App-Dictionary
These scenarios check the application dictionary support provided by app-detect feature.
Local Storage Application Dictionary
Description
DUT0 configures HTTP and DNS detection. DUT1 acts as a client behind DUT0 and DUT2 runs a DNS server. Traffic is first generated without a dictionary and connections are verified to be classified only by below-L7 detectors. Then a local dictionary file is loaded and statistics are checked to be empty. An HTTP download verifies FQDN match with local dictionary and performs IP-cache population. A second download verifies IP-cache match. An SSH connection verifies static IP address range match. Finally a DNS lookup and ping verify DNS-host detection with IP-cache lookup.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 address 192.168.2.100/24 set system conntrack app-detect dns-host set system conntrack app-detect http-host set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.2.101/24 set protocols static route 0.0.0.0/0 next-hop 192.168.2.100 set service dns forwarding name-server 10.215.168.66 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.215.168.66/24 set service dns forwarding local-ttl 30 set service dns forwarding name-server 127.0.0.1 set service dns static host-name enterprise.opentok.com inet 10.215.168.1 set service dns static host-name static.opentok.com inet 192.168.2.100 set service dns static host-name www.gamblingteldat.com inet 192.168.2.10 set service dns static host-name www.newspaperteldat.com inet 192.168.2.20 set service ssh set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 10.215.168.1 from DUT1:
admin@DUT1$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=1.14 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.137/1.137/1.137/0.000 ms
Step 5: Run the command file copy http://10.215.168.1/~robot/test_file running://user-data/ force on DUT0 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 5706 0 --:--:-- --:--:-- --:--:-- 6166
Step 6: Initiate an SSH connection from DUT0 to IP address 10.215.168.66 using user admin:
admin@DUT0$ ssh admin@10.215.168.66 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/nullShow output
Warning: Permanently added '10.215.168.66' (ECDSA) to the list of known hosts. admin@10.215.168.66's password: Welcome to Teldat OSDx v4.2.10.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Fri Jul 24 14:07:13 2026 admin@osdx$
Step 7: Ping the IP address 10.215.168.64 from DUT1:
admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1Show output
PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data. 64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.536 ms --- 10.215.168.64 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.536/0.536/0.536/0.000 ms
Step 8: Run the command system conntrack show on DUT0 and expect the following output:
Show output
icmp 1 29 src=192.168.2.101 dst=10.215.168.1 type=8 code=0 id=355 packets=1 bytes=84 src=10.215.168.1 dst=10.215.168.64 type=0 code=0 id=355 packets=1 bytes=84 mark=0 use=1 appdetect[L3:1] tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.1 sport=46714 dport=80 packets=6 bytes=583 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=46714 packets=4 bytes=504 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:10.215.168.1] tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.66 sport=47310 dport=22 packets=24 bytes=5057 src=10.215.168.66 dst=10.215.168.64 sport=22 dport=47310 packets=21 bytes=4865 [ASSURED] mark=0 use=1 appdetect[L4:22] icmp 1 29 src=192.168.2.101 dst=10.215.168.64 type=8 code=0 id=356 packets=1 bytes=84 src=10.215.168.64 dst=192.168.2.101 type=0 code=0 id=356 packets=1 bytes=84 mark=0 use=1 appdetect[L3:1] conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Run the command file copy http://10.215.168.1/~robot/test_dict.gz running://user-data/ force on DUT0 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 68181 100 68181 0 0 7272k 0 --:--:-- --:--:-- --:--:-- 7398k
Note
The dictionary file contains the following test entries used in this scenario:
Show output
<app id="30" name="Teldat Test" version="1"> <fqdn_list> <fqdn>10.215.168.1</fqdn> </fqdn_list> </app> <app id="31" name="Teldat Test 2" version="1"> <address_list> <range id="1"> <net_address>10.215.168.64</net_address> <net_mask>255.255.255.192</net_mask> </range> </address_list> </app>
Step 10: Modify the following configuration lines in DUT0 :
set system conntrack app-detect dictionary 1 filename 'running://user-data/test_dict.gz' set system conntrack app-detect enable_dict_match_priv_ip
Step 11: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 0 Modifications in IP-cache 0 Matches in dynamic dictionaries 0 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 12: Run the command system conntrack clear on DUT0.
Step 13: Run the command file copy http://10.215.168.1/~robot/test_file running://user-data/ force on DUT0 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 5356 0 --:--:-- --:--:-- --:--:-- 6166
Step 14: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
appdetect\[U128:30\shttp-host:10.215.168.1\]Show output
tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.1 sport=46742 dport=80 packets=6 bytes=583 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=46742 packets=4 bytes=504 [ASSURED] mark=0 use=1 appdetect[U128:30 http-host:10.215.168.1] conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 15: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 0 Modifications in IP-cache 1 Matches in dynamic dictionaries 1 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 16: Run the command file copy http://10.215.168.1/~robot/test_file running://user-data/ force on DUT0 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 5171 0 --:--:-- --:--:-- --:--:-- 5285
Step 17: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 1 Modifications in IP-cache 1 Matches in dynamic dictionaries 2 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 18: Initiate an SSH connection from DUT0 to IP address 10.215.168.66 using user admin:
admin@DUT0$ ssh admin@10.215.168.66 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/nullShow output
Warning: Permanently added '10.215.168.66' (ECDSA) to the list of known hosts. admin@10.215.168.66's password: Welcome to Teldat OSDx v4.2.10.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Fri Jul 24 14:13:42 2026 from 10.215.168.64 admin@osdx$
Step 19: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
src=10.215.168.64\sdst=10.215.168.66.*appdetect\[U128:31]Show output
tcp 6 18 TIME_WAIT src=10.215.168.64 dst=10.215.168.1 sport=46742 dport=80 packets=6 bytes=583 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=46742 packets=4 bytes=504 [ASSURED] mark=0 use=1 appdetect[U128:30 http-host:10.215.168.1] tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.66 sport=47314 dport=22 packets=24 bytes=5057 src=10.215.168.66 dst=10.215.168.64 sport=22 dport=47314 packets=20 bytes=4793 [ASSURED] mark=0 use=1 appdetect[U128:31] tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.1 sport=46758 dport=80 packets=6 bytes=583 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=46758 packets=4 bytes=504 [ASSURED] mark=0 use=1 appdetect[U128:30 http-host:10.215.168.1] conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 20: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 1 Matches in IP-cache 1 Modifications in IP-cache 1 Matches in dynamic dictionaries 2 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 21: Ping the IP address static.opentok.com from DUT1:
admin@DUT1$ ping static.opentok.com count 1 size 56 timeout 1Show output
PING static.opentok.com (192.168.2.100) 56(84) bytes of data. 64 bytes from static.opentok.com (192.168.2.100): icmp_seq=1 ttl=64 time=0.147 ms --- static.opentok.com ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.147/0.147/0.147/0.000 ms
Step 22: Run the command system conntrack show on DUT0 and expect the following output:
Show output
udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=36404 dport=53 packets=1 bytes=64 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36404 packets=1 bytes=64 mark=0 use=1 appdetect[U128:31] icmp 1 29 src=192.168.2.101 dst=192.168.2.100 type=8 code=0 id=357 packets=1 bytes=84 src=192.168.2.100 dst=192.168.2.101 type=0 code=0 id=357 packets=1 bytes=84 mark=0 use=1 appdetect[U128:12] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=35158 dport=53 packets=1 bytes=72 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=35158 packets=1 bytes=104 mark=0 use=1 appdetect[U128:31] tcp 6 18 TIME_WAIT src=10.215.168.64 dst=10.215.168.1 sport=46742 dport=80 packets=6 bytes=583 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=46742 packets=4 bytes=504 [ASSURED] mark=0 use=1 appdetect[U128:30 http-host:10.215.168.1] tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.66 sport=47314 dport=22 packets=24 bytes=5057 src=10.215.168.66 dst=10.215.168.64 sport=22 dport=47314 packets=20 bytes=4793 [ASSURED] mark=0 use=1 appdetect[U128:31] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=53475 dport=53 packets=1 bytes=64 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=53475 packets=1 bytes=80 mark=0 use=1 appdetect[U128:31 dns-host:static.opentok.com] tcp 6 19 TIME_WAIT src=10.215.168.64 dst=10.215.168.1 sport=46758 dport=80 packets=6 bytes=583 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=46758 packets=4 bytes=504 [ASSURED] mark=0 use=1 appdetect[U128:30 http-host:10.215.168.1] conntrack v1.4.7 (conntrack-tools): 7 flow entries have been shown.
Step 23: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 4 Matches in IP-cache 2 Modifications in IP-cache 2 Matches in dynamic dictionaries 3 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
CLI Custom Application Dictionary
Description
DUT0 configures HTTP detection with a custom dictionary defined via CLI. DUT1 acts as a client behind DUT0 and downloads a file via HTTP. The connection is verified to be classified with the custom App-ID on the first request through FQDN match, and on subsequent requests through IP-cache.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 address 192.168.2.100/24 set system conntrack app-detect dictionary 1 local app-id custom 42 fqdn enterprise.opentok.com set system conntrack app-detect dictionary 1 local app-id custom 42 name 'Teldat Test' set system conntrack app-detect dictionary 2 local app-id custom 43 fqdn enterprise.opentok.com set system conntrack app-detect dictionary 2 local app-id custom 43 name 'Teldat Test' set system conntrack app-detect http-host set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.2.101/24 set protocols static route 0.0.0.0/0 next-hop 192.168.2.100 set service dns forwarding name-server 10.215.168.66 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.215.168.66/24 set service dns forwarding local-ttl 30 set service dns forwarding name-server 127.0.0.1 set service dns static host-name enterprise.opentok.com inet 10.215.168.1 set service dns static host-name static.opentok.com inet 192.168.2.100 set service dns static host-name www.gamblingteldat.com inet 192.168.2.10 set service dns static host-name www.newspaperteldat.com inet 192.168.2.20 set service ssh set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 10.215.168.1 from DUT1:
admin@DUT1$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.724 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.724/0.724/0.724/0.000 ms
Step 5: Run the command system conntrack clear on DUT0.
