168.1:22 12/02/2024-21:01:55.030871 [Drop] [**] [1:5:0] Outgoing TCP traffic to port 22 from LAN to WAN [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41306 -> 10.215.168.1:22
Step 12: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 57136 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 14.3 MBytes 120 Mbits/sec 0 595 KBytes [ 5] 1.00-2.00 sec 12.5 MBytes 105 Mbits/sec 0 1.02 MBytes [ 5] 2.00-3.00 sec 12.5 MBytes 105 Mbits/sec 0 1.49 MBytes [ 5] 3.00-4.00 sec 10.0 MBytes 83.9 Mbits/sec 0 1.78 MBytes [ 5] 4.00-5.00 sec 28.8 MBytes 241 Mbits/sec 66 1.97 MBytes [ 5] 5.00-6.00 sec 72.5 MBytes 608 Mbits/sec 0 2.17 MBytes [ 5] 6.00-7.00 sec 71.2 MBytes 598 Mbits/sec 66 1.64 MBytes [ 5] 7.00-8.00 sec 71.2 MBytes 598 Mbits/sec 19 1.22 MBytes [ 5] 8.00-9.00 sec 68.8 MBytes 577 Mbits/sec 0 1.30 MBytes [ 5] 9.00-10.00 sec 81.2 MBytes 681 Mbits/sec 0 1.37 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 443 MBytes 372 Mbits/sec 151 sender [ 5] 0.00-10.01 sec 441 MBytes 370 Mbits/sec receiver iperf Done.
Step 13: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
12/02/2024-21:01:57.479403 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57136 -> 40.0.0.2:5001 12/02/2024-21:02:07.919988 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:08.139167 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:08.359111 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:08.807195 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:09.703187 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:10.952740 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:11.022731 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:11.035136 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000 12/02/2024-21:02:11.243175 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43868 -> 40.0.0.2:5000
Test XDP Filtering
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 2777 0 --:--:-- --:--:-- --:--:-- 2777
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://drop-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL_ENQUEUE set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q set service firewall FW stream bypass action drop set xdp-early-drop eth1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.940 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.940/0.940/0.940/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.770 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.770/0.770/0.770/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
12/02/2024-21:02:45.140103 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58416 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 58416 5000 yes 201 0 8 673 40.0.0.2 20.0.0.2 5000 58416 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250196s ending at 1733173369.299175 XDP_DROP 9 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 13 pkts ( 0 pps) 1 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
12/02/2024-21:02:45.140103 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58416 -> 40.0.0.2:5000 12/02/2024-21:02:49.602781 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:54066 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 54066 5001 no 201 0 0 0 40.0.0.2 20.0.0.2 5001 54066 no 201 0 0 0 20.0.0.2 40.0.0.2 58416 5000 yes 201 0 11 847 40.0.0.2 20.0.0.2 5000 58416 yes 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250233s ending at 1733173373.569634 XDP_DROP 11 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 34 pkts ( 0 pps) 2 KiB ( 0 Mbits/s)