Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 39546 0 --:--:-- --:--:-- --:--:-- 43000
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.727 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.727/0.727/0.727/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.611 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.611/0.611/0.611/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 34026 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 62.4 MBytes 523 Mbits/sec 4 1.50 MBytes [ 5] 1.00-2.00 sec 67.5 MBytes 566 Mbits/sec 35 1.12 MBytes [ 5] 2.00-3.00 sec 72.5 MBytes 608 Mbits/sec 0 1.19 MBytes [ 5] 3.00-4.00 sec 70.0 MBytes 587 Mbits/sec 0 1.23 MBytes [ 5] 4.00-5.00 sec 82.5 MBytes 692 Mbits/sec 0 1.26 MBytes [ 5] 5.00-6.00 sec 77.5 MBytes 650 Mbits/sec 0 1.28 MBytes [ 5] 6.00-7.00 sec 82.5 MBytes 692 Mbits/sec 0 1.32 MBytes [ 5] 7.00-8.00 sec 70.0 MBytes 587 Mbits/sec 0 1.36 MBytes [ 5] 8.00-9.00 sec 61.2 MBytes 514 Mbits/sec 0 1.40 MBytes [ 5] 9.00-10.00 sec 61.2 MBytes 514 Mbits/sec 0 1.43 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 707 MBytes 593 Mbits/sec 39 sender [ 5] 0.00-10.01 sec 705 MBytes 591 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/03/2025-10:59:16.457925 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34020 -> 40.0.0.2:5001 02/03/2025-10:59:16.459675 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34026 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 15022 0 --:--:-- --:--:-- --:--:-- 16125
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.693 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.693/0.693/0.693/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.687 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.687/0.687/0.687/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 38326 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.01 sec 78.6 MBytes 653 Mbits/sec 265 1.19 MBytes [ 5] 1.01-2.00 sec 97.5 MBytes 826 Mbits/sec 0 1.27 MBytes [ 5] 2.00-3.00 sec 118 MBytes 986 Mbits/sec 0 1.33 MBytes [ 5] 3.00-4.00 sec 111 MBytes 933 Mbits/sec 0 1.38 MBytes [ 5] 4.00-5.00 sec 124 MBytes 1.04 Gbits/sec 0 1.42 MBytes [ 5] 5.00-6.00 sec 119 MBytes 996 Mbits/sec 0 1.48 MBytes [ 5] 6.00-7.00 sec 146 MBytes 1.23 Gbits/sec 0 1.54 MBytes [ 5] 7.00-8.00 sec 130 MBytes 1.09 Gbits/sec 0 1.60 MBytes [ 5] 8.00-9.00 sec 93.8 MBytes 787 Mbits/sec 9 1.20 MBytes [ 5] 9.00-10.00 sec 116 MBytes 975 Mbits/sec 0 1.32 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.11 GBytes 951 Mbits/sec 274 sender [ 5] 0.00-10.01 sec 1.11 GBytes 949 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/03/2025-11:00:00.783914 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38324 -> 40.0.0.2:5001 02/03/2025-11:00:00.785676 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38326 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 03 10:59:47.003337 osdx systemd-timedated[33596]: Changed local time to Mon 2025-02-03 10:59:47 UTC Feb 03 10:59:47.005767 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'set date 2025-02-03 10:59:47'. Feb 03 10:59:47.007430 osdx systemd-journald[1936]: Time jumped backwards, rotating. Feb 03 10:59:47.515271 osdx systemd-journald[1936]: Runtime Journal (/run/log/journal/0b455e05fd8849079cae205af04c9e16) is 2.1M, max 15.3M, 13.2M free. Feb 03 10:59:47.516121 osdx systemd-journald[1936]: Received client request to rotate journal, rotating. Feb 03 10:59:47.516188 osdx systemd-journald[1936]: Vacuuming done, freed 0B of archived journals from /run/log/journal/0b455e05fd8849079cae205af04c9e16. Feb 03 10:59:47.536729 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'system journal clear'. Feb 03 10:59:48.138668 osdx osdx-coredump[33614]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 03 10:59:48.151584 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'system coredump delete all'. Feb 03 10:59:48.935159 osdx OSDxCLI[33264]: User 'admin' entered the configuration menu. Feb 03 10:59:49.069964 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 03 10:59:49.183423 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 03 10:59:49.299351 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 03 10:59:49.403976 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 03 10:59:49.519538 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 03 10:59:49.631266 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 03 10:59:49.785465 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'show working'. Feb 03 10:59:49.923249 osdx INFO[33641]: FRR daemons did not change Feb 03 10:59:49.943446 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 03 10:59:50.063437 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 03 10:59:50.111645 osdx (udev-worker)[33735]: Network interface NamePolicy= disabled on kernel command line. Feb 03 10:59:50.436772 osdx cfgd[1636]: [33264]Completed change to active configuration Feb 03 10:59:50.492479 osdx OSDxCLI[33264]: User 'admin' committed the configuration. Feb 03 10:59:50.529717 osdx OSDxCLI[33264]: User 'admin' left the configuration menu. Feb 03 10:59:53.792019 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 03 10:59:53.912229 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 03 10:59:54.060653 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 03 10:59:54.963825 osdx file_operation[33826]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 03 10:59:55.004925 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 03 10:59:55.241976 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 03 10:59:55.457962 osdx OSDxCLI[33264]: User 'admin' entered