Complete Tests
The following scenario shows how to place an OSDx router between two machines to allow them to communicate with each other and to provide protection when accessing one another and the external WAN.
Test Simple Ruleset With Queues
Description
Configures the three DUTs that will be used and checks that they are capable of pinning each other but not of connecting via SSH, since these connections are being dropped by the firewall.
Scenario
Step 1: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 2: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.680 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.680/0.680/0.680/0.000 ms
Step 3: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.582 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.582/0.582/0.582/0.000 ms
Step 4: Expect a failure in the following command:
Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 5: Expect a failure in the following command:
Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[Drop].+(SSH not allowed in this network).+$Show output
11/23/2023-22:52:11.551585 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:50408 -> 20.0.0.2:22 11/23/2023-22:52:13.744409 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53148 -> 40.0.0.2:22
Test Simple Ruleset With Queues IDS Mode
Description
Configures the three DUTs that will be used and checks that they are capable of pinning each other and of connecting via SSH. Since the firewall is set to IDS mode, these connections are not being dropped.
Scenario
Step 1: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base.rules set service firewall FW mode monitor interfaces eth0,eth1 set service firewall FW logging outputs fast
Step 2: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.489 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.489/0.489/0.489/0.000 ms
Step 3: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.678 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.678/0.678/0.678/0.000 ms
Step 4: Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 21:16:30 2023 admin@osdx$
Step 5: Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 21:09:36 2023 admin@osdx$
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[wDrop].+(SSH not allowed in this network).+$Show output
11/23/2023-22:52:39.369694 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.369696 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.369916 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.369918 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.370057 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.370060 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.370577 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.370597 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.377033 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22 11/23/2023-22:52:39.377045 [wDrop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35180 -> 40.0.0.2:22
Test Encrypted Ruleset
Description
Configures the three DUTs, encrypts an arbitrary ruleset file and checks that the firewall is handling said file as expected. The firewall behaves the same way as for Test Simple Ruleset With Queues but with an encrypted ruleset.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/base-enc.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 208 100 208 0 0 18909 0 --:--:-- --:--:-- --:--:-- 18909
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base-enc.rules set service firewall FW ruleset file running://base-enc.rules digest sha512 set service firewall FW ruleset file running://base-enc.rules iterations 100000 set service firewall FW ruleset file running://base-enc.rules key-length 256 set service firewall FW ruleset file running://base-enc.rules password 'dV^F$@i!zLWLG#ZLU55ditGi' set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.598 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.598/0.598/0.598/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.790 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.790/0.790/0.790/0.000 ms
Step 5: Expect a failure in the following command:
Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 6: Expect a failure in the following command:
Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+[Drop].+(SSH not allowed in this network).+$Show output
11/23/2023-22:53:03.902537 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:50228 -> 20.0.0.2:22 11/23/2023-22:53:06.062690 [Drop] [**] [1:2:0] SSH not allowed in this network [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58154 -> 40.0.0.2:22
Test Encrypted Patch
Description
Configures three DUTs, encrypts a patch that allows SSH communication between the DUTs and enables bypass. The original input file was:
drop ssh any any -> any any (msg: "SSH not allowed in this network"; sid: 2;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)
After applying the following patch:
1c1
< drop ssh any any -> any any (msg: "SSH not allowed in this network"; sid: 2;)
---
> alert ssh any any -> any any (msg: "SSH traffic detected - bypassing"; bypass; sid: 2;)
The resulting file must be:
alert ssh any any -> any any (msg: "SSH traffic detected - bypassing"; bypass; sid: 2;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)
This not only allows SSH traffic but also enables the bypass feature (not tested here yet).