Step 6: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 0 Modifications in IP-cache 0 Matches in dynamic dictionaries 0 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 7: Run the command system conntrack clear on DUT0.
Step 8: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 8776 0 --:--:-- --:--:-- --:--:-- 9250
Step 9: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
appdetect\[U6:42\shttp-host:enterprise.opentok.com\]Show output
tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=36270 dport=80 packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=36270 packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[U6:42 http-host:enterprise.opentok.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=58934 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=58934 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=33643 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=33643 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53] conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 10: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 0 Modifications in IP-cache 1 Matches in dynamic dictionaries 1 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 11: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 7568 0 --:--:-- --:--:-- --:--:-- 9250
Step 12: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 1 Modifications in IP-cache 1 Matches in dynamic dictionaries 2 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Remote Application Dictionary
Description
DUT0 configures HTTP detection with a remote application dictionary served by a categorization server. DUT1 acts as a client behind DUT0 and DUT2 runs a DNS server. A traffic policy drops uncategorized traffic until the remote dictionary classifies it. Traffic belonging to the remote dictionary protocol is allowed.
Phase 1: HTTP-host detection triggers a remote dictionary lookup in override mode and the connection is classified with the remote App-ID.
Phase 2: DNS-host detection is added so classification happens at DNS resolution time and populates the IP-cache.
Phase 3: App-detect chained storage mode is enabled and the full App-ID chain is verified.
Phase 4: An alarm is configured to detect communication errors with the remote dictionary server.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth0 traffic policy out POL set interfaces ethernet eth1 address 192.168.2.100/24 set system conntrack app-detect debug set system conntrack app-detect dictionary 1 remote encrypted-key U2FsdGVkX1+pEgupeFI0yW4pLe4eQT1MCKvaFhkwE8w= set system conntrack app-detect dictionary 1 remote encrypted-url U2FsdGVkX1+ReENrvsZ4q5kGbNpergfp2UsvZqCZzKF1xTcjI7vvZCFFXmdXjsdN set system conntrack app-detect dictionary 1 remote mark 5555 set system conntrack app-detect dictionary 1 remote property category set system conntrack app-detect dictionary 1 remote ssl-allow-insecure set system conntrack app-detect dictionary 2 remote encrypted-key U2FsdGVkX1/iJVfJy5WTrMRlx7tU3WzMw4EKiTSFQ/c= set system conntrack app-detect dictionary 2 remote encrypted-url U2FsdGVkX18AC5Qx5FoKd/0oeX1QAISt4WrifpfIWZpBjDS1ewfRTKbJi2tyEIEQ set system conntrack app-detect dictionary 2 remote mark 5555 set system conntrack app-detect dictionary 2 remote property reputation set system conntrack app-detect dictionary 2 remote ssl-allow-insecure set system conntrack app-detect enable_dict_match_priv_ip set system conntrack app-detect http set system conntrack app-detect http-host set system conntrack app-detect refresh-flow-appid set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POL rule 1 action accept set traffic policy POL rule 1 selector RDICT set traffic policy POL rule 2 action drop set traffic policy POL rule 2 selector RESOLVING set traffic selector RDICT rule 1 mark 5555 set traffic selector RESOLVING rule 1 app-detect state detecting set traffic selector RESOLVING rule 1 app-detect state host-detected
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.2.101/24 set protocols static route 0.0.0.0/0 next-hop 192.168.2.100 set service dns forwarding name-server 10.215.168.66 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.215.168.66/24 set service dns forwarding local-ttl 30 set service dns forwarding name-server 127.0.0.1 set service dns static host-name enterprise.opentok.com inet 10.215.168.1 set service dns static host-name static.opentok.com inet 192.168.2.100 set service dns static host-name www.gamblingteldat.com inet 192.168.2.10 set service dns static host-name www.newspaperteldat.com inet 192.168.2.20 set service ssh set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 10.215.168.1 from DUT1:
admin@DUT1$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=1.07 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.065/1.065/1.065/0.000 ms
Step 5: Run the command system conntrack clear on DUT0.
Step 6: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 7: Run the command system journal show | tail -n 200 on DUT0 and expect the following output:
Show output
Jul 24 14:15:16.321375 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.7M, max 13.8M, 12.0M free. Jul 24 14:15:16.323437 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:15:16.323510 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:15:16.336988 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:15:16.588795 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:15:16.875255 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:15:16.968877 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 address 192.168.2.100/24'. Jul 24 14:15:17.103493 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 24 14:15:17.203040 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Jul 24 14:15:17.309050 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy out POL'. Jul 24 14:15:17.365535 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POL rule 1 action accept'. Jul 24 14:15:17.456774 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POL rule 1 selector RDICT'. Jul 24 14:15:17.546070 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POL rule 2 action drop'. Jul 24 14:15:17.648079 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POL rule 2 selector RESOLVING'. Jul 24 14:15:17.781644 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic selector RDICT rule 1 mark 5555'. Jul 24 14:15:17.878433 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic selector RESOLVING rule 1 app-detect state detecting'. Jul 24 14:15:17.968188 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic selector RESOLVING rule 1 app-detect state host-detected'. Jul 24 14:15:18.066267 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 1 remote url ******'. Jul 24 14:15:18.178731 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 1 remote key ******'. Jul 24 14:15:18.236931 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 1 remote ssl-allow-insecure'. Jul 24 14:15:18.397063 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 1 remote property category'. Jul 24 14:15:18.528411 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 2 remote url ******'. Jul 24 14:15:18.618495 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 2 remote key ******'. Jul 24 14:15:18.722582 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 2 remote ssl-allow-insecure'. Jul 24 14:15:18.803244 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 2 remote property reputation'. Jul 24 14:15:18.944837 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 1 remote mark 5555'. Jul 24 14:15:19.018386 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 2 remote mark 5555'. Jul 24 14:15:19.109300 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect http'. Jul 24 14:15:19.191176 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect http-host'. Jul 24 14:15:19.292412 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect refresh-flow-appid'. Jul 24 14:15:19.346983 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect enable_dict_match_priv_ip'. Jul 24 14:15:19.440988 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect debug'. Jul 24 14:15:19.519234 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:15:19.632761 osdx ubnt-cfgd[928850]: inactive Jul 24 14:15:19.716329 osdx INFO[928895]: FRR daemons did not change Jul 24 14:15:19.807482 osdx kernel: nfUDPlink: module init Jul 24 14:15:19.807543 osdx kernel: app-detect: module init Jul 24 14:15:19.807554 osdx kernel: app-detect: registered: sysctl net.appdetect Jul 24 14:15:19.807564 osdx kernel: nfUDPlink: connected 127.0.0.1:49000 Jul 24 14:15:19.807573 osdx kernel: nfUDPlink: added destination 127.0.0.1:49000 Jul 24 14:15:19.807583 osdx kernel: app-detect: registered: /proc/net/stat/appdetect Jul 24 14:15:19.807603 osdx kernel: app-detect: expression init Jul 24 14:15:19.807614 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:15:19.807625 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:15:19.815442 osdx kernel: app-detect: selected hash dict hash table with 13 hash bits and 8192 buckets for max 5000 entries (supported range 2^8...2^20) Jul 24 14:15:19.815496 osdx kernel: app-detect: allocated memory for hash table with 8192 buckets (65536 bytes) Jul 24 14:15:19.815506 osdx kernel: app-detect: allocated memory for 5000 hash entries (520000 bytes) Jul 24 14:15:19.815514 osdx kernel: app-detect: CNAME database reallocated to 5000 entries Jul 24 14:15:19.827520 osdx kernel: app-detect: set target dict _remote_ priority 1 type unknown (new,empty) Jul 24 14:15:19.827589 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:19.827608 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:19.827619 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:19.827629 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type unknown (target_dict) Jul 24 14:15:19.827639 osdx kernel: app-detect: initialized expiration timer for REMOTE dict _remote_ Jul 24 14:15:19.827649 osdx kernel: app-detect: set type of dict _remote_ to remote Jul 24 14:15:19.827660 osdx kernel: app-detect: user set num_hash_entries=40000 Jul 24 14:15:19.827670 osdx kernel: app-detect: selected hash dict hash table with 16 hash bits and 65536 buckets for max 40000 entries (supported range 2^8...2^20) Jul 24 14:15:19.827680 osdx kernel: app-detect: allocated memory for hash table with 65536 buckets (524288 bytes) Jul 24 14:15:19.827690 osdx kernel: app-detect: allocated memory for 40000 hash entries (4160000 bytes) Jul 24 14:15:19.827700 osdx kernel: app-detect: set dictionary _remote_ hash_key d46225f3cb7730441efc28f7ad6acf2604ffe1719e801afac8457b3bf45deec3 Jul 24 14:15:19.827710 osdx kernel: app-detect: enable remote dictionary _remote_ Jul 24 14:15:19.827723 osdx kernel: app-detect: dictionary _remote_ enabled Jul 24 14:15:19.827732 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:19.827742 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:19.827752 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:19.827762 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:19.827773 osdx kernel: app-detect: set target dict _remote_ priority 2 type unknown (new,empty) Jul 24 14:15:19.827784 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:19.827793 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:19.827804 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:19.827814 osdx kernel: app-detect: (0) dictionary _remote_, priority 2 type unknown (target_dict) Jul 24 14:15:19.827824 osdx kernel: app-detect: initialized expiration timer for REMOTE dict _remote_ Jul 24 14:15:19.827834 osdx kernel: app-detect: set type of dict _remote_ to remote Jul 24 14:15:19.827846 osdx kernel: app-detect: user set num_hash_entries=40000 Jul 24 14:15:19.827861 osdx kernel: app-detect: selected hash dict hash table with 16 hash bits and 65536 buckets for max 40000 entries (supported range 2^8...2^20) Jul 24 14:15:19.827873 osdx kernel: app-detect: allocated memory for hash table with 65536 