Policy

The following scenarios show how to configure different traffic policies. Policies can be used to manage and classify network packets. traffic selectors can be configured to filter packets based on certain fields.

Test Policy Actions 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different traffic actions are configured to accept, drop or limit incoming traffic.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY rule 1 action accept

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Modify the following configuration lines in DUT0:

delete traffic policy POLICY rule 1 action accept
set traffic policy POLICY rule 1 action drop

Step 5: Expect a failure in the following command: Initiate a udp connection from DUT1 to DUT0 and try to send some messages between both endpoints

admin@DUT0$ monitor test connection server 8080 udp
admin@DUT1$ monitor test connection client 10.0.0.1 8080 udp

Step 6: Modify the following configuration lines in DUT0:

delete traffic policy POLICY rule 1 action drop
set traffic policy POLICY rule 1 action rate-limit 10

Step 7: Initiate a bandwidth test from DUT1 to DUT0

admin@DUT0$ monitor test performance server port 5001
admin@DUT1$ monitor test performance client 10.0.0.1 duration 5 port 5001 parallel 1

Note

Previous test should show a very low bandwidth rate.

Test Policy Copy 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different copy actions are configured to store the ToS value in the conntrack mark and extra conntrack mark fields.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY rule 1 copy tos connmark

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 1 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

mark=12

Step 5: Modify the following configuration lines in DUT0:

delete traffic policy POLICY rule 1 copy tos connmark
set traffic policy POLICY rule 1 copy tos extra-connmark 1

Step 6: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 1 size 56 timeout 1

Step 7: Run command system conntrack show at DUT0 and check if output contains the following tokens:

emark1=12

Test Policy Set 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different set actions are configured to change the conntrack mark, the app-id and the VRF.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY rule 1 set connmark 15

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

mark=15

Step 5: Modify the following configuration lines in DUT0:

delete traffic policy POLICY rule 1 set connmark
set traffic policy POLICY rule 1 set app-id custom 80

Step 6: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 7: Run command system conntrack show at DUT0 and check if output contains the following tokens:

appdetect[U:80]

Step 8: Modify the following configuration lines in DUT0:

delete traffic policy POLICY rule 1 set app-id
set interfaces ethernet eth0 vrf RED
set system vrf RED
set traffic policy POLICY rule 1 set vrf RED

Step 9: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 10: Run command system conntrack show at DUT0 and check if output contains the following tokens:

vrf=RED

Test Policy Log 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The log option is configured to show system messages that help debug and analyze the network status.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY rule 1 log level err
set traffic policy POLICY rule 1 log prefix DEBUG-

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system journal show | tail at DUT0 and check if output contains the following tokens:

[DEBUG--1] ACCEPT IN=eth0

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy in POLICY
set system advisor ADV test false
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY rule 1 action drop
set traffic policy POLICY rule 1 advisor ADV

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Modify the following configuration lines in DUT0:

set system advisor ADV test true

Step 5: Expect a failure in the following command: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 6: Modify the following configuration lines in DUT0:

set system advisor ADV test false

Step 7: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1