Cos-Mark

The following scenarios shows how to filter packets based on the cos-mark attribute using traffic selectors.

Test Cos-mark Regular Hooks

Description

A traffic policy SET_COS is attached to DUT0’s ethernet interface (eth0) in the local-out hook to set the CoS mark to 5 on locally-generated packets. A second traffic policy MATCH_COS is attached to the same interface in the out (postrouting) hook and uses a traffic selector to filter packets with cos-mark 5, logging matches with prefix MATCH_COS. A regular ping (no VLAN tagging) verifies that the CoS mark set in local-out is correctly visible to the out hook on the same interface.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy local-out SET_COS
set interfaces ethernet eth0 traffic policy out MATCH_COS
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy MATCH_COS rule 1 log prefix MATCH_COS
set traffic policy MATCH_COS rule 1 selector MATCH_COS
set traffic policy SET_COS rule 1 set cos-mark 5
set traffic selector MATCH_COS rule 1 cos-mark 5

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 4: Run the command system journal show | grep MATCH_COS on DUT0 and check whether the output matches the following regular expressions:

.*MATCH_COS-1.*eth0.*10.0.0.1.*10.0.0.2.*

Test Cos-mark 802.1Q

Description

A traffic policy SET_INNER_COS is configured on DUT0’s VLAN 100 sub-interface (eth0 vif 100) to set the CoS mark to 5 on outgoing packets. On the parent interface (eth0), a second traffic policy MATCH_COS uses a traffic selector to filter packets with cos-mark 5 and logs matches with prefix MATCH_COS. A ping through the 802.1Q VLAN verifies that the CoS mark set on the sub-interface is correctly propagated and matched on the parent interface.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 mtu 1390
set interfaces ethernet eth0 traffic policy link-out MATCH_COS
set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy local-out SET_INNER_COS
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy MATCH_COS rule 1 log prefix MATCH_COS
set traffic policy MATCH_COS rule 1 selector MATCH_COS
set traffic policy SET_INNER_COS rule 1 set cos-mark 5
set traffic selector MATCH_COS rule 1 cos-mark 5

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 mtu 1390
set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 4: Run the command system journal show | grep MATCH_COS on DUT0 and check whether the output matches the following regular expressions:

.*MATCH_COS-1.*eth0.*10.0.0.1.*10.0.0.2.*

Test Not Cos-mark 802.1Q

Description

Same scenario as the 802.1Q test case, but the traffic selector uses not cos-mark 3 instead of cos-mark 5. Since SET_INNER_COS sets cos 5 on the sub-interface, the actual CoS mark is not 3, so not cos-mark 3 matches rule 1 and logs with prefix MATCH_COS.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 mtu 1390
set interfaces ethernet eth0 traffic policy link-out MATCH_COS
set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy local-out SET_INNER_COS
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy MATCH_COS rule 1 log prefix MATCH_COS
set traffic policy MATCH_COS rule 1 selector MATCH_COS
set traffic policy SET_INNER_COS rule 1 set cos-mark 5
set traffic selector MATCH_COS rule 1 not cos-mark 3

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 mtu 1390
set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 4: Run the command system journal show | grep MATCH_COS on DUT0 and check whether the output matches the following regular expressions:

.*MATCH_COS-1.*eth0.*10.0.0.1.*10.0.0.2.*

Test Cos-mark QinQ

Description

This scenario shows that when both the outer VLAN (eth0 vif 100) and the inner VLAN (eth0 vif 100 vif-c 200) have a set cos policy configured, the traffic selector MATCH_COS on the parent interface only matches the CoS value set by the last set cos applied in the chain.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 mtu 1390
set interfaces ethernet eth0 traffic policy link-out MATCH_COS
set interfaces ethernet eth0 vif 100 ethertype 802.1ad
set interfaces ethernet eth0 vif 100 traffic policy link-out SET_OUTER_COS
set interfaces ethernet eth0 vif 100 vif-c 200 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 vif-c 200 traffic policy local-out SET_INNER_COS
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy MATCH_COS rule 1 log prefix MATCH_COS
set traffic policy MATCH_COS rule 1 selector MATCH_COS
set traffic policy SET_INNER_COS rule 1 set cos-mark 5
set traffic policy SET_OUTER_COS rule 1 set cos-mark 3
set traffic selector MATCH_COS rule 1 cos-mark 3

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 mtu 1390
set interfaces ethernet eth0 vif 100 ethertype 802.1ad
set interfaces ethernet eth0 vif 100 vif-c 200 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 4: Run the command system journal show | grep MATCH_COS on DUT0 and check whether the output matches the following regular expressions:

(?i).*MATCH_COS-1.*eth0.*