buckets (524288 bytes) Jul 24 14:15:19.827883 osdx kernel: app-detect: allocated memory for 40000 hash entries (4160000 bytes) Jul 24 14:15:19.827892 osdx kernel: app-detect: set dictionary _remote_ hash_key d46225f3cb7730441efc28f7ad6acf2604ffe1719e801afac8457b3bf45deec3 Jul 24 14:15:19.827902 osdx kernel: app-detect: enable remote dictionary _remote_ Jul 24 14:15:19.827912 osdx kernel: app-detect: dictionary _remote_ enabled Jul 24 14:15:19.827922 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:19.827931 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:19.827941 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:19.827951 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:19.827961 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:19.839089 osdx INFO[928932]: Updated /etc/default/osdx_tcatd.conf Jul 24 14:15:19.839134 osdx INFO[928932]: Restarting Traffic Categorization (TCATD) service ... Jul 24 14:15:19.864010 osdx systemd[1]: Starting osdx-tcatd.service - App-Detect Traffic Categorization daemon... Jul 24 14:15:20.163122 osdx systemd[1]: Started osdx-tcatd.service - App-Detect Traffic Categorization daemon. Jul 24 14:15:20.164503 osdx osdx-tcatd[928936]: Dict_client. rdict_num 2 mark 5555 local-vrf Jul 24 14:15:20.164617 osdx osdx-tcatd[928936]: Dict_client. ERROR (dict 2) 7 (Couldn't connect to server): Unable to connect to server Jul 24 14:15:20.164699 osdx osdx-tcatd[928936]: Dict_client. rdict_num 1 mark 5555 local-vrf Jul 24 14:15:20.164742 osdx osdx-tcatd[928936]: Dict_client. ERROR (dict 1) 7 (Couldn't connect to server): Unable to connect to server Jul 24 14:15:20.199444 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:15:20.250684 osdx WARNING[929028]: No supported link modes on interface eth0 Jul 24 14:15:20.252179 osdx modulelauncher[929028]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:15:20.252194 osdx modulelauncher[929028]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:15:20.253384 osdx modulelauncher[929028]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:15:20.253394 osdx modulelauncher[929028]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:15:20.287452 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Jul 24 14:15:20.331807 osdx WARNING[929103]: No supported link modes on interface eth1 Jul 24 14:15:20.333419 osdx modulelauncher[929103]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on Jul 24 14:15:20.333431 osdx modulelauncher[929103]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76. Jul 24 14:15:20.334594 osdx modulelauncher[929103]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:15:20.334602 osdx modulelauncher[929103]: Command '/sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:15:20.733822 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:15:20.734434 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:15:20.754779 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:15:24.117282 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack clear'. Jul 24 14:15:24.289897 osdx osdx-tcatd[928936]: UDP_Server. Read 27 bytes Jul 24 14:15:24.289920 osdx osdx-tcatd[928936]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 1 FQDN enterprise.opentok.com Jul 24 14:15:24.289941 osdx osdx-tcatd[928936]: Dict_client. Send query (dict 1): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["enterprise.opentok.com"],"xml": 0} Jul 24 14:15:24.289957 osdx osdx-tcatd[928936]: UDP_Server. Read 27 bytes Jul 24 14:15:24.289959 osdx osdx-tcatd[928936]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 2 FQDN enterprise.opentok.com Jul 24 14:15:24.289977 osdx osdx-tcatd[928936]: Dict_client. Send query (dict 2): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["enterprise.opentok.com"],"xml": 0} Jul 24 14:15:24.291441 osdx kernel: app-detect: field http-host detected: enterprise.opentok.com. Org(src/dst) 192.168.2.101:52252/10.215.168.1:80 Jul 24 14:15:24.291519 osdx kernel: app-detect: http detected. Org(src/dst) 192.168.2.101:52252/10.215.168.1:80 Jul 24 14:15:24.291534 osdx kernel: app-detect: dictionary search for enterprise.opentok.com Jul 24 14:15:24.291551 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:24.291562 osdx kernel: app-detect: search in dict _remote_, prio 2 Jul 24 14:15:24.952095 osdx osdx-tcatd[928936]: Dict_client. Received answer (dict 1): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "enterprise.opentok.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 88, "lcp": "opentok.com", "cats": [{"catid": 7, "conf": 95}]}, "getrepinfo": {"reputation": 88, "country": "", "popularity": 0, "a ge": 0, "threathistory": 0}}}]} Jul 24 14:15:24.952114 osdx osdx-tcatd[928936]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 1 FQDN enterprise.opentok.com TTL 172800 AppID:82000007 Jul 24 14:15:24.952179 osdx osdx-tcatd[928936]: UDP_Server. Sent 38 bytes Jul 24 14:15:24.955442 osdx kernel: app-detect: set target dict _remote_ priority 1 type remote (existing,enabled) Jul 24 14:15:24.955469 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:24.955482 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:24.955494 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote Jul 24 14:15:24.955502 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:24.955509 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:24.955516 osdx kernel: app-detect: set fqdn hash 46b26ca475a30e2c2b54f5356b2738abe73ead8a02742c712c9e645e233e9d74, hash table index=0018098 (0x046b2) (16 bits), ttl 172800 seconds Jul 24 14:15:24.962480 osdx osdx-tcatd[928936]: Dict_client. Received answer (dict 2): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "enterprise.opentok.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 88, "lcp": "opentok.com", "cats": [{"catid": 7, "conf": 95}]}, "getrepinfo": {"reputation": 88, "country": "", "popularity": 0, "a ge": 0, "threathistory": 0}}}]} Jul 24 14:15:24.962496 osdx osdx-tcatd[928936]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 2 FQDN enterprise.opentok.com TTL 172800 AppID:83000058 Jul 24 14:15:24.962558 osdx osdx-tcatd[928936]: UDP_Server. Sent 38 bytes Jul 24 14:15:24.963445 osdx kernel: app-detect: set target dict _remote_ priority 2 type remote (existing,enabled) Jul 24 14:15:24.963469 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:24.963489 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:24.963500 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:24.963512 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:24.963523 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:24.963533 osdx kernel: app-detect: set fqdn hash 46b26ca475a30e2c2b54f5356b2738abe73ead8a02742c712c9e645e233e9d74, hash table index=0018098 (0x046b2) (16 bits), ttl 172800 seconds
Step 8: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
tcp.*dst=10.215.168.1.*dport=443Show output
udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=58352 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=58352 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=39059 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39059 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53] tcp 6 3598 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=53708 dport=443 packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=53708 packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 3598 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=53696 dport=443 packets=12 bytes=1711 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=53696 packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=50623 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=50623 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 299 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=52252 dport=80 packets=8 bytes=1789 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=52252 packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.
Step 9: Run the command traffic selector RDICT show on DUT0 and check whether the output matches the following regular expressions:
1\s+[1-9]\d*\s+\d+Show output
Selector RDICT (Policy POL -- ifc eth0 -- hook out prio very-high -- rule 1) ----------------------------------------------------- rule pkts match pkts eval bytes match bytes eval ----------------------------------------------------- 1 23 42 3370 6243 ----------------------------------------------------- Total 23 42 3370 6243
Step 10: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
tcp.*dport=80.*packets=[1-9].*appdetect\[L4:80\shttp-host:enterprise.opentok.com\]Show output
udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=58352 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=58352 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=39059 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39059 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53] tcp 6 3598 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=53708 dport=443 packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=53708 packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 3598 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=53696 dport=443 packets=12 bytes=1711 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=53696 packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=50623 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=50623 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 298 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=52252 dport=80 packets=8 bytes=1789 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=52252 packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.
Step 11: Run the command system conntrack clear on DUT1.
Step 12: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 5908 0 --:--:-- --:--:-- --:--:-- 6166 admin@osdx$
Step 13: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
appdetect\[U130:7\shttp-host:enterprise.opentok.com\]Show output
udp 17 25 src=192.168.2.101 dst=10.215.168.66 sport=58352 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=58352 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 25 src=192.168.2.101 dst=10.215.168.66 sport=39059 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39059 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53] tcp 6 3595 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=53708 dport=443 packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=53708 packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 3595 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=53696 dport=443 packets=12 bytes=1711 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=53696 packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=52264 dport=80 packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=52264 packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[U130:7 http-host:enterprise.opentok.com] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=41248 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=41248 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 25 src=127.0.0.1 dst=127.0.0.1 sport=50623 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=50623 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 298 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=52252 dport=80 packets=10 bytes=2166 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=52252 packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] conntrack v1.4.7 (conntrack-tools): 8 flow entries have been shown.
Step 14: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
10.215.168.1\s*.*U130:7Show output
---------------------------------------- IP Application ID Expires in ---------------------------------------- 10.215.168.1 U130:7 4m57s832ms
Step 15: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 0 Modifications in IP-cache 1 Matches in dynamic dictionaries 1 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 16: Run the command system conntrack clear on DUT0.
Step 17: Run the command system conntrack clear on DUT1.