the configuration menu. Feb 03 10:59:55.587992 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 03 10:59:55.720109 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 03 10:59:55.871329 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 03 10:59:56.002235 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 03 10:59:56.180559 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 03 10:59:56.293453 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 03 10:59:56.470468 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 03 10:59:56.603796 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 03 10:59:56.733264 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 03 10:59:56.858546 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 03 10:59:56.980997 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 03 10:59:57.117685 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 03 10:59:57.235802 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 03 10:59:57.411271 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 03 10:59:57.594594 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 03 10:59:57.789918 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 03 10:59:57.906616 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 03 10:59:58.098095 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 03 10:59:58.191144 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 03 10:59:58.289017 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 03 10:59:58.477179 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'show working'. Feb 03 10:59:58.875240 osdx INFO[33906]: FRR daemons did not change Feb 03 10:59:59.416035 osdx systemd[1]: Reloading. Feb 03 10:59:59.583497 osdx systemd-sysv-generator[33966]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 03 10:59:59.763918 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 03 10:59:59.789544 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 03 11:00:00.118473 osdx INFO[33948]: Rules successfully loaded Feb 03 11:00:00.119583 osdx cfgd[1636]: [33264]Completed change to active configuration Feb 03 11:00:00.122526 osdx OSDxCLI[33264]: User 'admin' committed the configuration. Feb 03 11:00:00.152694 osdx OSDxCLI[33264]: User 'admin' left the configuration menu. Feb 03 11:00:00.787501 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=44753 DF PROTO=TCP SPT=38324 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 03 11:00:00.787734 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=63944 DF PROTO=TCP SPT=38326 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 03 11:00:11.047981 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 03 11:00:11.101762 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 03 11:00:11.101960 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 03 11:00:11.104270 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0:
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 58852 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 111 MBytes 932 Mbits/sec 10 1.55 MBytes [ 5] 1.00-2.00 sec 116 MBytes 975 Mbits/sec 130 1.18 MBytes [ 5] 2.00-3.00 sec 179 MBytes 1.50 Gbits/sec 0 1.27 MBytes [ 5] 3.00-4.00 sec 122 MBytes 1.03 Gbits/sec 0 1.34 MBytes [ 5] 4.00-5.00 sec 122 MBytes 1.03 Gbits/sec 0 1.40 MBytes [ 5] 5.00-6.00 sec 104 MBytes 867 Mbits/sec 8 1.08 MBytes [ 5] 6.00-7.00 sec 152 MBytes 1.28 Gbits/sec 0 1.18 MBytes [ 5] 7.00-8.00 sec 211 MBytes 1.77 Gbits/sec 0 1.26 MBytes [ 5] 8.00-9.00 sec 179 MBytes 1.50 Gbits/sec 0 1.34 MBytes [ 5] 9.00-10.00 sec 189 MBytes 1.58 Gbits/sec 0 1.43 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.45 GBytes 1.25 Gbits/sec 148 sender [ 5] 0.00-10.00 sec 1.45 GBytes 1.24 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/03/2025-11:00:00.783914 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38324 -> 40.0.0.2:5001 02/03/2025-11:00:00.785676 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38326 -> 40.0.0.2:5001 02/03/2025-11:00:17.958475 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58840 -> 40.0.0.2:5001 02/03/2025-11:00:17.960499 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58852 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 03 10:59:47.003337 osdx systemd-timedated[33596]: Changed local time to Mon 2025-02-03 10:59:47 UTC Feb 03 10:59:47.005767 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'set date 2025-02-03 10:59:47'. Feb 03 10:59:47.007430 osdx systemd-journald[1936]: Time jumped backwards, rotating. Feb 03 10:59:47.515271 osdx systemd-journald[1936]: Runtime Journal (/run/log/journal/0b455e05fd8849079cae205af04c9e16) is 2.1M, max 15.3M, 13.2M free. Feb 03 10:59:47.516121 osdx systemd-journald[1936]: Received client request to rotate journal, rotating. Feb 03 10:59:47.516188 osdx systemd-journald[1936]: Vacuuming done, freed 0B of archived journals from /run/log/journal/0b455e05fd8849079cae205af04c9e16. Feb 03 10:59:47.536729 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'system journal clear'. Feb 03 10:59:48.138668 osdx osdx-coredump[33614]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 03 10:59:48.151584 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'system coredump delete all'. Feb 03 10:59:48.935159 osdx OSDxCLI[33264]: User 'admin' entered the configuration menu. Feb 03 10:59:49.069964 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 03 10:59:49.183423 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 03 10:59:49.299351 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 03 10:59:49.403976 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 03 