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/base-enc.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 208 100 208 0 0 13866 0 --:--:-- --:--:-- --:--:-- 13866
Step 2: Run command file copy http://10.215.168.1/~robot/base-enc.diff1 running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 256 100 256 0 0 21333 0 --:--:-- --:--:-- --:--:-- 21333
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset file running://base-enc.rules set service firewall FW ruleset file running://base-enc.rules digest sha512 set service firewall FW ruleset file running://base-enc.rules iterations 100000 set service firewall FW ruleset file running://base-enc.rules key-length 256 set service firewall FW ruleset file running://base-enc.rules password 'dV^F$@i!zLWLG#ZLU55ditGi' set service firewall FW ruleset patch running://base-enc.diff1 set service firewall FW ruleset patch running://base-enc.diff1 digest sha512 set service firewall FW ruleset patch running://base-enc.diff1 iterations 100000 set service firewall FW ruleset patch running://base-enc.diff1 key-length 256 set service firewall FW ruleset patch running://base-enc.diff1 password '5YG9F@H4V!#s&LVKqQ6uehy7' set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.797 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.797/0.797/0.797/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.723 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.723/0.723/0.723/0.000 ms
Step 6: Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:52:38 2023 from 40.0.0.2 admin@osdx$
Step 7: Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:52:39 2023 from 20.0.0.2 admin@osdx$
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(SSH traffic detected - bypassing).+$Show output
11/23/2023-22:53:32.425822 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:58182 -> 20.0.0.2:22 11/23/2023-22:53:32.822332 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34240 -> 40.0.0.2:22
Test Compressed Ruleset With Patch
Description
Configures three DUTs, places a patch between the DUTs that allows SSH
communication, and enables bypass. In addition, there are two source
rules that are compressed into a tar.gz file whose content is used
by the firewall to define the rules. One of the files is named base.rules``and
is the file that the patch is meant for. The second one
is ``test-performance.rules whose contents are:: The original input file was:
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 4;)
This rule simply bypasses traffic that is deemed “performance traffic”,
which is directly associated with the monitor test performance command.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/ruleset.tar.gz running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 318 100 318 0 0 26500 0 --:--:-- --:--:-- --:--:-- 26500
Step 2: Run command file copy http://10.215.168.1/~robot/base.diff1 running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 238 100 238 0 0 18307 0 --:--:-- --:--:-- --:--:-- 18307
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset compressed running://ruleset.tar.gz set service firewall FW ruleset patch running://base.diff1 set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.512 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.512/0.512/0.512/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.580 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.580/0.580/0.580/0.000 ms
Step 6: Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:53:32 2023 from 40.0.0.2 admin@osdx$
Step 7: Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:53:32 2023 from 20.0.0.2 admin@osdx$
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(SSH traffic detected - bypassing).+$Show output
11/23/2023-22:53:57.430642 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:35676 -> 20.0.0.2:22 11/23/2023-22:53:57.866472 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41848 -> 40.0.0.2:22
Step 9: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 1 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 57726 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 23.4 MBytes 196 Mbits/sec 0 1.18 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-1.00 sec 23.4 MBytes 196 Mbits/sec 0 sender [ 5] 0.00-1.01 sec 21.4 MBytes 177 Mbits/sec receiver iperf Done.
Step 10: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
11/23/2023-22:53:57.430642 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:35676 -> 20.0.0.2:22 11/23/2023-22:53:57.866472 [**] [1:2:0] SSH traffic detected - bypassing [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41848 -> 40.0.0.2:22 11/23/2023-22:53:58.681353 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57722 -> 40.0.0.2:5001 11/23/2023-22:53:58.684370 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57726 -> 40.0.0.2:5001
Test Single File In Compressed Ruleset
Description
Compresses two ruleset files but only chooses the test-performance.rules
from within the compressed file. Lastly, checks that performance traffic is detected but
no message is generated for SSH traffic, indicating that only one file is
being used.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/ruleset.tar.gz running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 318 100 318 0 0 21200 0 --:--:-- --:--:-- --:--:-- 21200
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset compressed running://ruleset.tar.gz set service firewall FW ruleset compressed running://ruleset.tar.gz file test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.759 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.759/0.759/0.759/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.578 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.578/0.578/0.578/0.000 ms
Step 5: Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:53:57 2023 from 40.0.0.2 admin@osdx$
Step 6: Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:53:57 2023 from 20.0.0.2 admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output does not match the following regular expressions:
(?m)^.+(SSH traffic detected - bypassing).+$Show output
No fast logs yet for client "FW"
Step 8: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 1 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 33652 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 26.1 MBytes 219 Mbits/sec 0 1.04 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-1.00 sec 26.1 MBytes 219 Mbits/sec 0 sender [ 5] 0.00-1.01 sec 23.6 MBytes 196 Mbits/sec receiver iperf Done.