Step 18: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 9122 0 --:--:-- --:--:-- --:--:-- 12333
Step 19: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
appdetect\[U130:7\shttp-host:enterprise.opentok.com\]Show output
tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=52266 dport=80 packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=52266 packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[U130:7 http-host:enterprise.opentok.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=33145 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=33145 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 20: Run the command system conntrack app-detect show on DUT0 and expect the following output:
Show output
--------------------------------------------------- App-detect Stats # --------------------------------------------------- Matches in static dictionaries 0 Matches in IP-cache 1 Modifications in IP-cache 1 Matches in dynamic dictionaries 2 Times appid has been refreshed 0 Ips blacklisted from cache due to appid flapping 0 Matches in DNS CNAME cache 0 Entries in DNS CNAME cache 0
Step 21: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth0 traffic policy out POL set interfaces ethernet eth1 address 192.168.2.100/24 set system conntrack app-detect app-id-storage override set system conntrack app-detect debug set system conntrack app-detect dictionary 1 remote encrypted-key U2FsdGVkX18jaUa+pNnpoMERu2fPY23M2tjJezGUL/g= set system conntrack app-detect dictionary 1 remote encrypted-url U2FsdGVkX1/SUM3AACgBBMg4GHspRc2xWRr4W1Z9qg4HwvOfAAHix/0/PbdaeeJt set system conntrack app-detect dictionary 1 remote mark 5555 set system conntrack app-detect dictionary 1 remote property category set system conntrack app-detect dictionary 1 remote ssl-allow-insecure set system conntrack app-detect dictionary 2 remote encrypted-key U2FsdGVkX18Ex4NK8I75acMbCoFvYTr5x6CeEUxMruM= set system conntrack app-detect dictionary 2 remote encrypted-url U2FsdGVkX18jBkdpT2X5I01jbqu60cU6VPfCEPJKx/09PRxRGkrEwKwbbHJ6rn7w set system conntrack app-detect dictionary 2 remote mark 5555 set system conntrack app-detect dictionary 2 remote property reputation set system conntrack app-detect dictionary 2 remote ssl-allow-insecure set system conntrack app-detect dns set system conntrack app-detect dns-host set system conntrack app-detect enable_dict_match_priv_ip set system conntrack app-detect http set system conntrack app-detect http-host set system conntrack app-detect refresh-flow-appid set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POL rule 1 action accept set traffic policy POL rule 1 selector RDICT set traffic policy POL rule 2 action drop set traffic policy POL rule 2 selector RESOLVING set traffic selector RDICT rule 1 mark 5555 set traffic selector RESOLVING rule 1 app-detect state detecting set traffic selector RESOLVING rule 1 app-detect state host-detected
Step 22: Run the command system conntrack clear on DUT0.
Step 23: Run the command nslookup enterprise.opentok.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: enterprise.opentok.com Address: 10.215.168.1 ** server can't find enterprise.opentok.com: REFUSED
Step 24: Run the command nslookup www.gamblingteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.gamblingteldat.com Address: 192.168.2.10 ** server can't find www.gamblingteldat.com: REFUSED
Step 25: Run the command nslookup www.newspaperteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.newspaperteldat.com Address: 192.168.2.20 ** server can't find www.newspaperteldat.com: REFUSED
Step 26: Run the command system conntrack show on DUT0 and expect the following output:
Show output
udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=39146 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39146 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=57141 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=57141 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53 dns-host:enterprise.opentok.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=36553 dport=53 packets=1 bytes=69 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36553 packets=1 bytes=69 mark=0 use=1 appdetect[L4:53] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=37333 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=37333 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53 dns-host:www.gamblingteldat.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=42190 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=42190 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 29 src=127.0.0.1 dst=127.0.0.1 sport=50623 dport=49000 packets=6 bytes=332 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=50623 packets=6 bytes=398 mark=0 use=1 appdetect[L4:49000] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=48702 dport=53 packets=1 bytes=69 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=48702 packets=1 bytes=85 mark=0 use=1 appdetect[L4:53 dns-host:www.newspaperteldat.com] tcp 6 3599 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=35034 dport=443 packets=11 bytes=1449 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=35034 packets=8 bytes=1990 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 299 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=35026 dport=443 packets=10 bytes=1397 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=35026 packets=9 bytes=2042 [ASSURED] mark=0 use=1 appdetect[L4:443] conntrack v1.4.7 (conntrack-tools): 9 flow entries have been shown.
Step 27: Run the command nslookup enterprise.opentok.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: enterprise.opentok.com Address: 10.215.168.1 ** server can't find enterprise.opentok.com: REFUSED
Step 28: Run the command nslookup www.gamblingteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.gamblingteldat.com Address: 192.168.2.10 ** server can't find www.gamblingteldat.com: REFUSED
Step 29: Run the command nslookup www.newspaperteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.newspaperteldat.com Address: 192.168.2.20 ** server can't find www.newspaperteldat.com: REFUSED
Step 30: Run the command system conntrack show on DUT0 and expect the following output:
Show output
udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=39146 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39146 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=57141 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=57141 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53 dns-host:enterprise.opentok.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=45896 dport=53 packets=1 bytes=69 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=45896 packets=1 bytes=69 mark=0 use=1 appdetect[L4:53] udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=36553 dport=53 packets=1 bytes=69 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36553 packets=1 bytes=69 mark=0 use=1 appdetect[L4:53] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=54915 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=54915 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=52494 dport=53 packets=1 bytes=69 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=52494 packets=1 bytes=85 mark=0 use=1 appdetect[L4:53 dns-host:www.newspaperteldat.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=58196 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=58196 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53 dns-host:enterprise.opentok.com] udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=37333 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=37333 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53 dns-host:www.gamblingteldat.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=48018 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=48018 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=42190 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=42190 packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=50623 dport=49000 packets=6 bytes=332 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=50623 packets=6 bytes=398 mark=0 use=1 appdetect[L4:49000] udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=48702 dport=53 packets=1 bytes=69 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=48702 packets=1 bytes=85 mark=0 use=1 appdetect[L4:53 dns-host:www.newspaperteldat.com] tcp 6 3598 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=35034 dport=443 packets=11 bytes=1449 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=35034 packets=8 bytes=1990 [ASSURED] mark=0 use=1 appdetect[L4:443] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=40680 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=40680 packets=1 bytes=84 mark=0 use=1 appdetect[L4:53 dns-host:www.gamblingteldat.com] tcp 6 298 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=35026 dport=443 packets=10 bytes=1397 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=35026 packets=9 bytes=2042 [ASSURED] mark=0 use=1 appdetect[L4:443] conntrack v1.4.7 (conntrack-tools): 15 flow entries have been shown.
Step 31: Run the command system journal show | tail -n 200 on DUT0 and expect the following output:
Show output
Jul 24 14:15:33.383625 osdx kernel: app-detect: (0) dictionary _remote_, priority 2 type remote Jul 24 14:15:33.383636 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.383651 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:33.383663 osdx kernel: app-detect: freed hash table Jul 24 14:15:33.383674 osdx kernel: app-detect: freed memory for hashes+appids Jul 24 14:15:33.383684 osdx kernel: app-detect: dictionary _remote_ deleted Jul 24 14:15:33.383700 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.383710 osdx kernel: app-detect: (0) dictionary _remote_, priority 2 type remote Jul 24 14:15:33.383721 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.383730 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:33.383746 osdx kernel: app-detect: set target dict _remote_ priority 1 type unknown (new,empty) Jul 24 14:15:33.383757 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.383767 osdx kernel: app-detect: (0) dictionary _remote_, priority 2 type remote Jul 24 14:15:33.383777 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.383787 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type unknown (target_dict) Jul 24 14:15:33.383798 osdx kernel: app-detect: initialized expiration timer for REMOTE dict _remote_ Jul 24 14:15:33.383809 osdx kernel: app-detect: set type of dict _remote_ to remote Jul 24 14:15:33.383819 osdx kernel: app-detect: user set num_hash_entries=40000 Jul 24 14:15:33.383830 osdx kernel: app-detect: selected hash dict hash table with 16 hash bits and 65536 buckets for max 40000 entries (supported range 2^8...2^20) Jul 24 14:15:33.383847 osdx kernel: app-detect: allocated memory for hash table with 65536 buckets (524288 bytes) Jul 24 14:15:33.383860 osdx kernel: app-detect: allocated memory for 40000 hash entries (4160000 bytes) Jul 24 14:15:33.383870 osdx kernel: app-detect: set dictionary _remote_ hash_key d46225f3cb7730441efc28f7ad6acf2604ffe1719e801afac8457b3bf45deec3 Jul 24 