General Tests

The following scenario shows how to place an OSDx router between two machines to allow them to communicate with each other and to provide protection when accessing one another and the external WAN.

Test Simple Ruleset With Queues 

Description 

Configures the three DUTs that will be used and checks that they are capable of pinging each other but not of connecting via SSH, since these connections are being dropped by the firewall.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://base.rules'
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 2: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 3: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 4: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Expect a failure in the following command: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 7: Expect a failure in the following command: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 8: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+[Drop].+(SSH not allowed in this network).+$

Test Simple Ruleset With Custom Action-order 

Configures the three DUTs that will be used and checks that initially they are capable of pinging each other but after changing the priority of rule actions, ICMP traffic is not passed, but dropped by the firewall.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://base.rules'
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 2: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 3: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 4: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Modify the following configuration lines in DUT0 :

set service firewall FW action-order 'drop, reject, alert, pass'

Step 7: Expect a failure in the following command: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 8: Expect a failure in the following command: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 9: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+[Drop].+(ICMP traffic dropped).+$

Test Simple Ruleset Using Routing With Marks 

Description 

Configures the three DUTs that will be used. In this test the traffic is routed using marks in DUT0 (like SD-WAN scenarios). Then, checks that initially ping works from DUT1 to DUT2 but after changing the priority of rule actions, ICMP traffic is not passed, but dropped by the firewall.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in LAN_IN
set interfaces ethernet eth1 vif 101 vrf LAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 201 traffic policy in WAN_IN
set interfaces ethernet eth1 vif 201 vrf WAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set protocols vrf AP static route 0.0.0.0/0 next-hop-vrf WAN
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://base.rules'
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system traffic policy in FW_POLICY priority very-low
set system vrf AP
set system vrf LAN
set system vrf WAN
set traffic policy FW_POLICY rule 1 action enqueue FW_Q
set traffic policy FW_POLICY rule 1 selector AP_CONNMARK
set traffic policy LAN_IN rule 1 selector ICMP
set traffic policy LAN_IN rule 1 set vrf AP connmark-cache
set traffic policy WAN_IN rule 1 selector AP_CONNMARK
set traffic policy WAN_IN rule 1 set vrf LAN
set traffic queue FW_Q elements 1
set traffic selector AP_CONNMARK rule 1 vrf-connmark AP
set traffic selector ICMP rule 1 protocol icmp

Step 2: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 3: Modify the following configuration lines in DUT0 :

set service firewall FW action-order 'drop, reject, alert, pass'

Step 4: Expect a failure in the following command: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+[Drop].+(ICMP traffic dropped).+$

Test Simple Ruleset With Queues IDS Mode 

Description 

Configures the three DUTs that will be used and checks that they are capable of pinging each other and of connecting via SSH. Since the firewall is set to IDS mode, these connections are not being dropped.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging outputs fast
set service firewall FW mode monitor interfaces eth0,eth1
set service firewall FW ruleset file 'running://base.rules'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 3: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 4: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Run the command service firewall FW show reload-stats on DUT0 and expect the following output:

Step 7: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 8: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 9: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+[wDrop].+(SSH not allowed in this network).+$

Test Encrypted Ruleset 

Description 

Configures the three DUTs, encrypts an arbitrary ruleset file and checks that the firewall is handling said file as expected. The firewall behaves the same way as for Test Simple Ruleset With Queues but with an encrypted ruleset.

Scenario 

Step 1: Run the command file copy http://10.215.168.1/~robot/base-enc.rules running:// force on DUT0 and expect the following output:

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://base-enc.rules' digest sha512
set service firewall FW ruleset file 'running://base-enc.rules' encrypted-password U2FsdGVkX1/yZ/bYGeWBIiSv+nXG8j5fcJ9L7jzU/pb3jkud8iMSE02r6jKJBtcn
set service firewall FW ruleset file 'running://base-enc.rules' iterations 100000
set service firewall FW ruleset file 'running://base-enc.rules' key-length 256
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 3: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 4: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 6: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 7: Expect a failure in the following command: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 8: Expect a failure in the following command: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 9: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+[Drop].+(SSH not allowed in this network).+$

Test Encrypted Patch 

Description 

Configures three DUTs, encrypts a patch that allows SSH communication between the DUTs and enables bypass. The original input file was:

drop ssh any any -> any any (msg: "SSH not allowed in this network"; sid: 2;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)

After applying the following patch:

1c1
< drop ssh any any -> any any (msg: "SSH not allowed in this network"; sid: 2;)
---
> alert ssh any any -> any any (msg: "SSH traffic detected - bypassing"; bypass; sid: 2;)

The resulting file must be:

alert ssh any any -> any any (msg: "SSH traffic detected - bypassing"; bypass; sid: 2;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)

This not only allows SSH traffic but also enables the bypass feature (not tested here yet).