10:59:49.519538 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 03 10:59:49.631266 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 03 10:59:49.785465 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'show working'. Feb 03 10:59:49.923249 osdx INFO[33641]: FRR daemons did not change Feb 03 10:59:49.943446 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 03 10:59:50.063437 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 03 10:59:50.111645 osdx (udev-worker)[33735]: Network interface NamePolicy= disabled on kernel command line. Feb 03 10:59:50.436772 osdx cfgd[1636]: [33264]Completed change to active configuration Feb 03 10:59:50.492479 osdx OSDxCLI[33264]: User 'admin' committed the configuration. Feb 03 10:59:50.529717 osdx OSDxCLI[33264]: User 'admin' left the configuration menu. Feb 03 10:59:53.792019 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 03 10:59:53.912229 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 03 10:59:54.060653 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 03 10:59:54.963825 osdx file_operation[33826]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 03 10:59:55.004925 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 03 10:59:55.241976 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 03 10:59:55.457962 osdx OSDxCLI[33264]: User 'admin' entered the configuration menu. Feb 03 10:59:55.587992 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 03 10:59:55.720109 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 03 10:59:55.871329 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 03 10:59:56.002235 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 03 10:59:56.180559 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 03 10:59:56.293453 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 03 10:59:56.470468 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 03 10:59:56.603796 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 03 10:59:56.733264 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 03 10:59:56.858546 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 03 10:59:56.980997 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 03 10:59:57.117685 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 03 10:59:57.235802 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 03 10:59:57.411271 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 03 10:59:57.594594 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 03 10:59:57.789918 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 03 10:59:57.906616 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 03 10:59:58.098095 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 03 10:59:58.191144 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 03 10:59:58.289017 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 03 10:59:58.477179 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'show working'. Feb 03 10:59:58.875240 osdx INFO[33906]: FRR daemons did not change Feb 03 10:59:59.416035 osdx systemd[1]: Reloading. Feb 03 10:59:59.583497 osdx systemd-sysv-generator[33966]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 03 10:59:59.763918 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 03 10:59:59.789544 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 03 11:00:00.118473 osdx INFO[33948]: Rules successfully loaded Feb 03 11:00:00.119583 osdx cfgd[1636]: [33264]Completed change to active configuration Feb 03 11:00:00.122526 osdx OSDxCLI[33264]: User 'admin' committed the configuration. Feb 03 11:00:00.152694 osdx OSDxCLI[33264]: User 'admin' left the configuration menu. Feb 03 11:00:00.787501 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=44753 DF PROTO=TCP SPT=38324 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 03 11:00:00.787734 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=63944 DF PROTO=TCP SPT=38326 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 03 11:00:11.047981 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 03 11:00:11.101762 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 03 11:00:11.101960 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 03 11:00:11.104270 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Feb 03 11:00:11.299745 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'system journal show | cat'. Feb 03 11:00:11.650802 osdx OSDxCLI[33264]: User 'admin' entered the configuration menu. Feb 03 11:00:11.766630 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 03 11:00:11.901281 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 03 11:00:12.028517 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 03 11:00:12.158567 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 03 11:00:12.265715 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 03 11:00:12.371715 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 03 11:00:12.552670 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 03 11:00:12.647810 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 03 11:00:12.777918 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 03 11:00:12.908525 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 03 11:00:13.044321 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 03 11:00:13.147435 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 03 11:00:13.273864 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 03 11:00:13.386241 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 03 11:00:13.479032 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 03 11:00:13.605181 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 03 