14:15:33.383881 osdx kernel: app-detect: enable remote dictionary _remote_ Jul 24 14:15:33.383891 osdx kernel: app-detect: dictionary _remote_ enabled Jul 24 14:15:33.383901 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.383911 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:33.383929 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote Jul 24 14:15:33.383939 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.383949 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:33.383959 osdx kernel: app-detect: set target dict _remote_ priority 2 type remote (existing,enabled) Jul 24 14:15:33.383969 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.383985 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:33.383996 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:33.384006 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.384016 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:33.384026 osdx kernel: app-detect: dictionary _remote_ disabled Jul 24 14:15:33.384040 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.384051 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:33.384061 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.384070 osdx kernel: app-detect: (0) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:33.384080 osdx kernel: app-detect: freed hash table Jul 24 14:15:33.384090 osdx kernel: app-detect: freed memory for hashes+appids Jul 24 14:15:33.384100 osdx kernel: app-detect: dictionary _remote_ deleted Jul 24 14:15:33.384110 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.384128 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:33.384138 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.384149 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:33.384158 osdx kernel: app-detect: set target dict _remote_ priority 2 type unknown (new,empty) Jul 24 14:15:33.384170 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.384179 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:33.384189 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.384199 osdx kernel: app-detect: (0) dictionary _remote_, priority 2 type unknown (target_dict) Jul 24 14:15:33.384209 osdx kernel: app-detect: initialized expiration timer for REMOTE dict _remote_ Jul 24 14:15:33.384219 osdx kernel: app-detect: set type of dict _remote_ to remote Jul 24 14:15:33.384241 osdx kernel: app-detect: user set num_hash_entries=40000 Jul 24 14:15:33.384252 osdx kernel: app-detect: selected hash dict hash table with 16 hash bits and 65536 buckets for max 40000 entries (supported range 2^8...2^20) Jul 24 14:15:33.384261 osdx kernel: app-detect: allocated memory for hash table with 65536 buckets (524288 bytes) Jul 24 14:15:33.384270 osdx kernel: app-detect: allocated memory for 40000 hash entries (4160000 bytes) Jul 24 14:15:33.384280 osdx kernel: app-detect: set dictionary _remote_ hash_key d46225f3cb7730441efc28f7ad6acf2604ffe1719e801afac8457b3bf45deec3 Jul 24 14:15:33.384291 osdx kernel: app-detect: enable remote dictionary _remote_ Jul 24 14:15:33.384301 osdx kernel: app-detect: dictionary _remote_ enabled Jul 24 14:15:33.384311 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:33.384323 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:33.384334 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:33.384345 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:33.384355 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:33.391867 osdx INFO[929368]: Updated /etc/default/osdx_tcatd.conf Jul 24 14:15:33.391906 osdx INFO[929368]: Restarting Traffic Categorization (TCATD) service ... Jul 24 14:15:33.400100 osdx osdx-tcatd[928936]: UDP_Server. Received STOP signal. Cleanup Jul 24 14:15:33.400143 osdx systemd[1]: Stopping osdx-tcatd.service - App-Detect Traffic Categorization daemon... Jul 24 14:15:33.400151 osdx osdx-tcatd[928936]: Dict_client. Cleanup Jul 24 14:15:33.402615 osdx systemd[1]: osdx-tcatd.service: Deactivated successfully. Jul 24 14:15:33.402748 osdx systemd[1]: Stopped osdx-tcatd.service - App-Detect Traffic Categorization daemon. Jul 24 14:15:33.431877 osdx systemd[1]: Starting osdx-tcatd.service - App-Detect Traffic Categorization daemon... Jul 24 14:15:33.772756 osdx systemd[1]: Started osdx-tcatd.service - App-Detect Traffic Categorization daemon. Jul 24 14:15:33.774179 osdx osdx-tcatd[929372]: Dict_client. rdict_num 2 mark 5555 local-vrf Jul 24 14:15:33.800044 osdx osdx-tcatd[929372]: Dict_client. rdict_num 1 mark 5555 local-vrf Jul 24 14:15:33.987993 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:15:33.988940 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:15:34.006367 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:15:34.225833 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack clear'. Jul 24 14:15:36.320278 osdx kernel: app-detect: field dns-host detected: enterprise.opentok.com. Org(src/dst) 192.168.2.101:57141/10.215.168.66:53 Jul 24 14:15:36.320729 osdx osdx-tcatd[929372]: UDP_Server. Read 27 bytes Jul 24 14:15:36.320738 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 1 FQDN enterprise.opentok.com Jul 24 14:15:36.320757 osdx osdx-tcatd[929372]: Dict_client. Send query (dict 1): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["enterprise.opentok.com"],"xml": 0} Jul 24 14:15:36.320771 osdx osdx-tcatd[929372]: UDP_Server. Read 27 bytes Jul 24 14:15:36.320774 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 2 FQDN enterprise.opentok.com Jul 24 14:15:36.320779 osdx osdx-tcatd[929372]: Dict_client. Send query (dict 2): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["enterprise.opentok.com"],"xml": 0} Jul 24 14:15:36.322077 osdx osdx-tcatd[929372]: Dict_client. Received answer (dict 2): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "enterprise.opentok.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 88, "lcp": "opentok.com", "cats": [{"catid": 7, "conf": 95}]}, "getrepinfo": {"reputation": 88, "country": "", "popularity": 0, "a ge": 0, "threathistory": 0}}}]} Jul 24 14:15:36.322097 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 2 FQDN enterprise.opentok.com TTL 172800 AppID:83000058 Jul 24 14:15:36.322156 osdx osdx-tcatd[929372]: UDP_Server. Sent 38 bytes Jul 24 14:15:36.323441 osdx kernel: app-detect: dns detected, continuing detection for further analysis. Org(src/dst) 192.168.2.101:57141/10.215.168.66:53 Jul 24 14:15:36.323480 osdx kernel: app-detect: dictionary search for enterprise.opentok.com Jul 24 14:15:36.323493 osdx kernel: app-detect: search in CNAMEs db for enterprise.opentok.com Jul 24 14:15:36.323502 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:36.323509 osdx kernel: app-detect: search in dict _remote_, prio 2 Jul 24 14:15:36.323522 osdx kernel: app-detect: set target dict _remote_ priority 2 type remote (existing,enabled) Jul 24 14:15:36.323530 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:36.323537 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:36.323545 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:36.323552 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:36.323559 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:36.323566 osdx kernel: app-detect: set fqdn hash 46b26ca475a30e2c2b54f5356b2738abe73ead8a02742c712c9e645e233e9d74, hash table index=0018098 (0x046b2) (16 bits), ttl 172800 seconds Jul 24 14:15:36.353954 osdx osdx-tcatd[929372]: Dict_client. Received answer (dict 1): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "enterprise.opentok.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 88, "lcp": "opentok.com", "cats": [{"catid": 7, "conf": 95}]}, "getrepinfo": {"reputation": 88, "country": "", "popularity": 0, "a ge": 0, "threathistory": 0}}}]} Jul 24 14:15:36.353967 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 1 FQDN enterprise.opentok.com TTL 172800 AppID:82000007 Jul 24 14:15:36.354036 osdx osdx-tcatd[929372]: UDP_Server. Sent 38 bytes Jul 24 14:15:36.355432 osdx kernel: app-detect: set target dict _remote_ priority 1 type remote (existing,enabled) Jul 24 14:15:36.355468 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:36.355500 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:36.355514 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote Jul 24 14:15:36.355526 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:36.355538 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:36.355548 osdx kernel: app-detect: set fqdn hash 46b26ca475a30e2c2b54f5356b2738abe73ead8a02742c712c9e645e233e9d74, hash table index=0018098 (0x046b2) (16 bits), ttl 172800 seconds Jul 24 14:15:36.406738 osdx kernel: app-detect: field dns-host detected: www.gamblingteldat.com. Org(src/dst) 192.168.2.101:37333/10.215.168.66:53 Jul 24 14:15:36.407132 osdx osdx-tcatd[929372]: UDP_Server. Read 27 bytes Jul 24 14:15:36.407140 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 1 FQDN www.gamblingteldat.com Jul 24 14:15:36.407159 osdx osdx-tcatd[929372]: Dict_client. Send query (dict 1): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["www.gamblingteldat.com"],"xml": 0} Jul 24 14:15:36.407171 osdx osdx-tcatd[929372]: UDP_Server. Read 27 bytes Jul 24 14:15:36.407174 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 2 FQDN www.gamblingteldat.com Jul 24 14:15:36.407184 osdx osdx-tcatd[929372]: Dict_client. Send query (dict 2): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["www.gamblingteldat.com"],"xml": 0} Jul 24 14:15:36.407640 osdx kernel: app-detect: dns detected, continuing detection for further analysis. Org(src/dst) 192.168.2.101:37333/10.215.168.66:53 Jul 24 14:15:36.407668 osdx kernel: app-detect: dictionary search for www.gamblingteldat.com Jul 24 14:15:36.407680 osdx kernel: app-detect: search in CNAMEs db for www.gamblingteldat.com Jul 24 14:15:36.407692 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:36.407703 osdx kernel: app-detect: search in dict _remote_, prio 2 Jul 24 14:15:36.461482 osdx osdx-tcatd[929372]: Dict_client. Received answer (dict 1): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "www.gamblingteldat.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 25, "lcp": "gamblingteldat.com", "cats": [{"catid": 15, "conf": 93}]}, "getrepinfo": {"reputation": 25, "country": "", "popularity ": 0, "age": 0, "threathistory": 0}}}]} Jul 24 14:15:36.461498 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 1 FQDN www.gamblingteldat.com TTL 172800 AppID:8200000F Jul 24 14:15:36.461559 osdx osdx-tcatd[929372]: UDP_Server. Sent 38 bytes Jul 24 14:15:36.463460 osdx kernel: app-detect: set target dict _remote_ priority 1 type remote (existing,enabled) Jul 24 14:15:36.463513 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:36.463523 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:36.463531 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote Jul 24 14:15:36.463538 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:36.463547 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:36.463556 osdx kernel: app-detect: set fqdn hash 95d7d9863609db9ccc870c2d2b6f3048a307595f4ee206f3a041baa9f588fc85, hash table index=0038359 (0x095d7) (16 bits), ttl 172800 seconds Jul 24 14:15:36.469204 osdx osdx-tcatd[929372]: Dict_client. Received answer (dict 2): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "www.gamblingteldat.