Step 9: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
11/23/2023-22:54:30.337655 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33640 -> 40.0.0.2:5001 11/23/2023-22:54:30.339474 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33652 -> 40.0.0.2:5001
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the previous test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 2580 0 --:--:-- --:--:-- --:--:-- 2580
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q set service firewall FW stream bypass
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.676 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.676/0.676/0.676/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.597 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.597/0.597/0.597/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 38630 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.01 sec 24.5 MBytes 203 Mbits/sec 0 1.00 MBytes [ 5] 1.01-2.01 sec 27.5 MBytes 232 Mbits/sec 0 2.21 MBytes [ 5] 2.01-3.00 sec 42.5 MBytes 359 Mbits/sec 0 3.15 MBytes [ 5] 3.00-4.00 sec 41.2 MBytes 346 Mbits/sec 0 3.15 MBytes [ 5] 4.00-5.00 sec 40.0 MBytes 336 Mbits/sec 0 3.15 MBytes [ 5] 5.00-6.00 sec 40.0 MBytes 335 Mbits/sec 0 3.15 MBytes [ 5] 6.00-7.00 sec 38.8 MBytes 325 Mbits/sec 0 3.15 MBytes [ 5] 7.00-8.00 sec 38.8 MBytes 325 Mbits/sec 0 3.15 MBytes [ 5] 8.00-9.00 sec 42.5 MBytes 356 Mbits/sec 51 2.29 MBytes [ 5] 9.00-10.00 sec 35.0 MBytes 294 Mbits/sec 90 1.70 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 371 MBytes 311 Mbits/sec 141 sender [ 5] 0.00-10.02 sec 370 MBytes 310 Mbits/sec receiver iperf Done.
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
11/23/2023-22:54:54.815177 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38628 -> 40.0.0.2:5001 11/23/2023-22:54:54.819231 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38630 -> 40.0.0.2:5001
Test Capture Bypass
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the previous test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 7588 0 --:--:-- --:--:-- --:--:-- 7588
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765 set traffic selector FW_SEL rule 1 not label BYPASS set traffic policy FW_PLAN rule 1 selector FW_SEL set traffic policy FW_PWAN rule 1 selector FW_SEL set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.649 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.649/0.649/0.649/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.515 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.515/0.515/0.515/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 35088 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 27.2 MBytes 229 Mbits/sec 0 990 KBytes [ 5] 1.00-2.00 sec 12.5 MBytes 105 Mbits/sec 1 1.41 KBytes [ 5] 2.00-3.06 sec 7.50 MBytes 59.3 Mbits/sec 0 1.69 MBytes [ 5] 3.06-4.00 sec 71.2 MBytes 636 Mbits/sec 505 1.73 MBytes [ 5] 4.00-5.00 sec 119 MBytes 996 Mbits/sec 254 1.39 MBytes [ 5] 5.00-6.01 sec 140 MBytes 1.17 Gbits/sec 0 1.51 MBytes [ 5] 6.01-7.00 sec 139 MBytes 1.17 Gbits/sec 106 262 KBytes [ 5] 7.00-8.00 sec 138 MBytes 1.15 Gbits/sec 0 522 KBytes [ 5] 8.00-9.00 sec 68.8 MBytes 578 Mbits/sec 1 872 KBytes [ 5] 9.00-10.00 sec 134 MBytes 1.12 Gbits/sec 579 416 KBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 856 MBytes 718 Mbits/sec 1446 sender [ 5] 0.00-10.00 sec 853 MBytes 715 Mbits/sec receiver iperf Done.
