Bypass Tests

The following scenario shows different configuration alternatives to improve the OSDx firewall performance.

../../../_images/topology32.svg

Test Local Bypass

Description

Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0  25333      0 --:--:-- --:--:-- --:--:-- 25800

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.619 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.619/0.619/0.619/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.471 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.471/0.471/0.471/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Expect this output in DUT2:
Connecting to host 40.0.0.2, port 5001
[  5] local 20.0.0.2 port 57914 connected to 40.0.0.2 port 5001
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  61.8 MBytes   518 Mbits/sec   28   1.68 MBytes
[  5]   1.00-2.00   sec  66.2 MBytes   556 Mbits/sec  275   1.29 MBytes
[  5]   2.00-3.00   sec  88.8 MBytes   744 Mbits/sec    0   1.37 MBytes
[  5]   3.00-4.00   sec  88.8 MBytes   744 Mbits/sec    0   1.43 MBytes
[  5]   4.00-5.00   sec  90.0 MBytes   755 Mbits/sec    0   1.47 MBytes
[  5]   5.00-6.00   sec  95.0 MBytes   797 Mbits/sec    0   1.50 MBytes
[  5]   6.00-7.00   sec  58.8 MBytes   493 Mbits/sec   43   1.63 MBytes
[  5]   7.00-8.00   sec  97.5 MBytes   818 Mbits/sec    0   1.79 MBytes
[  5]   8.00-9.00   sec  81.2 MBytes   682 Mbits/sec    0   1.92 MBytes
[  5]   9.00-10.00  sec  71.2 MBytes   598 Mbits/sec   19   1.43 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   799 MBytes   670 Mbits/sec  365             sender
[  5]   0.00-10.01  sec   797 MBytes   668 Mbits/sec                  receiver

iperf Done.

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
12/03/2024-14:14:51.851913  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57910 -> 40.0.0.2:5001
12/03/2024-14:14:51.859221  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57914 -> 40.0.0.2:5001

Test Capture Bypass Using Packet Mark

Description

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.

Performance must improve considerably compared to the Local Bypass test.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0   3424      0 --:--:-- --:--:-- --:--:--  3486

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic label BYPASS
set traffic policy FW-SKIP rule 1 log prefix SKIP
set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS
set traffic policy FW-SKIP rule 1 set label BYPASS
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS
set traffic selector MARKED-PACKETS rule 1 mark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.563 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.563/0.563/0.563/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.507 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.507/0.507/0.507/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Expect this output in DUT2:
Connecting to host 40.0.0.2, port 5001
[  5] local 20.0.0.2 port 45674 connected to 40.0.0.2 port 5001
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  49.2 MBytes   413 Mbits/sec    1   1.41 KBytes
[  5]   1.00-2.00   sec  86.2 MBytes   724 Mbits/sec  105   1.98 MBytes
[  5]   2.00-3.00   sec   279 MBytes  2.34 Gbits/sec  307   1.53 MBytes
[  5]   3.00-4.00   sec   296 MBytes  2.49 Gbits/sec    0   1.67 MBytes
[  5]   4.00-5.00   sec   276 MBytes  2.32 Gbits/sec    0   1.78 MBytes
[  5]   5.00-6.00   sec   276 MBytes  2.32 Gbits/sec    0   1.89 MBytes
[  5]   6.00-7.00   sec   284 MBytes  2.38 Gbits/sec    0   1.99 MBytes
[  5]   7.00-8.00   sec   305 MBytes  2.56 Gbits/sec    0   2.10 MBytes
[  5]   8.00-9.00   sec   324 MBytes  2.72 Gbits/sec    0   2.20 MBytes
[  5]   9.00-10.00  sec   334 MBytes  2.80 Gbits/sec    1   1.65 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  2.45 GBytes  2.10 Gbits/sec  414             sender
[  5]   0.00-10.00  sec  2.45 GBytes  2.10 Gbits/sec                  receiver

iperf Done.