11:00:13.705006 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 03 11:00:13.850450 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 03 11:00:13.940699 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 03 11:00:14.044751 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 03 11:00:14.151939 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Feb 03 11:00:14.252494 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Feb 03 11:00:14.357688 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Feb 03 11:00:14.482528 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Feb 03 11:00:14.656606 osdx OSDxCLI[33264]: User 'admin' added a new cfg line: 'show changes'. Feb 03 11:00:14.960331 osdx INFO[34104]: FRR daemons did not change Feb 03 11:00:15.299944 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Feb 03 11:00:17.034530 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Feb 03 11:00:17.154405 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Feb 03 11:00:17.154558 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Feb 03 11:00:17.154605 osdx systemd[1]: suricata@FW.service: Consumed 1.897s CPU time. Feb 03 11:00:17.176011 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 03 11:00:17.212113 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 03 11:00:17.574514 osdx INFO[34130]: Rules successfully loaded Feb 03 11:00:17.575866 osdx cfgd[1636]: [33264]Completed change to active configuration Feb 03 11:00:17.578883 osdx OSDxCLI[33264]: User 'admin' committed the configuration. Feb 03 11:00:17.606584 osdx OSDxCLI[33264]: User 'admin' left the configuration menu. Feb 03 11:00:17.959468 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=17820 DF PROTO=TCP SPT=58840 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 03 11:00:17.963928 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=61322 DF PROTO=TCP SPT=58852 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 03 11:00:28.269218 osdx OSDxCLI[33264]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 14507 0 --:--:-- --:--:-- --:--:-- 16125
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=8.59 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 8.587/8.587/8.587/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.621 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.621/0.621/0.621/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 39768 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 97.8 MBytes 820 Mbits/sec 329 1.15 MBytes [ 5] 1.00-2.01 sec 97.5 MBytes 807 Mbits/sec 0 1.22 MBytes [ 5] 2.01-3.00 sec 95.0 MBytes 808 Mbits/sec 0 1.28 MBytes [ 5] 3.00-4.01 sec 106 MBytes 884 Mbits/sec 0 1.32 MBytes [ 5] 4.01-5.00 sec 122 MBytes 1.04 Gbits/sec 0 1.37 MBytes [ 5] 5.00-6.00 sec 134 MBytes 1.12 Gbits/sec 35 1.01 MBytes [ 5] 6.00-7.00 sec 128 MBytes 1.07 Gbits/sec 0 1.13 MBytes [ 5] 7.00-8.00 sec 140 MBytes 1.17 Gbits/sec 0 1.23 MBytes [ 5] 8.00-9.00 sec 129 MBytes 1.08 Gbits/sec 0 1.30 MBytes [ 5] 9.00-10.00 sec 96.2 MBytes 807 Mbits/sec 0 1.35 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.12 GBytes 961 Mbits/sec 364 sender [ 5] 0.00-10.00 sec 1.12 GBytes 957 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/03/2025-11:00:59.312109 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39758 -> 40.0.0.2:5001 02/03/2025-11:00:59.314293 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39768 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=39768 dport=5001 packets=828078 bytes=1242109293 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39768 packets=47984 bytes=2500124 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=75 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=75 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=39758 dport=5001 packets=15 bytes=1250 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39758 packets=14 bytes=1084 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=40 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=40 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0:
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 53116 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 114 MBytes 956 Mbits/sec 113 1.50 MBytes [ 5] 1.00-2.00 sec 126 MBytes 1.06 Gbits/sec 25 1.14 MBytes [ 5] 2.00-3.00 sec 112 MBytes 944 Mbits/sec 0 1.20 MBytes [ 5] 3.00-4.00 sec 119 MBytes 996 Mbits/sec 0 1.27 MBytes [ 5] 4.00-5.00 sec 129 MBytes 1.08 Gbits/sec 0 1.34 MBytes [ 5] 5.00-6.00 sec 125 MBytes 1.05 Gbits/sec 0 1.40 MBytes [ 5] 6.00-7.00 sec 132 MBytes 1.11 Gbits/sec 41 1.05 MBytes [ 5] 7.00-8.01 sec 135 MBytes 1.13 Gbits/sec 0 1.16 MBytes [ 5] 8.01-9.00 sec 196 MBytes 1.65 Gbits/sec 0 1.26 MBytes [ 5] 9.00-10.00 sec 186 MBytes 1.57 Gbits/sec 0 1.33 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.34 GBytes 1.15 Gbits/sec 179 sender [ 5] 0.00-10.00 sec 1.34 GBytes 1.15 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/03/2025-11:00:59.312109 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39758 -> 40.0.0.2:5001 02/03/2025-11:00:59.314293 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39768 -> 40.0.0.2:5001 02/03/2025-11:01:14.944686 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53114 -> 40.0.0.2:5001 02/03/2025-11:01:14.946791 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53116 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=53114 dport=5001 packets=17 bytes=1635 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53114 packets=15 bytes=1136 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=53116 dport=5001 packets=994577 bytes=1491856129 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53116 packets=63669 bytes=3302624 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 17850 0 --:--:-- --:--:-- --:--:-- 18181