Scenario 

Step 1: Run the command file copy http://10.215.168.1/~robot/base-enc.rules running:// force on DUT0 and expect the following output:

Step 2: Run the command file copy http://10.215.168.1/~robot/base-enc.diff1 running:// force on DUT0 and expect the following output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://base-enc.rules' digest sha512
set service firewall FW ruleset file 'running://base-enc.rules' encrypted-password U2FsdGVkX1+m7rZMMDzTz8Gk5hae7vG1yU1XFqZxGAesIoFqGOSZAedRbcEVT4AE
set service firewall FW ruleset file 'running://base-enc.rules' iterations 100000
set service firewall FW ruleset file 'running://base-enc.rules' key-length 256
set service firewall FW ruleset patch 'running://base-enc.diff1' digest sha512
set service firewall FW ruleset patch 'running://base-enc.diff1' encrypted-password U2FsdGVkX1/0Xkcepc0ffK8hTUzSTOUNYzJyD0a6xiDeOR6RfJB7Npyu0Eozb4Z+
set service firewall FW ruleset patch 'running://base-enc.diff1' iterations 100000
set service firewall FW ruleset patch 'running://base-enc.diff1' key-length 256
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 6: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 7: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 8: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 9: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 10: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(SSH traffic detected - bypassing).+$

Test Compressed Ruleset With Patch 

Description 

Configures three DUTs, places a patch between the DUTs that allows SSH communication, and enables bypass. In addition, there are two source rules that are compressed into a tar.gz file whose content is used by the firewall to define the rules. One of the files is named base.rules``and is the file that the patch is meant for. The second one is ``test-performance.rules whose contents are:: The original input file was:

alert tcp any any -> any 5001 (msg: "Skipping test network performance TCP traffic"; bypass; flow: established, to_server; sid: 4;)

This rule simply bypasses traffic that is deemed “performance traffic”, which is directly associated with the monitor test performance command.

Scenario 

Step 1: Run the command file copy http://10.215.168.1/~robot/ruleset.tar.gz running:// force on DUT0 and expect the following output:

Step 2: Run the command file copy http://10.215.168.1/~robot/base.diff1 running:// force on DUT0 and expect the following output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset compressed 'running://ruleset.tar.gz'
set service firewall FW ruleset patch 'running://base.diff1'
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 6: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 7: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 8: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 9: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 10: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(SSH traffic detected - bypassing).+$

Step 11: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 1 port 5001 parallel 1

Step 12: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(Skipping test network performance TCP traffic).+$

Test Single File In Compressed Ruleset 

Description 

Compresses two ruleset files but only chooses the test-performance.rules from within the compressed file. Lastly, checks that performance traffic is detected but no message is generated for SSH traffic, indicating that only one file is being used.

Scenario 

Step 1: Run the command file copy http://10.215.168.1/~robot/ruleset.tar.gz running:// force on DUT0 and expect the following output:

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset compressed 'running://ruleset.tar.gz' file test-performance.rules
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 3: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 4: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 6: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 7: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 8: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 9: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output does not match the following regular expressions:

(?m)^.+(SSH traffic detected - bypassing).+$

Step 10: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 1 port 5001 parallel 1

Step 11: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(Skipping test network performance TCP traffic).+$

Test Selectors 

Description 

Builds a scenario with three DUTs in which some selectors are applied to traffic depending on the network detected. This allows specific selector-based rules to be applied to traffic and with only one firewall instance.

To demonstrate this behavior, two labels will be set:

WAN label that is applied to every packet going outside the local network.

LAN label that marks every packet present in the underlying network.

For this purpose, a whole scenario will be used to enable all the features to work:

A compressed, encrypted ruleset will be created that contains base.rules as well as test-performance.rules.

