Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 22237 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.01 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.011/1.011/1.011/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.839 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.839/0.839/0.839/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 45444 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 94.2 MBytes 791 Mbits/sec 79 1.34 MBytes [ 5] 1.00-2.00 sec 96.2 MBytes 807 Mbits/sec 0 1.43 MBytes [ 5] 2.00-3.00 sec 93.8 MBytes 786 Mbits/sec 0 1.49 MBytes [ 5] 3.00-4.00 sec 96.2 MBytes 807 Mbits/sec 0 1.53 MBytes [ 5] 4.00-5.00 sec 97.5 MBytes 818 Mbits/sec 0 1.56 MBytes [ 5] 5.00-6.00 sec 95.0 MBytes 797 Mbits/sec 0 1.58 MBytes [ 5] 6.00-7.00 sec 67.5 MBytes 566 Mbits/sec 0 1.59 MBytes [ 5] 7.00-8.00 sec 52.5 MBytes 440 Mbits/sec 0 1.62 MBytes [ 5] 8.00-9.00 sec 48.8 MBytes 409 Mbits/sec 0 1.64 MBytes [ 5] 9.00-10.00 sec 51.2 MBytes 430 Mbits/sec 0 1.66 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 793 MBytes 665 Mbits/sec 79 sender [ 5] 0.00-10.02 sec 791 MBytes 662 Mbits/sec receiver iperf Done.
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
07/30/2024-11:35:16.365226 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45430 -> 40.0.0.2:5001 07/30/2024-11:35:16.366318 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45444 -> 40.0.0.2:5001
Test Capture Bypass
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the previous test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 23222 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL set traffic policy FW_PWAN rule 1 selector FW_SEL set traffic queue FW_Q elements 1 set traffic selector FW_SEL rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.01 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.007/1.007/1.007/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=1.08 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.083/1.083/1.083/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 57504 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 364 MBytes 3.05 Gbits/sec 5 2.34 MBytes [ 5] 1.00-2.00 sec 379 MBytes 3.18 Gbits/sec 107 1.79 MBytes [ 5] 2.00-3.00 sec 361 MBytes 3.03 Gbits/sec 0 1.93 MBytes [ 5] 3.00-4.00 sec 408 MBytes 3.42 Gbits/sec 0 2.07 MBytes [ 5] 4.00-5.00 sec 401 MBytes 3.37 Gbits/sec 0 2.21 MBytes [ 5] 5.00-6.00 sec 359 MBytes 3.01 Gbits/sec 0 2.33 MBytes [ 5] 6.00-7.00 sec 411 MBytes 3.45 Gbits/sec 20 1.80 MBytes [ 5] 7.00-8.00 sec 409 MBytes 3.43 Gbits/sec 0 1.96 MBytes [ 5] 8.00-9.00 sec 380 MBytes 3.19 Gbits/sec 0 2.10 MBytes [ 5] 9.00-10.00 sec 368 MBytes 3.08 Gbits/sec 0 2.22 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.75 GBytes 3.22 Gbits/sec 132 sender [ 5] 0.00-10.00 sec 3.75 GBytes 3.22 Gbits/sec receiver iperf Done.
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
07/30/2024-11:35:43.676444 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57502 -> 40.0.0.2:5001 07/30/2024-11:35:43.677657 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57504 -> 40.0.0.2:5001
Step 7: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Jul 30 11:35:36.271835 osdx systemd-journald[60253]: Runtime Journal (/run/log/journal/22c37bf8be29452e87aca50c6265032f) is 2.1M, max 15.3M, 13.2M free. Jul 30 11:35:36.272558 osdx systemd-journald[60253]: Received client request to rotate journal, rotating. Jul 30 11:35:36.272592 osdx systemd-journald[60253]: Vacuuming done, freed 0B of archived journals from /run/log/journal/22c37bf8be29452e87aca50c6265032f. Jul 30 11:35:36.281696 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'system journal clear'. Jul 30 11:35:36.690330 osdx osdx-coredump[192660]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Jul 30 11:35:36.700824 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'system coredump delete all'. Jul 30 11:35:37.131960 osdx OSDxCLI[192336]: User 'admin' entered the configuration menu. Jul 30 11:35:37.197038 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 30 11:35:37.279598 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Jul 30 11:35:37.329659 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 30 11:35:37.426023 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Jul 30 11:35:37.484482 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Jul 30 11:35:37.574767 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Jul 30 11:35:37.644824 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'show working'. Jul 30 11:35:37.756584 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 30 11:35:37.792571 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Jul 30 11:35:37.817040 osdx (udev-worker)[192777]: Network interface NamePolicy= disabled on kernel command line. Jul 30 11:35:37.827826 osdx (udev-worker)[192782]: Network interface NamePolicy= disabled on kernel command line. Jul 30 11:35:37.932560 osdx cfgd[1242]: [192336]Completed change to active configuration Jul 30 11:35:37.957872 osdx OSDxCLI[192336]: User 'admin' committed the configuration. Jul 30 11:35:37.974810 osdx OSDxCLI[192336]: User 'admin' left the configuration menu. Jul 30 11:35:39.879651 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 30 11:35:39.948933 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Jul 30 11:35:40.058083 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Jul 30 11:35:40.537115 osdx file_operation[192854]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Jul 30 11:35:40.561122 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Jul 30 11:35:40.709679 osdx OSDxCLI[192336]: User 'admin' entered the configuration menu. Jul 30 11:35:40.777083 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jul 30 11:35:40.877265 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jul 30 11:35:40.944586 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jul 30 11:35:41.040024 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jul 30 11:35:41.088243 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jul 30 11:35:41.183054 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jul 30 11:35:41.249407 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jul 30 11:35:41.330180 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jul 30 11:35:41.380527 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jul 30 11:35:41.471136 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jul 30 11:35:41.522187 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jul 