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
12/03/2024-14:15:23.369691  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45660 -> 40.0.0.2:5001
12/03/2024-14:15:23.370790  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45674 -> 40.0.0.2:5001

Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

(?m)^.*\[SKIP\-1\].*$
Show output
Dec 03 14:15:15.015746 osdx systemd-timedated[249872]: Changed local time to Tue 2024-12-03 14:15:15 UTC
Dec 03 14:15:15.016953 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'set date 2024-12-03 14:15:15'.
Dec 03 14:15:15.018433 osdx systemd-journald[1835]: Time jumped backwards, rotating.
Dec 03 14:15:15.334256 osdx systemd-journald[1835]: Runtime Journal (/run/log/journal/d3b584433ca54f4e84c38003c593de3f) is 2.1M, max 15.3M, 13.2M free.
Dec 03 14:15:15.334787 osdx systemd-journald[1835]: Received client request to rotate journal, rotating.
Dec 03 14:15:15.334820 osdx systemd-journald[1835]: Vacuuming done, freed 0B of archived journals from /run/log/journal/d3b584433ca54f4e84c38003c593de3f.
Dec 03 14:15:15.347158 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'system journal clear'.
Dec 03 14:15:15.706678 osdx osdx-coredump[249889]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Dec 03 14:15:15.716408 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'system coredump delete all'.
Dec 03 14:15:16.198222 osdx OSDxCLI[249541]: User 'admin' entered the configuration menu.
Dec 03 14:15:16.269514 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Dec 03 14:15:16.357994 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'.
Dec 03 14:15:16.414191 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Dec 03 14:15:16.512019 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'.
Dec 03 14:15:16.569991 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'.
Dec 03 14:15:16.666320 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'.
Dec 03 14:15:16.742369 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'show working'.
Dec 03 14:15:16.866431 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Dec 03 14:15:16.946429 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1
Dec 03 14:15:16.976062 osdx (udev-worker)[250010]: Network interface NamePolicy= disabled on kernel command line.
Dec 03 14:15:17.025976 osdx (udev-worker)[250017]: Network interface NamePolicy= disabled on kernel command line.
Dec 03 14:15:17.178988 osdx cfgd[1634]: [249541]Completed change to active configuration
Dec 03 14:15:17.212341 osdx OSDxCLI[249541]: User 'admin' committed the configuration.
Dec 03 14:15:17.240419 osdx OSDxCLI[249541]: User 'admin' left the configuration menu.
Dec 03 14:15:19.265736 osdx zebra[1599]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]):
Dec 03 14:15:19.292555 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Dec 03 14:15:19.369304 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'.
Dec 03 14:15:19.486110 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'.
Dec 03 14:15:19.980162 osdx file_operation[250103]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running://
Dec 03 14:15:20.037498 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'.
Dec 03 14:15:20.170039 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'file show running://test-performance.rules'.
Dec 03 14:15:20.313816 osdx OSDxCLI[249541]: User 'admin' entered the configuration menu.
Dec 03 14:15:20.375021 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'.
Dec 03 14:15:20.488127 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'.
Dec 03 14:15:20.543800 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'.
Dec 03 14:15:20.640097 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'.
Dec 03 14:15:20.696542 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'.
Dec 03 14:15:20.795005 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'.
Dec 03 14:15:20.871894 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'.
Dec 03 14:15:20.958718 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'.
Dec 03 14:15:21.014108 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'.
Dec 03 14:15:21.110916 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'.
Dec 03 14:15:21.164143 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic label BYPASS'.
Dec 03 14:15:21.264336 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'.
Dec 03 14:15:21.322532 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'.
Dec 03 14:15:21.421853 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'.
Dec 03 14:15:21.479909 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'.
Dec 03 14:15:21.585950 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'.
Dec 03 14:15:21.641273 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'.
Dec 03 14:15:21.741646 osdx zebra[1599]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]):
Dec 03 14:15:21.742031 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'.
Dec 03 14:15:21.801065 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'.
Dec 03 14:15:21.899069 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'.
Dec 03 14:15:21.999182 osdx OSDxCLI[249541]: User 'admin' added a new cfg line: 'show working'.
Dec 03 14:15:22.502646 osdx systemd[1]: Reloading.
Dec 03 14:15:22.630426 osdx systemd-sysv-generator[250234]: stat() failed on /etc/init.d/README, ignoring: No such file or directory
Dec 03 14:15:22.734888 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service...
Dec 03 14:15:22.757790 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service.
Dec 03 14:15:22.946551 osdx INFO[250216]: Rules successfully loaded
Dec 03 14:15:22.947443 osdx cfgd[1634]: [249541]Completed change to active configuration
Dec 03 14:15:22.949590 osdx OSDxCLI[249541]: User 'admin' committed the configuration.
Dec 03 14:15:22.972684 osdx OSDxCLI[249541]: User 'admin' left the configuration menu.
Dec 03 14:15:23.056766 osdx zebra[1599]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]):
Dec 03 14:15:23.370439 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=14114 DF PROTO=TCP SPT=45660 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
Dec 03 14:15:23.374447 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=48601 DF PROTO=TCP SPT=45674 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
Dec 03 14:15:25.676727 osdx zebra[1599]: [RZ3YY-GPH41][EC 100663310] snmp[warning]: Warning: Failed to connect to the agentx master agent ([NIL]):
Dec 03 14:15:33.545391 osdx OSDxCLI[249541]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.