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.651 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.651/0.651/0.651/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.604 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.604/0.604/0.604/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/03/2025-11:01:56.375432 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52026 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=52026 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=52026 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=78 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=78 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=43 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=43 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0:
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/03/2025-11:01:56.375432 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52026 -> 40.0.0.2:5000 02/03/2025-11:02:04.557651 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52026 -> 40.0.0.2:5000 02/03/2025-11:02:06.332481 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38756 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=38756 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=38756 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 6 210 323 2 - 2 2 113 113 --------------------------------------------------------------------- Total 6 6 323 323 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 10 499 740 2 - 4 4 241 241 --------------------------------------------------------------------- Total 10 10 740 740
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 18079 0 --:--:-- --:--:-- --:--:-- 18428
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.777 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.777/0.777/0.777/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.589 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.589/0.589/0.589/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/03/2025-11:02:38.728782 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55720 -> 40.0.0.2:5001 02/03/2025-11:02:38.731642 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55730 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=46 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=46 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=55730 dport=5001 packets=33765 bytes=50638889 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55730 packets=3011 bytes=159988 [ASSURED] [OFFLOAD, packets=33752 bytes=50623688 packets=3009 bytes=159876] mark=129834765 use=2 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=81 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=81 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=55720 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55720 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=388 packets=4 bytes=211] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 18244 0 --:--:-- --:--:-- --:--:-- 19000
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0:
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
02/03/2025-11:02:38.728782 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55720 -> 40.0.0.2:5001 02/03/2025-11:02:38.731642 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55730 -> 40.0.0.2:5001 02/03/2025-11:02:42.089600 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48674 -> 40.0.0.2:5001 02/03/2025-11:02:42.091837 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:59767 -> 40.0.0.2:5001 02/03/2025-11:02:42.105618 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:59767 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=48674 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=48674 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=406 packets=4 bytes=211] mark=129834765 use=2 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=59767 dport=5001 packets=29 bytes=41360 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=59767 packets=1 bytes=32 [OFFLOAD, packets=26 bytes=38376 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 27952 0 --:--:-- --:--:-- --:--:-- 28571
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.805 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.805/0.805/0.805/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.721 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.721/0.721/0.721/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/03/2025-11:03:10.149133 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42652 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 42652 yes 201 0 0 0 20.0.0.2 40.0.0.2 42652 5000 yes 201 0 9 731
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250524s ending at 1738580594.257470 XDP_DROP 10 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 14 pkts ( 0 pps) 1 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
02/03/2025-11:03:10.149133 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42652 -> 40.0.0.2:5000 02/03/2025-11:03:14.538786 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:38884 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 42652 yes 201 0 0 0 20.0.0.2 40.0.0.2 42652 5000 yes 201 0 12 905 20.0.0.2 40.0.0.2 38884 5001 no 201 0 0 0 40.0.0.2 20.0.0.2 5001 38884 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250234s ending at 1738580598.543669 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 33 pkts ( 0 pps) 2 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)