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 25, "lcp": "gamblingteldat.com", "cats": [{"catid": 15, "conf": 93}]}, "getrepinfo": {"reputation": 25, "country": "", "popularity ": 0, "age": 0, "threathistory": 0}}}]} Jul 24 14:15:36.469219 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 2 FQDN www.gamblingteldat.com TTL 172800 AppID:83000019 Jul 24 14:15:36.469288 osdx osdx-tcatd[929372]: UDP_Server. Sent 38 bytes Jul 24 14:15:36.471444 osdx kernel: app-detect: set target dict _remote_ priority 2 type remote (existing,enabled) Jul 24 14:15:36.471485 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:36.471496 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:36.471504 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:36.471522 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:36.471529 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:36.471536 osdx kernel: app-detect: set fqdn hash 95d7d9863609db9ccc870c2d2b6f3048a307595f4ee206f3a041baa9f588fc85, hash table index=0038359 (0x095d7) (16 bits), ttl 172800 seconds Jul 24 14:15:36.502750 osdx kernel: app-detect: field dns-host detected: www.newspaperteldat.com. Org(src/dst) 192.168.2.101:48702/10.215.168.66:53 Jul 24 14:15:36.503136 osdx osdx-tcatd[929372]: UDP_Server. Read 28 bytes Jul 24 14:15:36.503144 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 1 FQDN www.newspaperteldat.com Jul 24 14:15:36.503162 osdx osdx-tcatd[929372]: Dict_client. Send query (dict 1): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["www.newspaperteldat.com"],"xml": 0} Jul 24 14:15:36.503172 osdx osdx-tcatd[929372]: UDP_Server. Read 28 bytes Jul 24 14:15:36.503174 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message parse. Read message addressed to dictionary 2 FQDN www.newspaperteldat.com Jul 24 14:15:36.503179 osdx osdx-tcatd[929372]: Dict_client. Send query (dict 2): {"requestid": "besafepro_request_id","oemid": "Teldat","deviceid": "develop","uid": "","queries": ["getinfo", "getrepinfo"],"fqdns": ["www.newspaperteldat.com"],"xml": 0} Jul 24 14:15:36.503432 osdx kernel: app-detect: dns detected, continuing detection for further analysis. Org(src/dst) 192.168.2.101:48702/10.215.168.66:53 Jul 24 14:15:36.503456 osdx kernel: app-detect: dictionary search for www.newspaperteldat.com Jul 24 14:15:36.503468 osdx kernel: app-detect: search in CNAMEs db for www.newspaperteldat.com Jul 24 14:15:36.503478 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:36.503489 osdx kernel: app-detect: search in dict _remote_, prio 2 Jul 24 14:15:36.510085 osdx osdx-tcatd[929372]: Dict_client. Received answer (dict 1): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "www.newspaperteldat.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 92, "lcp": "newspaperteldat.com", "cats": [{"catid": 4, "conf": 93}]}, "getrepinfo": {"reputation": 92, "country": "", "popularit y": 0, "age": 0, "threathistory": 0}}}]} Jul 24 14:15:36.510103 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 1 FQDN www.newspaperteldat.com TTL 172800 AppID:82000004 Jul 24 14:15:36.510200 osdx osdx-tcatd[929372]: UDP_Server. Sent 39 bytes Jul 24 14:15:36.510215 osdx osdx-tcatd[929372]: Dict_client. Received answer (dict 2): {"status": 200, "requestid": "besafepro_request_id", "type": "fqdns", "TTL": 172800, "results": [{"fqdns": "www.newspaperteldat.com", "queries": {"getinfo": {"a1cat": 0, "reputation": 92, "lcp": "newspaperteldat.com", "cats": [{"catid": 4, "conf": 93}]}, "getrepinfo": {"reputation": 92, "country": "", "popularit y": 0, "age": 0, "threathistory": 0}}}]} Jul 24 14:15:36.510224 osdx osdx-tcatd[929372]: UDP_Server. Kernel_Message format. Write message addressed to dictionary 2 FQDN www.newspaperteldat.com TTL 172800 AppID:8300005C Jul 24 14:15:36.510257 osdx osdx-tcatd[929372]: UDP_Server. Sent 39 bytes Jul 24 14:15:36.511440 osdx kernel: app-detect: set target dict _remote_ priority 1 type remote (existing,enabled) Jul 24 14:15:36.511490 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:36.511504 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote (target_dict) Jul 24 14:15:36.511515 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote Jul 24 14:15:36.511527 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:36.511538 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:36.511549 osdx kernel: app-detect: set fqdn hash f32edeb00a440e970fb18ad576d01b83fe00cd767533ed3c53233a2aaaa9dce8, hash table index=0062254 (0x0f32e) (16 bits), ttl 172800 seconds Jul 24 14:15:36.511567 osdx kernel: app-detect: set target dict _remote_ priority 2 type remote (existing,enabled) Jul 24 14:15:36.511578 osdx kernel: app-detect: linked list of enabled dicts: Jul 24 14:15:36.511589 osdx kernel: app-detect: (0) dictionary _remote_, priority 1 type remote Jul 24 14:15:36.511600 osdx kernel: app-detect: (1) dictionary _remote_, priority 2 type remote (target_dict) Jul 24 14:15:36.511611 osdx kernel: app-detect: linked list of disabled dicts: Jul 24 14:15:36.511621 osdx kernel: app-detect: (empty, no dicts) Jul 24 14:15:36.511632 osdx kernel: app-detect: set fqdn hash f32edeb00a440e970fb18ad576d01b83fe00cd767533ed3c53233a2aaaa9dce8, hash table index=0062254 (0x0f32e) (16 bits), ttl 172800 seconds Jul 24 14:15:36.619522 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack show'. Jul 24 14:15:37.703913 osdx kernel: app-detect: field dns-host detected: enterprise.opentok.com. Org(src/dst) 192.168.2.101:58196/10.215.168.66:53 Jul 24 14:15:37.707455 osdx kernel: app-detect: dns detected, continuing detection for further analysis. Org(src/dst) 192.168.2.101:58196/10.215.168.66:53 Jul 24 14:15:37.707509 osdx kernel: app-detect: dictionary search for enterprise.opentok.com Jul 24 14:15:37.707523 osdx kernel: app-detect: search in CNAMEs db for enterprise.opentok.com Jul 24 14:15:37.707535 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:37.707546 osdx kernel: app-detect: appid 82000007 found in hash dictionary Jul 24 14:15:37.707558 osdx kernel: app-detect: add address 10.215.168.1, appids 82000007 to cache Jul 24 14:15:37.799031 osdx kernel: app-detect: field dns-host detected: www.gamblingteldat.com. Org(src/dst) 192.168.2.101:40680/10.215.168.66:53 Jul 24 14:15:37.799443 osdx kernel: app-detect: dns detected, continuing detection for further analysis. Org(src/dst) 192.168.2.101:40680/10.215.168.66:53 Jul 24 14:15:37.799460 osdx kernel: app-detect: dictionary search for www.gamblingteldat.com Jul 24 14:15:37.799472 osdx kernel: app-detect: search in CNAMEs db for www.gamblingteldat.com Jul 24 14:15:37.799484 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:37.799495 osdx kernel: app-detect: appid 8200000f found in hash dictionary Jul 24 14:15:37.799506 osdx kernel: app-detect: add address 192.168.2.10, appids 8200000f to cache Jul 24 14:15:37.886058 osdx kernel: app-detect: field dns-host detected: www.newspaperteldat.com. Org(src/dst) 192.168.2.101:52494/10.215.168.66:53 Jul 24 14:15:37.887445 osdx kernel: app-detect: dns detected, continuing detection for further analysis. Org(src/dst) 192.168.2.101:52494/10.215.168.66:53 Jul 24 14:15:37.887489 osdx kernel: app-detect: dictionary search for www.newspaperteldat.com Jul 24 14:15:37.887500 osdx kernel: app-detect: search in CNAMEs db for www.newspaperteldat.com Jul 24 14:15:37.887508 osdx kernel: app-detect: search in dict _remote_, prio 1 Jul 24 14:15:37.887524 osdx kernel: app-detect: appid 82000004 found in hash dictionary Jul 24 14:15:37.887531 osdx kernel: app-detect: add address 192.168.2.20, appids 82000004 to cache Jul 24 14:15:38.013722 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack show'.
Step 32: Run the command system conntrack app-detect show ip-cache on DUT0 and expect the following output:
Show output
---------------------------------------- IP Application ID Expires in ---------------------------------------- 10.215.168.1 U130:7 28s164ms 192.168.2.10 U130:15 28s256ms 192.168.2.20 U130:4 28s344ms
Step 33: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
10.215.168.1\s*.*U130:7Show output
---------------------------------------- IP Application ID Expires in ---------------------------------------- 10.215.168.1 U130:7 28s92ms 192.168.2.10 U130:15 28s184ms 192.168.2.20 U130:4 28s272ms
Step 34: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
192.168.2.10\s*.*U130:15Show output
---------------------------------------- IP Application ID Expires in ---------------------------------------- 10.215.168.1 U130:7 27s984ms 192.168.2.10 U130:15 28s76ms 192.168.2.20 U130:4 28s164ms
Step 35: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
192.168.2.20\s*.*U130:4Show output
---------------------------------------- IP Application ID Expires in ---------------------------------------- 10.215.168.1 U130:7 27s864ms 192.168.2.10 U130:15 27s956ms 192.168.2.20 U130:4 28s44ms
Step 36: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth0 traffic policy out POL set interfaces ethernet eth1 address 192.168.2.100/24 set system conntrack app-detect app-id-storage chained set system conntrack app-detect debug set system conntrack app-detect dictionary 1 remote encrypted-key U2FsdGVkX18HCK5epauao0HdnzC8KHWgtU/20XyBIow= set system conntrack app-detect dictionary 1 remote encrypted-url U2FsdGVkX19sdTd+AFZVDAgTfkqXs1MNVFXETghSg0sB4XdfQvvZ91m8OCaV3UcG set system conntrack app-detect dictionary 1 remote mark 5555 set system conntrack app-detect dictionary 1 remote property category set system conntrack app-detect dictionary 1 remote ssl-allow-insecure set system conntrack app-detect dictionary 2 remote encrypted-key U2FsdGVkX19vn2ReFYZO5mHBSc0tbIkGCyxcvCtXISY= set system conntrack app-detect dictionary 2 remote encrypted-url U2FsdGVkX199vMm4aBUARfuqkKNjNQKDutCK0md2zxRY8in3noDiCNW3ny3eAZgl set system conntrack app-detect dictionary 2 remote mark 5555 set system conntrack app-detect dictionary 2 remote property reputation set system conntrack app-detect dictionary 2 remote ssl-allow-insecure set system conntrack app-detect dns set system conntrack app-detect dns-host set system conntrack app-detect enable_dict_match_priv_ip set system conntrack app-detect http set system conntrack app-detect http-host set system conntrack app-detect refresh-flow-appid set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POL rule 1 action accept set traffic policy POL rule 1 selector RDICT set traffic policy POL rule 2 action drop set traffic policy POL rule 2 selector RESOLVING set traffic selector RDICT rule 1 mark 5555 set traffic selector RESOLVING rule 1 app-detect state detecting set traffic selector RESOLVING rule 1 app-detect state host-detected
Step 37: Run the command system conntrack clear on DUT0.
Step 38: Run the command system conntrack clear on DUT0.
Step 39: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 40: Run the command system conntrack clear on DUT1.
Step 41: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 1259 0 --:--:-- --:--:-- --:--:-- 1275
Step 42: Run the command system conntrack clear on DUT1.