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
11/23/2023-22:55:37.675783 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35082 -> 40.0.0.2:5001 11/23/2023-22:55:37.677815 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35088 -> 40.0.0.2:5001
Step 7: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
-- Logs begin at Thu 2023-11-23 22:55:27 UTC, end at Thu 2023-11-23 22:55:47 UTC. -- Nov 23 22:55:27.000239 osdx systemd-timedated[17971]: Changed local time to Thu Nov 23 22:55:27 2023 Nov 23 22:55:27.002334 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'set date 2023-11-23 22:55:27'. Nov 23 22:55:27.452936 osdx systemd-journald[619]: Runtime journal (/run/log/journal/1b38b2114cf0481baed8058b17ed7ac1) is 4.0M, max 16.0M, 12.0M free. Nov 23 22:55:27.466089 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'system journal clear'. Nov 23 22:55:27.818588 osdx OSDxCLI[17488]: User 'admin' entered the configuration menu. Nov 23 22:55:27.944407 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.100/24'. Nov 23 22:55:28.049884 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Nov 23 22:55:28.168875 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Nov 23 22:55:28.259237 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Nov 23 22:55:28.351512 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Nov 23 22:55:28.442002 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Nov 23 22:55:28.580654 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Nov 23 22:55:28.617009 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Nov 23 22:55:28.655964 osdx systemd-udevd[18082]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable. Nov 23 22:55:28.656327 osdx systemd-udevd[18082]: Using default interface naming scheme 'v240'. Nov 23 22:55:28.710968 osdx systemd-udevd[18082]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable. Nov 23 22:55:28.868528 osdx cfgd[1092]: [17488]Completed change to active configuration Nov 23 22:55:28.929003 osdx OSDxCLI[17488]: User 'admin' committed the configuration. Nov 23 22:55:28.976529 osdx OSDxCLI[17488]: User 'admin' left the configuration menu. Nov 23 22:55:31.410552 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Nov 23 22:55:31.518833 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Nov 23 22:55:31.633814 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Nov 23 22:55:32.325672 osdx file_operation[18163]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Nov 23 22:55:32.371132 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Nov 23 22:55:32.547632 osdx OSDxCLI[17488]: User 'admin' entered the configuration menu. Nov 23 22:55:32.650907 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Nov 23 22:55:32.756089 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Nov 23 22:55:32.848477 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Nov 23 22:55:32.939578 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Nov 23 22:55:33.031410 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Nov 23 22:55:33.130189 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy in FW_PWAN'. Nov 23 22:55:33.224845 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy out FW_PWAN'. Nov 23 22:55:33.322240 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Nov 23 22:55:33.413443 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Nov 23 22:55:33.502669 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Nov 23 22:55:33.592372 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW_PWAN'. Nov 23 22:55:33.684230 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN'. Nov 23 22:55:33.776265 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL'. Nov 23 22:55:33.873520 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Nov 23 22:55:33.968553 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Nov 23 22:55:34.056728 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Nov 23 22:55:34.157160 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Nov 23 22:55:34.246209 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Nov 23 22:55:34.366535 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Nov 23 22:55:34.386433 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:34.463990 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Nov 23 22:55:34.556811 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL rule 1 not label BYPASS'. Nov 23 22:55:34.641306 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL'. Nov 23 22:55:34.785934 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW_PWAN rule 1 selector FW_SEL'. Nov 23 22:55:34.901438 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Nov 23 22:55:35.040202 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Nov 23 22:55:35.132379 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Nov 23 22:55:35.223230 osdx OSDxCLI[17488]: User 'admin' added a new cfg line: 'set traffic policy FW_PWAN rule 1 action enqueue FW_Q'. Nov 23 22:55:35.526369 osdx systemd[1]: Reloading. Nov 23 22:55:35.731461 osdx systemd[1]: Starting Suricata client "FW" service... Nov 23 22:55:35.754158 osdx systemd[1]: suricata@FW.service: Can't open PID file /run/suricata-FW.pid (yet?) after start: No such file or directory Nov 23 22:55:35.760728 osdx systemd[1]: Started Suricata client "FW" service. Nov 23 22:55:37.015443 osdx INFO[18278]: Rules successfully loaded Nov 23 22:55:37.018580 osdx cfgd[1092]: [17488]Completed change to active configuration Nov 23 22:55:37.022079 osdx OSDxCLI[17488]: User 'admin' committed the configuration. Nov 23 22:55:37.063377 osdx OSDxCLI[17488]: User 'admin' left the configuration menu. Nov 23 22:55:37.676698 