Policy

The following scenarios show how to configure different traffic policies. Policies can be used to manage and classify network packets. traffic selectors can be configured to filter packets based on certain fields.

Test Policy Actions 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different traffic actions are configured to accept, drop or limit incoming traffic.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 action accept
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 action accept
set traffic policy POLICY_IN rule 1 action drop

Step 5: Expect a failure in the following command: Initiate a udp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 8080 udp
admin@DUT1$ monitor test connection client 10.0.0.1 8080 udp

Step 6: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 action drop
set traffic policy POLICY_IN rule 1 action rate-limit 10

Step 7: Initiate a bandwidth test from DUT1 to DUT0

admin@DUT0$ monitor test performance server port 5001
admin@DUT1$ monitor test performance client 10.0.0.1 duration 5 port 5001 parallel 1

Note

Previous test should show a very low bandwidth rate.

Test Policy Copy 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different copy actions are configured to store the ToS value in the conntrack mark and extra conntrack mark fields.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 copy tos connmark
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 5 size 56 timeout 1

Step 4: Run the command system conntrack show on DUT0 and check whether the output contains the following tokens:

mark=12

Step 5: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 copy tos connmark
set traffic policy POLICY_IN rule 1 copy tos extra-connmark 1

Step 6: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 5 size 56 timeout 1

Step 7: Run the command system conntrack show on DUT0 and check whether the output contains the following tokens:

emark1=12

Test Policy Set 

Description 

In this scenario, an egress traffic policy is configured in DUT0 (‘eth0’ interface) to mark outgoing packets using ToS and CoS fields.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN
set traffic policy POLICY_OUT rule 1 set tos 12

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run the command traffic dump monitor detail interface eth0 filter "host 10.0.0.2" on DUT1.

Step 4: Ping the IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 5: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_OUT rule 1 set tos
set traffic policy POLICY_OUT rule 1 set cos-mark 5

Step 6: Run the command traffic dump monitor detail interface eth0 filter "host 10.0.0.2" on DUT1.

Step 7: Ping the IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Test Policy Set Conntrack Values 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different set actions are configured to change the conntrack mark, the app-id and the VRF.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set connmark 15
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 4: Run the command system conntrack show on DUT0 and check whether the output contains the following tokens:

mark=15

Step 5: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 set connmark
set traffic policy POLICY_IN rule 1 set app-id custom 80

Step 6: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 7: Run the command system conntrack show on DUT0 and check whether the output contains the following tokens:

appdetect[U6:80]

Step 8: Modify the following configuration lines in DUT0 :

set system conntrack app-detect app-id-storage chained

Step 9: Run the command system conntrack clear on DUT0.

Step 10: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 11: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:

appdetect\[L3:1;U6:80\]

Step 12: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 set app-id
set interfaces ethernet eth0 vif 100 vrf RED
set system vrf RED
set traffic policy POLICY_IN rule 1 set vrf RED

Step 13: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 14: Run the command system conntrack show on DUT0 and check whether the output contains the following tokens:

vrf=RED

Test Policy Log 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The log option is configured to show system messages that help debug and analyze the network status. Additionally, an invalid log prefix is included to illustrate the maximum length allowed.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 log level err
set traffic policy POLICY_IN rule 1 log prefix Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run the command system journal show | tail on DUT0 and check whether the output contains the following tokens:

[Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit-1] ACCEPT IN=eth0

Step 5: Run the command configure on DUT0 and expect the following output:

Show output
admin@osdx#

Step 6: Run the command set traffic policy INVALID_LOG_PREFIX rule 1 log prefix Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-amet-vita on DUT0 and check whether the output contains the following tokens:

Log prefix must be 92 characters or less and must contain printable characters except those defined as part of the space character class

Test Policy Advisor 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The advisor option is configured to enable/disable the rule depending on the advisor status. If the rule is enabled, incoming traffic will be dropped.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system advisor ADV test false
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 action drop
set traffic policy POLICY_IN rule 1 advisor ADV
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Modify the following configuration lines in DUT0 :

set system advisor ADV test true

Step 5: Expect a failure in the following command: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 6: Modify the following configuration lines in DUT0 :

set system advisor ADV test false

Step 7: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Test Policy Set Label 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The set label action is configured to assign a label to conntrack entries. Labels are used to classify and identify connections in the conntrack table, which can be useful for traffic analysis and policy enforcement.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic label TESTLABEL
set traffic policy POLICY_IN rule 1 set label TESTLABEL
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 4: Run the command system conntrack show on DUT0 and check whether the output contains the following tokens:

labels=TESTLABEL