Step 43: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 5566 0 --:--:-- --:--:-- --:--:-- 6166
Step 44: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
appdetect\[(U130:7;U131:88|U131:88;U130:7);L3:6;L4:80\shttp-host:enterprise.opentok.com\]Show output
tcp 6 297 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=43114 dport=443 packets=3 bytes=480 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=43114 packets=3 bytes=675 [ASSURED] mark=0 use=1 appdetect[L3:6;L4:443] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=40561 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=40561 packets=1 bytes=68 mark=0 use=1 appdetect[L3:17;L4:53] tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=33624 dport=80 packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=33624 packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[L3:6;L4:80;U130:7;U131:88 http-host:enterprise.opentok.com] udp 17 29 src=192.168.2.101 dst=10.215.168.66 sport=57136 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=57136 packets=1 bytes=68 mark=0 use=1 appdetect[L3:17;L4:53] tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=33630 dport=80 packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=33630 packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=3 appdetect[U130:7;U131:88;L3:6;L4:80 http-host:enterprise.opentok.com] udp 17 27 src=127.0.0.1 dst=127.0.0.1 sport=50623 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=50623 packets=2 bytes=132 mark=0 use=1 appdetect[L3:17;L4:49000] tcp 6 297 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=43124 dport=443 packets=4 bytes=532 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=43124 packets=3 bytes=675 [ASSURED] mark=0 use=1 appdetect[L3:6;L4:443] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=37324 dport=53 packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=37324 packets=1 bytes=68 mark=0 use=1 appdetect[L3:17;L4:53] tcp 6 298 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=33616 dport=80 packets=7 bytes=1737 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=33616 packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L3:6;L4:80 http-host:enterprise.opentok.com] conntrack v1.4.7 (conntrack-tools): 9 flow entries have been shown.
Step 45: Run the command nslookup www.gamblingteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.gamblingteldat.com Address: 192.168.2.10 ** server can't find www.gamblingteldat.com: REFUSED
Step 46: Run the command nslookup www.newspaperteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.newspaperteldat.com Address: 192.168.2.20 ** server can't find www.newspaperteldat.com: REFUSED
Step 47: Run the command nslookup www.gamblingteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.gamblingteldat.com Address: 192.168.2.10 ** server can't find www.gamblingteldat.com: REFUSED
Step 48: Run the command nslookup www.newspaperteldat.com dns-server 10.215.168.66 on DUT1 and expect the following output:
Show output
Server: 10.215.168.66 Address: 10.215.168.66#53 Name: www.newspaperteldat.com Address: 192.168.2.20 ** server can't find www.newspaperteldat.com: REFUSED
Step 49: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
10.215.168.1\s*.*(U130:7;U131:88|U131:88;U130:7)Show output
----------------------------------------- IP Application ID Expires in ----------------------------------------- 10.215.168.1 U130:7;U131:88 4m54s988ms 192.168.2.10 U130:15;U131:25 28s804ms 192.168.2.20 U130:4;U131:92 28s904ms
Step 50: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
192.168.2.10\s*.*(U130:15;U131:25|U131:25;U130:15)Show output
----------------------------------------- IP Application ID Expires in ----------------------------------------- 10.215.168.1 U130:7;U131:88 4m54s920ms 192.168.2.10 U130:15;U131:25 28s736ms 192.168.2.20 U130:4;U131:92 28s836ms
Step 51: Run the command system conntrack app-detect show ip-cache on DUT0 and check whether the output matches the following regular expressions:
192.168.2.20\s*.*(U130:4;U131:92|U131:92;U130:4)Show output
----------------------------------------- IP Application ID Expires in ----------------------------------------- 10.215.168.1 U130:7;U131:88 4m54s804ms 192.168.2.10 U130:15;U131:25 28s620ms 192.168.2.20 U130:4;U131:92 28s720ms
Step 52: Modify the following configuration lines in DUT0 :
set system alarm DICTERROR1 set system alarm DICTERROR2 set system conntrack app-detect dictionary 1 remote alarm connection-error DICTERROR1 set system conntrack app-detect dictionary 2 remote alarm connection-error DICTERROR2
Step 53: Run the command system alarm show on DUT0 and check whether the output matches the following regular expressions:
DICTERROR1\s+falseShow output
-------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) -------------------------------------------------------------------- DICTERROR1 false 0 0.00 DICTERROR2 false 0 0.00
Step 54: Run the command system alarm show on DUT0 and check whether the output matches the following regular expressions:
DICTERROR2\s+falseShow output
-------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) -------------------------------------------------------------------- DICTERROR1 false 0 0.00 DICTERROR2 false 0 0.00
Step 55: Modify the following configuration lines in DUT0 :
set system conntrack app-detect dictionary 1 remote encrypted-key U2FsdGVkX1/TCIGMaN14UZTm3JJN5I/5X4wqoPk2DUE= set system conntrack app-detect dictionary 2 remote encrypted-key U2FsdGVkX19+/s3kiuuqDAkdya/s4bk+a9BN3BkpVn8=
Step 56: Run the command system conntrack clear on DUT0.
Step 57: Run the command system conntrack clear on DUT1.
Step 58: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 3 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 59: Run the command system alarm show on DUT0 and check whether the output matches the following regular expressions:
(DICTERROR1|DICTERROR2)\s+trueShow output
--------------------------------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) --------------------------------------------------------------------------------------------- DICTERROR1 true 2026-07-24 14:15:55.330019+00:00 1 67.96 DICTERROR2 true 2026-07-24 14:15:55.330233+00:00 1 68.01
Step 60: Modify the following configuration lines in DUT0 :
set system conntrack app-detect dictionary 1 remote encrypted-key U2FsdGVkX19AwKKKx1A6R3GSLVqSNRe/i9fsqZ6VJ0g= set system conntrack app-detect dictionary 2 remote encrypted-key U2FsdGVkX1/w/nBTnxu18TI/7qhFTkLXlr+Zjc5B/yg=
Step 61: Run the command system conntrack clear on DUT0.
Step 62: Run the command system conntrack clear on DUT1.
Step 63: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 3 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 64: Run the command system alarm show on DUT0 and check whether the output matches the following regular expressions:
(DICTERROR1|DICTERROR2)\s+falseShow output
----------------------------------------------------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) ----------------------------------------------------------------------------------------------------------------- DICTERROR1 false 2026-07-24 14:16:01.669680+00:00 2026-07-24 14:15:55.330019+00:00 2 46.37 DICTERROR2 false 2026-07-24 14:16:01.669969+00:00 2026-07-24 14:15:55.330233+00:00 2 46.39
Remote Application Dictionary run in a VRF
Description
DUT0 configures HTTP detection with a remote application dictionary running in a separate VRF. DUT1 acts as a client behind DUT0. The test verifies that remote dictionary protocol traffic uses the VRF and HTTP connections are classified.
Phase 1: Using the local-vrf option to specify the VRF for the remote dictionary protocol.
Phase 2: Using the local-interface option with an interface assigned to the VRF.
Phase 3: Using the local-address option to source from an address on an interface in the VRF.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth0 traffic policy out POL set interfaces ethernet eth0 vrf MYVRF set interfaces ethernet eth1 address 192.168.2.100/24 set interfaces ethernet eth1 vrf MYVRF set system conntrack app-detect dictionary 1 remote encrypted-key U2FsdGVkX189iWmCKU2GLRqaN0HCatPAfRSmz+pTHWs= set system conntrack app-detect dictionary 1 remote encrypted-url U2FsdGVkX1/D8gR9zBkvtMhVxAC8hJn+UPJsYZ8ruSus+pmzd1QnmRO4pTp2f+sl set system conntrack app-detect dictionary 1 remote local-vrf MYVRF set system conntrack app-detect dictionary 1 remote property category set system conntrack app-detect dictionary 1 remote ssl-allow-insecure set system conntrack app-detect dictionary 1 remote vrf-mark MYVRF set system conntrack app-detect dictionary 2 remote encrypted-key U2FsdGVkX1+/noXNXmWdBoEBloRFZwE4tpGgwcwfeqg= set system conntrack app-detect dictionary 2 remote encrypted-url U2FsdGVkX1+aEv54gx7BhVSGj5w+dTID90ao+Nb5+/y58bUK+XGobejwLgu+WolS set system conntrack app-detect dictionary 2 remote local-vrf MYVRF set system conntrack app-detect dictionary 2 remote property reputation set system conntrack app-detect dictionary 2 remote ssl-allow-insecure set system conntrack app-detect dictionary 2 remote vrf-mark MYVRF set system conntrack app-detect enable_dict_match_priv_ip set system conntrack app-detect http set system conntrack app-detect http-host set system conntrack app-detect refresh-flow-appid set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf MYVRF set traffic policy POL rule 1 action accept set traffic policy POL rule 1 selector RDICT set traffic policy POL rule 2 action drop set traffic policy POL rule 2 selector RESOLVING set traffic selector RDICT rule 1 vrf-mark MYVRF set traffic selector RESOLVING rule 1 app-detect state detecting set traffic selector RESOLVING rule 1 app-detect state host-detected
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.2.101/24 set protocols static route 0.0.0.0/0 next-hop 192.168.2.100 set service dns forwarding name-server 10.215.168.66 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.215.168.66/24 set service dns forwarding local-ttl 30 set service dns forwarding name-server 127.0.0.1 set service dns static host-name enterprise.opentok.com inet 10.215.168.1 set service dns static host-name static.opentok.com inet 192.168.2.100 set service dns static host-name www.gamblingteldat.com inet 192.168.2.10 set service dns static host-name www.newspaperteldat.com inet 192.168.2.20 set service ssh set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 10.215.168.1 from DUT1:
admin@DUT1$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.961 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.961/0.961/0.961/0.000 ms
Step 5: Run the command system conntrack clear on DUT0.
Step 6: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 7: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
tcp.*dst=10.215.168.1.*dport=443.*vrf=MYVRF.*vrf=MYVRFShow output
udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=36551 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36551 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 27 src=127.0.0.1 dst=127.0.0.1 sport=47767 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=47767 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 3597 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38278 dport=443 vrf=MYVRF packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38278 vrf=MYVRF packets=9 bytes=3410 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 3597 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38280 dport=443 vrf=MYVRF packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38280 vrf=MYVRF packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 299 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=45718 dport=80 vrf=MYVRF packets=7 bytes=1737 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45718 vrf=MYVRF packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=39616 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39616 vrf=MYVRF packets=1 bytes=84 mark=0 use=1 appdetect[L4:53] conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.
