Policy

The following scenarios show how to configure different traffic policies. Policies can be used to manage and classify network packets. traffic selectors can be configured to filter packets based on certain fields.

Test Policy Actions 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different traffic actions are configured to accept, drop or limit incoming traffic.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set traffic policy POLICY rule 1 action accept

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Set the following configuration in DUT0:

del traffic policy POLICY
set traffic policy POLICY rule 1 action drop

Step 5: Expect a failure in the following command: Initiate a udp connection from DUT1 to DUT0 and try to send some messages between both endpoints

admin@DUT0$ monitor test connection server 8080 udp
admin@DUT1$ monitor test connection client 10.0.0.1 8080 udp

Step 6: Set the following configuration in DUT0:

del traffic policy POLICY
set traffic policy POLICY rule 1 action rate-limit 10

Step 7: Initiate a bandwidth test from DUT1 to DUT0

admin@DUT0$ monitor test performance server port 5001
admin@DUT1$ monitor test performance client 10.0.0.1 duration 5 port 5001

Note

Previous test should show a very low bandwidth rate.

Test Policy Copy 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different copy actions are configured to store the ToS value in the conntrack mark and extra conntrack mark fields.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set traffic policy POLICY rule 1 copy tos connmark

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 5 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

mark=12

Step 5: Set the following configuration in DUT0:

del traffic policy POLICY
set traffic policy POLICY rule 1 copy tos extra-connmark 1

Step 6: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 5 size 56 timeout 1

Step 7: Run command system conntrack show at DUT0 and check if output contains the following tokens:

emark1=12

Test Policy Set 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different set actions are configured to change the conntrack mark, the app-id and the VRF.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set traffic policy POLICY rule 1 set connmark 15

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

mark=15

Step 5: Set the following configuration in DUT0:

del traffic policy POLICY
set traffic policy POLICY rule 1 set app-id custom 80

Step 6: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 7: Run command system conntrack show at DUT0 and check if output contains the following tokens:

appdetect[U:80]

Step 8: Set the following configuration in DUT0:

del traffic policy POLICY
set traffic policy POLICY rule 1 set vrf RED
set system vrf RED
set interfaces ethernet eth0 vrf RED

Step 9: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 10: Run command system conntrack show at DUT0 and check if output contains the following tokens:

vrf=RED

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set traffic policy POLICY rule 1 log prefix "DEBUG-"
set traffic policy POLICY rule 1 log level err

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system journal show | tail at DUT0 and check if output contains the following tokens:

[DEBUG--1] ACCEPT IN=eth0