osdx kernel: [SKIP-1]IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:11:de:ad:be:ef:6c:30:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=60840 DF PROTO=TCP SPT=35082 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Nov 23 22:55:37.680699 osdx kernel: [SKIP-1]IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:11:de:ad:be:ef:6c:30:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=9682 DF PROTO=TCP SPT=35088 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Nov 23 22:55:39.384666 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:39.385343 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:39.385633 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:39.385900 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:39.386183 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:39.386451 osdx zebra[1034]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]): Nov 23 22:55:43.658180 osdx zebra[1034]: [WPPMZ-G9797] if_zebra_speed_update: eth1.201 old speed: 0 new speed: 4294967295 Nov 23 22:55:43.707078 osdx zebra[1034]: [WPPMZ-G9797] if_zebra_speed_update: eth1.101 old speed: 0 new speed: 4294967295 Nov 23 22:55:47.974682 osdx OSDxCLI[17488]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Simple Capture Bypass
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the previous test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 589 0 --:--:-- --:--:-- --:--:-- 589
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset file running://test-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set traffic selector FW_SEL rule 1 not connmark 129834765 set traffic policy FW_PLAN rule 1 selector FW_SEL set traffic policy FW_PWAN rule 1 selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.667 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.667/0.667/0.667/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.539 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.539/0.539/0.539/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 36292 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 45.3 MBytes 380 Mbits/sec 1 1.66 MBytes [ 5] 1.00-2.00 sec 5.00 MBytes 41.9 Mbits/sec 1 1.41 KBytes [ 5] 2.00-3.00 sec 6.25 MBytes 52.4 Mbits/sec 121 1.39 MBytes [ 5] 3.00-4.00 sec 5.00 MBytes 42.0 Mbits/sec 109 123 KBytes [ 5] 4.00-5.00 sec 27.5 MBytes 231 Mbits/sec 1 1.03 MBytes [ 5] 5.00-6.12 sec 13.8 MBytes 103 Mbits/sec 1 1.41 KBytes [ 5] 6.12-7.00 sec 100 MBytes 953 Mbits/sec 662 735 KBytes [ 5] 7.00-8.00 sec 124 MBytes 1.04 Gbits/sec 0 1.03 MBytes [ 5] 8.00-9.00 sec 112 MBytes 944 Mbits/sec 0 1.31 MBytes [ 5] 9.00-10.00 sec 142 MBytes 1.19 Gbits/sec 1 1.05 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 582 MBytes 488 Mbits/sec 897 sender [ 5] 0.00-10.00 sec 579 MBytes 486 Mbits/sec receiver iperf Done.
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
11/23/2023-22:56:20.368996 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36284 -> 40.0.0.2:5001 11/23/2023-22:56:20.444690 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36292 -> 40.0.0.2:5001
Step 7: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=52110 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=52110 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=46315 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=46315 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=44865 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=44865 packets=0 bytes=0 mark=0 use=1 udp 17 19 src=127.0.0.1 dst=127.0.0.1 sport=49384 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=49384 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=49717 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=49717 packets=0 bytes=0 mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=36284 dport=5001 packets=18 bytes=1389 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=36284 packets=15 bytes=1096 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=59160 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=59160 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=57482 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=57482 packets=0 bytes=0 mark=0 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=235 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=235 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=38133 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=38133 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=47694 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=47694 packets=0 bytes=0 mark=0 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=41 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=41 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=38507 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=38507 packets=0 bytes=0 mark=0 use=2 udp 17 19 src=127.0.0.1 dst=127.0.0.1 sport=52988 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=52988 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=34611 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=34611 packets=0 bytes=0 mark=0 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=50687 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=50687 packets=0 bytes=0 mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=36292 dport=5001 packets=420715 bytes=631057313 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=36292 packets=17968 bytes=944108 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 udp 17 24 src=127.0.0.1 dst=127.0.0.1 sport=46046 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=46046 packets=0 bytes=0 mark=0 use=1 conntrack v1.4.5 (conntrack-tools): 18 flow entries have been shown.