30 11:35:41.620056 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jul 30 11:35:41.677487 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jul 30 11:35:41.771654 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jul 30 11:35:41.828664 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jul 30 11:35:41.928139 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL rule 1 not label BYPASS'. Jul 30 11:35:41.978016 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL'. Jul 30 11:35:42.069413 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic policy FW_PWAN rule 1 selector FW_SEL'. Jul 30 11:35:42.119969 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jul 30 11:35:42.211855 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jul 30 11:35:42.260674 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jul 30 11:35:42.410434 osdx OSDxCLI[192336]: User 'admin' added a new cfg line: 'show working'. Jul 30 11:35:42.868772 osdx systemd[1]: Reloading. Jul 30 11:35:42.996609 osdx systemd-sysv-generator[192982]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Jul 30 11:35:43.113061 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jul 30 11:35:43.134120 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jul 30 11:35:43.309058 osdx INFO[192964]: Rules successfully loaded Jul 30 11:35:43.309824 osdx cfgd[1242]: [192336]Completed change to active configuration Jul 30 11:35:43.311852 osdx OSDxCLI[192336]: User 'admin' committed the configuration. Jul 30 11:35:43.326413 osdx OSDxCLI[192336]: User 'admin' left the configuration menu. Jul 30 11:35:43.676577 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:11:de:ad:be:ef:6c:30:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=37913 DF PROTO=TCP SPT=57502 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jul 30 11:35:43.680744 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:11:de:ad:be:ef:6c:30:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=24413 DF PROTO=TCP SPT=57504 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jul 30 11:35:52.812340 osdx zebra[1207]: [WPPMZ-G9797] if_zebra_speed_update: eth1.201 old speed: 0 new speed: 4294967295 Jul 30 11:35:52.827666 osdx zebra[1207]: [WPPMZ-G9797] if_zebra_speed_update: eth1.101 old speed: 0 new speed: 4294967295 Jul 30 11:35:53.848107 osdx OSDxCLI[192336]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Simple Capture Bypass
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the previous test.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 23176 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL set traffic policy FW_PWAN rule 1 selector FW_SEL set traffic queue FW_Q elements 1 set traffic selector FW_SEL rule 1 not connmark 129834765
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.749 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.749/0.749/0.749/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=1.29 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.287/1.287/1.287/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 46972 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 393 MBytes 3.30 Gbits/sec 479 1.67 MBytes [ 5] 1.00-2.00 sec 374 MBytes 3.14 Gbits/sec 0 1.82 MBytes [ 5] 2.00-3.00 sec 414 MBytes 3.47 Gbits/sec 0 1.98 MBytes [ 5] 3.00-4.00 sec 260 MBytes 2.18 Gbits/sec 472 656 KBytes [ 5] 4.00-5.00 sec 355 MBytes 2.98 Gbits/sec 0 979 KBytes [ 5] 5.00-6.00 sec 370 MBytes 3.10 Gbits/sec 124 2.02 MBytes [ 5] 6.00-7.00 sec 505 MBytes 4.24 Gbits/sec 0 2.22 MBytes [ 5] 7.00-8.00 sec 364 MBytes 3.05 Gbits/sec 579 675 KBytes [ 5] 8.00-9.00 sec 419 MBytes 3.51 Gbits/sec 0 1.02 MBytes [ 5] 9.00-10.00 sec 415 MBytes 3.48 Gbits/sec 0 1.29 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.78 GBytes 3.24 Gbits/sec 1654 sender [ 5] 0.00-10.00 sec 3.78 GBytes 3.24 Gbits/sec receiver iperf Done.
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
07/30/2024-11:36:12.166238 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46960 -> 40.0.0.2:5001 07/30/2024-11:36:12.167081 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46972 -> 40.0.0.2:5001
Step 7: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=46960 dport=5001 packets=14 bytes=1196 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46960 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=46972 dport=5001 packets=2801896 bytes=4202817365 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46972 packets=69055 bytes=3608852 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=361 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=361 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=84 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=84 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 36603 0 --:--:-- --:--:-- --:--:-- 40000
Step 2: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 3: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.733 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.733/0.733/0.733/0.000 ms
Step 4: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=1.28 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.278/1.278/1.278/0.000 ms
Step 5: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 6: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
07/30/2024-11:36:40.614508 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48140 -> 40.0.0.2:5000
Step 7: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 48140 yes 201 0 0 0 20.0.0.2 40.0.0.2 48140 5000 yes 201 0 9 731
Step 8: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250133s ending at 1722339404.542143 XDP_DROP 10 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 14 pkts ( 4 pps) 1 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 9: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 10: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
07/30/2024-11:36:40.614508 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48140 -> 40.0.0.2:5000 07/30/2024-11:36:44.674029 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:58429 -> 40.0.0.2:5001
Step 11: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 48140 yes 201 0 0 0 20.0.0.2 40.0.0.2 58429 5001 no 201 0 0 0 20.0.0.2 40.0.0.2 48140 5000 yes 201 0 12 905 40.0.0.2 20.0.0.2 5001 58429 no 201 0 0 0
Step 12: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250218s ending at 1722339408.270903 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 33 pkts ( 0 pps) 2 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)