Step 8: Run the command traffic selector RDICT show on DUT0 and check whether the output matches the following regular expressions:
1\s+[1-9]\d*\s+\d+Show output
Selector RDICT (Policy POL -- ifc eth0 -- hook out prio very-high -- rule 1) ----------------------------------------------------- rule pkts match pkts eval bytes match bytes eval ----------------------------------------------------- 1 22 40 3318 6087 ----------------------------------------------------- Total 22 40 3318 6087
Step 9: Run the command system conntrack clear on DUT1.
Step 10: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 4653 0 --:--:-- --:--:-- --:--:-- 4625 admin@osdx$
Step 11: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
vrf=MYVRF.*vrf=MYVRF.*appdetect\[U130:7\shttp-host:enterprise.opentok.com\]Show output
udp 17 25 src=192.168.2.101 dst=10.215.168.66 sport=36551 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36551 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=45728 dport=80 vrf=MYVRF packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45728 vrf=MYVRF packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[U130:7 http-host:enterprise.opentok.com] udp 17 25 src=127.0.0.1 dst=127.0.0.1 sport=47767 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=47767 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 3595 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38278 dport=443 vrf=MYVRF packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38278 vrf=MYVRF packets=9 bytes=3410 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 3595 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38280 dport=443 vrf=MYVRF packets=11 bytes=1659 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38280 vrf=MYVRF packets=10 bytes=3462 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 298 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=45718 dport=80 vrf=MYVRF packets=8 bytes=2062 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45718 vrf=MYVRF packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=44076 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=44076 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 25 src=192.168.2.101 dst=10.215.168.66 sport=39616 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=39616 vrf=MYVRF packets=1 bytes=84 mark=0 use=1 appdetect[L4:53] conntrack v1.4.7 (conntrack-tools): 8 flow entries have been shown.
Step 12: Modify the following configuration lines in DUT0 :
delete system conntrack app-detect dictionary 1 remote local-vrf delete system conntrack app-detect dictionary 2 remote local-vrf set system conntrack app-detect dictionary 1 remote local-interface eth1 set system conntrack app-detect dictionary 2 remote local-interface eth1
Step 13: Run the command system conntrack clear on DUT0.
Step 14: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 15: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
tcp.*dst=10.215.168.1.*dport=443.*vrf=MYVRF.*vrf=MYVRFShow output
udp 17 27 src=127.0.0.1 dst=127.0.0.1 sport=47767 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=47767 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 297 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38296 dport=443 vrf=MYVRF packets=4 bytes=532 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38296 vrf=MYVRF packets=3 bytes=675 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 299 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=45730 dport=80 vrf=MYVRF packets=7 bytes=1737 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45730 vrf=MYVRF packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] tcp 6 9 CLOSE src=192.168.2.101 dst=10.215.168.1 sport=45718 dport=80 vrf=MYVRF packets=4 bytes=457 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45718 vrf=MYVRF packets=3 bytes=444 [ASSURED] mark=0 use=1 appdetect[L4:80] tcp 6 297 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38312 dport=443 vrf=MYVRF packets=4 bytes=532 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38312 vrf=MYVRF packets=3 bytes=675 [ASSURED] mark=0 use=1 appdetect[L4:443] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=36588 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36588 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.
Step 16: Run the command system conntrack clear on DUT1.
Step 17: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 9824 0 --:--:-- --:--:-- --:--:-- 12333 admin@osdx$
Step 18: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
vrf=MYVRF.*vrf=MYVRF.*appdetect\[U130:7\shttp-host:enterprise.opentok.com\]Show output
udp 17 25 src=127.0.0.1 dst=127.0.0.1 sport=47767 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=47767 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 295 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38296 dport=443 vrf=MYVRF packets=4 bytes=532 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38296 vrf=MYVRF packets=3 bytes=675 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 299 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=45730 dport=80 vrf=MYVRF packets=8 bytes=2062 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45730 vrf=MYVRF packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] tcp 6 6 CLOSE src=192.168.2.101 dst=10.215.168.1 sport=45718 dport=80 vrf=MYVRF packets=4 bytes=457 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45718 vrf=MYVRF packets=3 bytes=444 [ASSURED] mark=0 use=1 appdetect[L4:80] tcp 6 295 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=38312 dport=443 vrf=MYVRF packets=4 bytes=532 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=38312 vrf=MYVRF packets=3 bytes=675 [ASSURED] mark=0 use=1 appdetect[L4:443] tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=50402 dport=80 vrf=MYVRF packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=50402 vrf=MYVRF packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[U130:7 http-host:enterprise.opentok.com] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=55033 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=55033 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 25 src=192.168.2.101 dst=10.215.168.66 sport=36588 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=36588 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] conntrack v1.4.7 (conntrack-tools): 8 flow entries have been shown.
Step 19: Modify the following configuration lines in DUT0 :
delete system conntrack app-detect dictionary 1 remote local-interface delete system conntrack app-detect dictionary 2 remote local-interface set system conntrack app-detect dictionary 1 remote local-address 10.215.168.64 set system conntrack app-detect dictionary 2 remote local-address 10.215.168.64
Step 20: Run the command system conntrack clear on DUT0.
Step 21: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0^C Operation aborted by user. admin@osdx$
Step 22: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
tcp.*dst=10.215.168.1.*dport=443.*vrf=MYVRF.*vrf=MYVRFShow output
udp 17 27 src=127.0.0.1 dst=127.0.0.1 sport=47767 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=47767 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 9 CLOSE src=192.168.2.101 dst=10.215.168.1 sport=45730 dport=80 vrf=MYVRF packets=4 bytes=457 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45730 vrf=MYVRF packets=3 bytes=444 [ASSURED] mark=0 use=2 appdetect[L4:80] tcp 6 3597 ESTABLISHED src=10.215.168.1 dst=10.215.168.64 sport=443 dport=46174 vrf=MYVRF packets=9 bytes=2088 src=10.215.168.64 dst=10.215.168.1 sport=46174 dport=443 vrf=MYVRF packets=9 bytes=1090 [ASSURED] mark=0 use=1 appdetect[L4:46174] tcp 6 299 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=50408 dport=80 vrf=MYVRF packets=7 bytes=1737 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=50408 vrf=MYVRF packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] udp 17 27 src=192.168.2.101 dst=10.215.168.66 sport=48221 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=48221 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] tcp 6 3597 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=46182 dport=443 vrf=MYVRF packets=14 bytes=1875 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=46182 vrf=MYVRF packets=12 bytes=3700 [ASSURED] mark=0 use=1 appdetect[L4:443] conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.
Step 23: Run the command system conntrack clear on DUT1.
Step 24: Run the command file copy http://enterprise.opentok.com/~robot/test_file running://user-data/ force on DUT1, press Ctrl+C after 2 seconds and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37 100 37 0 0 9075 0 --:--:-- --:--:-- --:--:-- 9250 admin@osdx$
Step 25: Run the command system conntrack show on DUT0 and check whether the output matches the following regular expressions:
vrf=MYVRF.*vrf=MYVRF.*appdetect\[U130:7\shttp-host:enterprise.opentok.com\]Show output
udp 17 25 src=127.0.0.1 dst=127.0.0.1 sport=47767 dport=49000 packets=2 bytes=110 src=127.0.0.1 dst=127.0.0.1 sport=49000 dport=47767 packets=2 bytes=132 mark=0 use=1 appdetect[L4:49000] tcp 6 6 CLOSE src=192.168.2.101 dst=10.215.168.1 sport=45730 dport=80 vrf=MYVRF packets=4 bytes=457 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=45730 vrf=MYVRF packets=3 bytes=444 [ASSURED] mark=0 use=1 appdetect[L4:80] tcp 6 3595 ESTABLISHED src=10.215.168.1 dst=10.215.168.64 sport=443 dport=46174 vrf=MYVRF packets=9 bytes=2088 src=10.215.168.64 dst=10.215.168.1 sport=46174 dport=443 vrf=MYVRF packets=9 bytes=1090 [ASSURED] mark=0 use=1 appdetect[L4:46174] tcp 6 299 ESTABLISHED src=192.168.2.101 dst=10.215.168.1 sport=50408 dport=80 vrf=MYVRF packets=8 bytes=2062 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=50408 vrf=MYVRF packets=1 bytes=60 [ASSURED] mark=0 use=1 appdetect[L4:80 http-host:enterprise.opentok.com] tcp 6 src=192.168.2.101 dst=10.215.168.1 sport=50424 dport=80 vrf=MYVRF packets=6 bytes=593 src=10.215.168.1 dst=10.215.168.64 sport=80 dport=50424 vrf=MYVRF packets=4 bytes=504 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=2 bytes=392] mark=0 use=2 appdetect[U130:7 http-host:enterprise.opentok.com] udp 17 28 src=192.168.2.101 dst=10.215.168.66 sport=56372 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=56372 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] udp 17 25 src=192.168.2.101 dst=10.215.168.66 sport=48221 dport=53 vrf=MYVRF packets=1 bytes=68 src=10.215.168.66 dst=10.215.168.64 sport=53 dport=48221 vrf=MYVRF packets=1 bytes=68 mark=0 use=1 appdetect[L4:53] tcp 6 3595 ESTABLISHED src=10.215.168.64 dst=10.215.168.1 sport=46182 dport=443 vrf=MYVRF packets=14 bytes=1875 src=10.215.168.1 dst=10.215.168.64 sport=443 dport=46182 vrf=MYVRF packets=12 bytes=3700 [ASSURED] mark=0 use=1 appdetect[L4:443] conntrack v1.4.7 (conntrack-tools): 8 flow entries have been shown.