Test Selectors
Description
Builds a scenario with three DUTs in which some selectors are applied to traffic depending on the network detected. This allows specific selector-based rules to be applied to traffic and with only one firewall instance.
To demonstrate this behavior, two labels will be set:
WANlabel that is applied to every packet going outside the local network.
LANlabel that marks every packet present in the underlying network.
For this purpose, a whole scenario will be used to enable all the features to work:
A compressed, encrypted ruleset will be created that contains
base.rulesas well astest-performance.rules.A patch that will upgrade
base.rulesso it contains rules based on labels. The expected final result will be:alert ssh any any -> any any (msg: "Local SSH traffic - bypassing..."; selector: LOCAL; bypass; sid: 1; flow: established, to_server;) drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23; selector: WAN;) pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;) drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; selector: WAN, LOCAL; sid: 4; flow: established, to_server;)
Hence, the following will be tested:
SSH connection is working between the LAN nodes - DUT1 and DUT2
It is impossible to get the
nids.htmlfile (i.e., a malicious file) from the WAN.ICMP messages are allowed from any node within the network.
Traffic performance tests are allowed for both the WAN and LOCAL selectors but not on port 5000.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/ruleset.tar.gz.aes256 running://ruleset.tar.gz force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 336 100 336 0 0 28000 0 --:--:-- --:--:-- --:--:-- 28000
Step 2: Run command file copy http://10.215.168.1/~robot/base.diff2-aes256 running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 528 100 528 0 0 33000 0 --:--:-- --:--:-- --:--:-- 31058
Step 3: Set the following configuration in DUT0:
set service firewall FW ruleset compressed running://ruleset.tar.gz set service firewall FW ruleset compressed running://ruleset.tar.gz digest sha512 set service firewall FW ruleset compressed running://ruleset.tar.gz iterations 100000 set service firewall FW ruleset compressed running://ruleset.tar.gz key-length 256 set service firewall FW ruleset compressed running://ruleset.tar.gz password 'dV^F$@i!zLWLG#ZLU55ditGi' set service firewall FW ruleset patch running://base.diff2-aes256 set service firewall FW ruleset patch running://base.diff2-aes256 digest sha512 set service firewall FW ruleset patch running://base.diff2-aes256 iterations 100000 set service firewall FW ruleset patch running://base.diff2-aes256 key-length 256 set service firewall FW ruleset patch running://base.diff2-aes256 password '5YG9F@H4V!#s&LVKqQ6uehy7' set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic label LOCAL set traffic label WAN set traffic group address LAN element 40.0.0.0/24 set traffic group address LAN element 20.0.0.0/24 set traffic selector LAN rule 1 destination address-group LAN set traffic selector LAN rule 1 source address-group LAN set traffic policy FW_PLAN rule 1 selector LAN set traffic policy FW_PLAN rule 1 set label LOCAL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 set label WAN set traffic policy FW_PWAN rule 1 action enqueue FW_Q
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.54 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.544/1.544/1.544/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.559 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.559/0.559/0.559/0.000 ms
Step 6: Init an SSH connection from DUT1 to IP address 20.0.0.2:
admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '20.0.0.2' (ED25519) to the list of known hosts. admin@20.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:54:29 2023 from 40.0.0.2 admin@osdx$
Step 7: Init an SSH connection from DUT2 to IP address 40.0.0.2:
admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1Show output
Warning: Permanently added '40.0.0.2' (ED25519) to the list of known hosts. admin@40.0.0.2's password: Welcome to Teldat OSDx v3.8.1.7-beta3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Thu Nov 23 22:54:29 2023 from 20.0.0.2 admin@osdx$
Step 8: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Local SSH traffic - bypassing...).+$Show output
11/23/2023-22:57:01.138786 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:53464 -> 20.0.0.2:22 11/23/2023-22:57:01.569074 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58208 -> 40.0.0.2:22
Step 9: Expect a failure in the following command:
Init an SSH connection from DUT1 to IP address 10.215.168.1:
admin@DUT1$ ssh admin@10.215.168.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 10: Expect a failure in the following command:
Init an SSH connection from DUT2 to IP address 10.215.168.1:
admin@DUT2$ ssh admin@10.215.168.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Outgoing TCP traffic to port 22 from LAN to WAN).+$Show output
11/23/2023-22:57:01.138786 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:53464 -> 20.0.0.2:22 11/23/2023-22:57:01.569074 [**] [1:1:0] Local SSH traffic - bypassing... [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58208 -> 40.0.0.2:22 11/23/2023-22:57:02.096721 [Drop] [**] [1:5:0] Outgoing TCP traffic to port 22 from LAN to WAN [**] [Classification: (null)] [Priority: 3] {TCP} 40.0.0.2:47298 -> 10.215.168.1:22 11/23/2023-22:57:04.285968 [Drop] [**] [1:5:0] Outgoing TCP traffic to port 22 from LAN to WAN [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:50678 -> 10.215.168.1:22
Step 12: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 45172 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 27.2 MBytes 228 Mbits/sec 0 1.14 MBytes [ 5] 1.00-2.00 sec 31.2 MBytes 262 Mbits/sec 0 2.65 MBytes [ 5] 2.00-3.00 sec 40.0 MBytes 336 Mbits/sec 65 2.32 MBytes [ 5] 3.00-4.02 sec 42.5 MBytes 351 Mbits/sec 0 2.53 MBytes [ 5] 4.02-5.00 sec 37.5 MBytes 320 Mbits/sec 0 2.68 MBytes [ 5] 5.00-6.00 sec 36.2 MBytes 304 Mbits/sec 0 2.81 MBytes [ 5] 6.00-7.00 sec 41.2 MBytes 346 Mbits/sec 0 2.91 MBytes [ 5] 7.00-8.00 sec 41.2 MBytes 346 Mbits/sec 216 2.15 MBytes [ 5] 8.00-9.00 sec 38.8 MBytes 325 Mbits/sec 0 2.25 MBytes [ 5] 9.00-10.00 sec 37.5 MBytes 315 Mbits/sec 0 2.34 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 373 MBytes 313 Mbits/sec 281 sender [ 5] 0.00-10.03 sec 373 MBytes 312 Mbits/sec receiver iperf Done.
Step 13: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
11/23/2023-22:57:17.285827 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:17.491712 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:17.699640 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:18.131682 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:18.963668 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:20.347711 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:20.398421 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:20.402408 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:20.411851 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000 11/23/2023-22:57:20.616115 [Drop] [**] [1:4:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55628 -> 40.0.0.2:5000
Test XDP Filtering
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 576 0 --:--:-- --:--:-- --:--:-- 576
Step 2: Set the following configuration in DUT0:
set service firewall FW ruleset file running://drop-performance.rules set service firewall FW mode inline queue FW_Q set service firewall FW logging outputs fast set service firewall FW logging level config set service firewall FW validator-timeout 20 set interfaces ethernet eth0 traffic policy in FW_PWAN set interfaces ethernet eth0 traffic policy out FW_PWAN set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set traffic queue FW_Q elements 1 set traffic policy FW_PWAN set traffic policy FW_PLAN set traffic selector FW_SEL set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PWAN rule 1 action enqueue FW_Q set service firewall FW stream bypass action drop set xdp-early-drop eth1
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.777 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.777/0.777/0.777/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.827 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.827/0.827/0.827/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
11/23/2023-22:57:51.557704 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41992 -> 40.0.0.2:5000
Step 7: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250124s ending at 1700780275.334362 XDP_DROP 10 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 15 pkts ( 4 pps) 1 KiB ( 0 Mbits/s)
Step 8: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 9: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
11/23/2023-22:57:51.557704 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41992 -> 40.0.0.2:5000 11/23/2023-22:57:55.643611 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:56821 -> 40.0.0.2:5001
Step 10: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250160s ending at 1700780279.453213 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 36 pkts ( 0 pps) 2 KiB ( 0 Mbits/s)