A patch that will upgrade base.rules so it contains rules based on labels. The expected final result will be:

alert ssh any any -> any any (msg: "Local SSH traffic - bypassing..."; selector: LOCAL; bypass; sid: 1; flow: established, to_server;)
drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23; selector: WAN;)
pass icmp any any -> any any (msg: "ICMP traffic ignored"; sid: 3;)
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; selector: WAN, LOCAL; sid: 4; flow: established, to_server;)

Hence, the following will be tested:

SSH connection is working between the LAN nodes - DUT1 and DUT2

It is impossible to get the nids.html file (i.e., a malicious file) from the WAN.

ICMP messages are allowed from any node within the network.

Traffic performance tests are allowed for both the WAN and LOCAL selectors but not on port 5000.

Scenario 

Step 1: Run the command file copy http://10.215.168.1/~robot/ruleset.tar.gz.aes256 running://ruleset.tar.gz force on DUT0 and expect the following output:

Step 2: Run the command file copy http://10.215.168.1/~robot/base.diff2-aes256 running:// force on DUT0 and expect the following output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth0 traffic policy in FW_PWAN
set interfaces ethernet eth0 traffic policy out FW_PWAN
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset compressed 'running://ruleset.tar.gz' digest sha512
set service firewall FW ruleset compressed 'running://ruleset.tar.gz' encrypted-password U2FsdGVkX1/CGQ8AcWg7lDf5nlIvAsPpwa8qfziczJ/Rk0z9/I2m6w9MgDrCSZ/B
set service firewall FW ruleset compressed 'running://ruleset.tar.gz' iterations 100000
set service firewall FW ruleset compressed 'running://ruleset.tar.gz' key-length 256
set service firewall FW ruleset patch 'running://base.diff2-aes256' digest sha512
set service firewall FW ruleset patch 'running://base.diff2-aes256' encrypted-password U2FsdGVkX1920U8/0B8htBjCUsj/kTm7b83CpJTreaiZo6MgpVipILMd9uschscq
set service firewall FW ruleset patch 'running://base.diff2-aes256' iterations 100000
set service firewall FW ruleset patch 'running://base.diff2-aes256' key-length 256
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic group address LAN element 20.0.0.0/24
set traffic group address LAN element 40.0.0.0/24
set traffic label LOCAL
set traffic label WAN
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 1 selector LAN
set traffic policy FW_PLAN rule 1 set label LOCAL
set traffic policy FW_PWAN rule 1 action enqueue FW_Q
set traffic policy FW_PWAN rule 1 set label WAN
set traffic queue FW_Q elements 1
set traffic selector LAN rule 1 destination address-group LAN
set traffic selector LAN rule 1 source address-group LAN

Step 4: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 6: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 7: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 8: Initiate an SSH connection from DUT1 to IP address 20.0.0.2 using user admin:

admin@DUT1$ ssh admin@20.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 9: Initiate an SSH connection from DUT2 to IP address 40.0.0.2 using user admin:

admin@DUT2$ ssh admin@40.0.0.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 10: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(Local SSH traffic - bypassing...).+$

Step 11: Expect a failure in the following command: Initiate an SSH connection from DUT1 to IP address 10.215.168.1 using user admin:

admin@DUT1$ ssh admin@10.215.168.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 12: Expect a failure in the following command: Initiate an SSH connection from DUT2 to IP address 10.215.168.1 using user admin:

admin@DUT2$ ssh admin@10.215.168.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null option ConnectTimeout=1 option ServerAliveInterval=1 option ServerAliveCountMax=1

Step 13: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(Outgoing TCP traffic to port 22 from LAN to WAN).+$

Step 14: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 15: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1

Step 16: Run the command service firewall FW show logging fast | tail on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$

Test Hashset 

Description 

Configures the three DUTs although only DUT0 is used for the test. First, a probe file is downloaded by DUT0. The probe file is detected by the service firewall running in DUT0 and md5, sha1 and sha256 hashes are logged. Lastly, the service firewall is configured for blocking the download of the probe file when is recognized through the configured md5, sha1 or sha256 hashset files.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth0 traffic policy in FW_PWAN
set interfaces ethernet eth0 traffic policy out FW_PWAN
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs eve types files force-hash md5
set service firewall FW logging outputs eve types files force-hash sha1
set service firewall FW logging outputs eve types files force-hash sha256
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://http-alert.rules'
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PWAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 2: Ping the IP address 40.0.0.2 from DUT0:

admin@DUT0$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 3: Ping the IP address 20.0.0.2 from DUT0:

admin@DUT0$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 4: Ping the IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Run the command file show running://http-alert.rules on DUT0 and expect the following output:

Step 7: Run the command file copy http://10.215.168.1/~robot/nids.html running:// force on DUT0 and expect the following output:

Step 8: Run the command service firewall FW show logging eve | grep -E "HTTP ALERT Test by Teldat.*md5.*:.*c533c963702d7e99b2aa52713d3cf63c" on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+("signature_id":10001).+$

Step 9: Run the command service firewall FW show logging eve | grep -E "HTTP ALERT Test by Teldat.*sha1.*:.*edbfd7fc5eba4b93b8299e4b31352578a74f5773" on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+("signature_id":10001).+$

Step 10: Run the command service firewall FW show logging eve | grep -E "HTTP ALERT Test by Teldat.*sha256.*:.*11b4ce07fad40ff666d4c67fe9f9aa7eacecbb3876c0c8c5ee0298202bd9cd6d" on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+("signature_id":10001).+$

Step 11: Run the command file copy http://10.215.168.1/~robot/hashset-md5.list running:// force on DUT0 and expect the following output:

Step 12: Run the command file copy http://10.215.168.1/~robot/filehash-md5-drop.rules running:// force on DUT0 and expect the following output:

Step 13: Run the command file show running://hashset-md5.list on DUT0 and expect the following output:

Step 14: Run the command file show running://filehash-md5-drop.rules on DUT0 and expect the following output:

Step 15: Modify the following configuration lines in DUT0 :

set service firewall FW hashset file 'running://hashset-md5.list'
set service firewall FW ruleset file 'running://filehash-md5-drop.rules'

Step 16: Run the command file copy http://10.215.168.1/~robot/nids.html running:// force on DUT0, press Ctrl+C after 10 seconds and expect the following output:

Step 17: Run the command service firewall FW show logging eve | grep -E "HTTP MD5 DROP Test by Teldat.*md5.*:.*c533c963702d7e99b2aa52713d3cf63c" on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+("signature_id":10002).+$

Step 18: Run the command file copy http://10.215.168.1/~robot/hashset-sha1.list running:// force on DUT0 and expect the following output:

Step 19: Run the command file copy http://10.215.168.1/~robot/filehash-sha1-drop.rules running:// force on DUT0 and expect the following output:

Step 20: Run the command file show running://hashset-sha1.list on DUT0 and expect the following output:

Step 21: Run the command file show running://filehash-sha1-drop.rules on DUT0 and expect the following output:

Step 22: Modify the following configuration lines in DUT0 :

delete service firewall FW hashset file 'running://hashset-md5.list'
delete service firewall FW ruleset file 'running://filehash-md5-drop.rules'
set service firewall FW hashset file 'running://hashset-sha1.list'
set service firewall FW ruleset file 'running://filehash-sha1-drop.rules'

Step 23: Run the command file copy http://10.215.168.1/~robot/nids.html running:// force on DUT0, press Ctrl+C after 10 seconds and expect the following output:

Step 24: Run the command service firewall FW show logging eve | grep -E "HTTP SHA1 DROP Test by Teldat.*md5.*:.*edbfd7fc5eba4b93b8299e4b31352578a74f5773" on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+("signature_id":10003).+$

Step 25: Run the command file copy http://10.215.168.1/~robot/hashset-sha256.list running:// force on DUT0 and expect the following output:

Step 26: Run the command file copy http://10.215.168.1/~robot/filehash-sha256-drop.rules running:// force on DUT0 and expect the following output:

Step 27: Run the command file show running://hashset-sha256.list on DUT0 and expect the following output:

Step 28: Run the command file show running://filehash-sha256-drop.rules on DUT0 and expect the following output:

Step 29: Modify the following configuration lines in DUT0 :

delete service firewall FW hashset file 'running://hashset-sha1.list'
delete service firewall FW ruleset file 'running://filehash-sha1-drop.rules'
set service firewall FW hashset file 'running://hashset-sha256.list'
set service firewall FW ruleset file 'running://filehash-sha256-drop.rules'

Step 30: Run the command file copy http://10.215.168.1/~robot/nids.html running:// force on DUT0, press Ctrl+C after 10 seconds and expect the following output:

Step 31: Run the command service firewall FW show logging eve | grep -E "HTTP SHA256 DROP Test by Teldat.*md5.*:.*11b4ce07fad40ff666d4c67fe9f9aa7eacecbb3876c0c8c5ee0298202bd9cd6d" on DUT0 and check whether the output matches the following regular expressions:

(?m)^.+("signature_id":10004).+$