Test Capture Bypass Using Conntrack Mark

Description

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.

Performance must improve considerably compared to the Local Bypass test.

Then, the test is broaden by configuring “Capture bypass drop” to also avoid dropped packets from entering the firewall.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0  24893      0 --:--:-- --:--:-- --:--:-- 25800

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW stream bypass set-connmark
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.515 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.515/0.515/0.515/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.467 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.467/0.467/0.467/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Expect this output in DUT2:
Connecting to host 40.0.0.2, port 5001
[  5] local 20.0.0.2 port 46604 connected to 40.0.0.2 port 5001
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  12.6 MBytes   106 Mbits/sec    2   1.41 KBytes
[  5]   1.00-2.00   sec  15.0 MBytes   126 Mbits/sec    1   1.28 MBytes
[  5]   2.00-3.00   sec  11.2 MBytes  94.3 Mbits/sec  138   1.16 MBytes
[  5]   3.00-4.00   sec  33.8 MBytes   283 Mbits/sec    1   1.74 MBytes
[  5]   4.00-5.00   sec  13.8 MBytes   115 Mbits/sec  151   1.45 MBytes
[  5]   5.00-6.00   sec   164 MBytes  1.37 Gbits/sec    0   1.62 MBytes
[  5]   6.00-7.00   sec   388 MBytes  3.25 Gbits/sec    0   1.75 MBytes
[  5]   7.00-8.00   sec   311 MBytes  2.61 Gbits/sec    0   1.85 MBytes
[  5]   8.00-9.00   sec   306 MBytes  2.57 Gbits/sec    0   1.93 MBytes
[  5]   9.00-10.00  sec   260 MBytes  2.18 Gbits/sec  226   1.44 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  1.48 GBytes  1.27 Gbits/sec  519             sender
[  5]   0.00-10.00  sec  1.48 GBytes  1.27 Gbits/sec                  receiver

iperf Done.

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
12/03/2024-14:15:54.444010  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46594 -> 40.0.0.2:5001
12/03/2024-14:15:54.444994  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46604 -> 40.0.0.2:5001

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$
Show output
icmp     1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=19 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=19 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
udp      17 21 src=127.0.0.1 dst=127.0.0.1 sport=37640 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=37640 packets=0 bytes=0 mark=0 use=1
icmp     1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=143 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=143 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
tcp      6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=46604 dport=5001 packets=1097245 bytes=1645859017 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46604 packets=124224 bytes=6455312 [ASSURED] (Sc: not-bypass) mark=129834765 use=1
tcp      6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=46594 dport=5001 packets=14 bytes=1196 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46594 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 use=1
udp      17 21 src=127.0.0.1 dst=127.0.0.1 sport=58386 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=58386 packets=0 bytes=0 mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.

Step 9: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   200  100   200    0     0    958      0 --:--:-- --:--:-- --:--:--   961

Step 10: Run command file show running://drop-performance.rules at DUT0 and expect this output:

Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)

Step 11: Modify the following configuration lines in DUT0:

set service firewall FW bypass action drop set connmark mark 147652983
set service firewall FW ruleset file 'running://drop-performance.rules'
set traffic policy FW_PLAN rule 1 action drop
set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP
set traffic selector FW_SEL_DROP rule 1 connmark 147652983

Step 12: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1
Expect this output in DUT2:
^C- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
iperf3: interrupt - the client has terminated
admin@osdx$

Step 13: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$
Show output
12/03/2024-14:15:54.444010  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46594 -> 40.0.0.2:5001
12/03/2024-14:15:54.444994  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46604 -> 40.0.0.2:5001
12/03/2024-14:16:08.507271  [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:36636 -> 40.0.0.2:5000

Step 14: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$
Show output
udp      17 29 src=127.0.0.1 dst=127.0.0.1 sport=34646 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=34646 packets=0 bytes=0 mark=0 use=1
tcp      6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=36636 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=36636 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1
udp      17 29 src=127.0.0.1 dst=127.0.0.1 sport=36380 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=36380 packets=0 bytes=0 mark=0 use=1
udp      17 27 src=127.0.0.1 dst=127.0.0.1 sport=52003 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=52003 packets=0 bytes=0 mark=0 use=1
udp      17 27 src=127.0.0.1 dst=127.0.0.1 sport=38756 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=38756 packets=0 bytes=0 mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 5 flow entries have been shown.

Step 15: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:

(?m)^1\s+FW_SEL_DROP\s+[1-9].*$
Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high

---------------------------------------------------------------------
rule      selector     pkts match  pkts eval  bytes match  bytes eval
---------------------------------------------------------------------
1      FW_SEL_DROP              4          5          210         270
2      FW_SEL_ENQUEUE           1          1           60          60
---------------------------------------------------------------------
Total                           5          5          270         270

Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high

---------------------------------------------------------------------
rule      selector     pkts match  pkts eval  bytes match  bytes eval
---------------------------------------------------------------------
1      FW_SEL_DROP              5          8          409         610
2      FW_SEL_ENQUEUE           3          3          201         201
---------------------------------------------------------------------
Total                           8          8          610         610

Test Capture And Offload

Description

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.

Performance must improve considerably compared to the previous test, to reach its top value.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0  10224      0 --:--:-- --:--:-- --:--:-- 10750

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass action accept set conntrack offload-flag
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW stream bypass set-connmark
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.802 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.802/0.802/0.802/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.466 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.466/0.466/0.466/0.000 ms

Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
12/03/2024-14:16:32.307859  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54842 -> 40.0.0.2:5001
12/03/2024-14:16:32.308738  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54856 -> 40.0.0.2:5001

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$
Show output
tcp      6 src=20.0.0.2 dst=40.0.0.2 sport=54842 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=54842 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=388 packets=4 bytes=211] mark=129834765 use=2
icmp     1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=146 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=146 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
tcp      6 src=20.0.0.2 dst=40.0.0.2 sport=54856 dport=5001 packets=16548 bytes=24816253 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=54856 packets=2471 bytes=128524 [ASSURED] [OFFLOAD, packets=16536 bytes=24802552 packets=2469 bytes=128412] mark=129834765 use=2
icmp     1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=22 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=22 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.

Step 9: Stop the current bandwidth test between DUT2 and DUT1

Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   133  100   133    0     0   3962      0 --:--:-- --:--:-- --:--:--  4030

Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:

Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)

Step 12: Modify the following configuration lines in DUT0:

set service firewall FW ruleset file 'running://test-performance-udp.rules'

Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1

Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance UDP traffic).+$
Show output
12/03/2024-14:16:32.307859  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54842 -> 40.0.0.2:5001
12/03/2024-14:16:32.308738  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54856 -> 40.0.0.2:5001
12/03/2024-14:16:34.527734  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54872 -> 40.0.0.2:5001
12/03/2024-14:16:34.529422  [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:52667 -> 40.0.0.2:5001
12/03/2024-14:16:34.540616  [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:52667 -> 40.0.0.2:5001

Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$
Show output
udp      17 src=20.0.0.2 dst=40.0.0.2 sport=52667 dport=5001 packets=17 bytes=23648 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=52667 packets=1 bytes=32 [OFFLOAD, packets=14 bytes=20664 packets=0 bytes=0] mark=129834765 use=2
tcp      6 src=20.0.0.2 dst=40.0.0.2 sport=54872 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=54872 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=406 packets=4 bytes=211] mark=129834765 use=2
conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.

Step 16: Stop the current bandwidth test between DUT2 and DUT1

Test Traffic Early Dropping

Description

Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.

The contents of the rule file are:

drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)

This rule allows the connection to be established and traffic to be dropped later.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   200  100   200    0     0  31162      0 --:--:-- --:--:-- --:--:-- 33333

Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:

Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://drop-performance.rules'
set service firewall FW stream bypass action drop set xdp-early-drop eth1
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.615 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.615/0.615/0.615/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.559 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.559/0.559/0.559/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1
Expect this output in DUT2:
^C- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
iperf3: interrupt - the client has terminated
admin@osdx$

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$
Show output
12/03/2024-14:16:55.749454  [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48416 -> 40.0.0.2:5000

Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:

yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*
Show output
------------------------------------------------------------------------
  src       dst     src port  dst port  tcp  vlan_0  vlan_1  pkts  bytes
------------------------------------------------------------------------
40.0.0.2  20.0.0.2      5000     48416  yes     201       0     0      0
20.0.0.2  40.0.0.2     48416      5000  yes     201       0     8    673

Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:

Show output
Pin path: /sys/fs/bpf/eth1
Period of 0.250137s ending at 1733235419.334705
XDP_DROP               8 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_PASS         4040432 pkts (         0 pps)     5247184 KiB (     0 Mbits/s)
XDP_TX                 0 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_REDIRECT           0 pkts (         0 pps)           0 KiB (     0 Mbits/s)

Step 10: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1
Expect this output in DUT2:
^C- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams
iperf3: interrupt - the client has terminated
admin@osdx$

Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping UDP performance test traffic).+$
Show output
12/03/2024-14:16:55.749454  [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48416 -> 40.0.0.2:5000
12/03/2024-14:16:59.514573  [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:48413 -> 40.0.0.2:5001

Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:

yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*
Show output
------------------------------------------------------------------------
  src       dst     src port  dst port  tcp  vlan_0  vlan_1  pkts  bytes
------------------------------------------------------------------------
40.0.0.2  20.0.0.2      5001     48413  no      201       0     0      0
40.0.0.2  20.0.0.2      5000     48416  yes     201       0     0      0
20.0.0.2  40.0.0.2     48413      5001  no      201       0     0      0
20.0.0.2  40.0.0.2     48416      5000  yes     201       0    11    847

Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:

Show output
Pin path: /sys/fs/bpf/eth1
Period of 0.250141s ending at 1733235423.101601
XDP_DROP              11 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_PASS         4040472 pkts (         0 pps)     5247188 KiB (     0 Mbits/s)
XDP_TX                 0 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_REDIRECT           0 pkts (         0 pps)           0 KiB (     0 Mbits/s)