Conntag
The following scenarios show how the conntag feature integrates with conntrack logging and system conntrack show commands. Conntag allows tagging conntrack entries with string values (up to 255 characters) for traffic identification and logging.
Conntag In Conntrack Show
Description
Verify that conntag values appear correctly in the
system conntrack show command output. The conntag
field should display the string value assigned to the
connection via traffic policy.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY_TAG set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY_TAG rule 1 set conntag my-logged-tag
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.869 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.869/0.869/0.869/0.000 ms
Step 4: Run the command system conntrack clear on DUT0 and expect the following output:
Show output
Connection tracking table has been emptied
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.600 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.269 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.339 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2047ms rtt min/avg/max/mdev = 0.269/0.402/0.600/0.142 ms
Step 6: Run the command system conntrack show on DUT0 and expect the following output:
Show output
icmp 1 29 src=192.168.100.2 dst=192.168.100.1 type=8 code=0 id=332 packets=3 bytes=252 src=192.168.100.1 dst=192.168.100.2 type=0 code=0 id=332 packets=3 bytes=252 mark=0 conntag=my-logged-tag use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Conntag In Conntrack Logging
Description
Verify that conntag values appear in conntrack logging
events when system conntrack logging events is enabled.
The CONNTAG field should be included in log entries for
NEW, UPDATE, and DESTROY events.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY_TAG set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY_TAG rule 1 set conntag my-logged-tag
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.577 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.577/0.577/0.577/0.000 ms
Step 4: Run the command system conntrack clear on DUT0 and expect the following output:
Show output
Connection tracking table has been emptied
Step 5: Run the command system journal clear on DUT0 and expect the following output:
Show output
Deleted archived journal /run/log/journal/3a8dbab828fc40a183893e468c03e10b/system@f6b627f530614ebebcf2fb35acc78ad6-0000000000028ac3-0006575bf18a7645.journal (112.0K). Vacuuming done, freed 112.0K of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Vacuuming done, freed 0B of archived journals from /var/log/journal. Vacuuming done, freed 0B of archived journals from /run/log/journal.
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.289 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.296 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.258 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2048ms rtt min/avg/max/mdev = 0.258/0.281/0.296/0.016 ms
Step 7: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
CONNTAG=my-logged-tagShow output
Jul 24 14:11:09.005822 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:11:09.006264 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:09.006298 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:09.015626 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:09.125181 osdx ulogd[920900]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=my-logged-tag Jul 24 14:11:09.125209 osdx ulogd[920900]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=my-logged-tag
Conntag In Traffic Policy Log
Description
Verify that conntag values appear in traffic policy log
entries when the log option is enabled on a rule that
sets conntag.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY_TAG set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY_TAG rule 1 log prefix CONNTAG set traffic policy POLICY_TAG rule 1 set conntag my-logged-tag
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.657 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.657/0.657/0.657/0.000 ms
Step 4: Run the command system conntrack clear on DUT0 and expect the following output:
Show output
Connection tracking table has been emptied
Step 5: Run the command system journal clear on DUT0 and expect the following output:
Show output
Deleted archived journal /run/log/journal/3a8dbab828fc40a183893e468c03e10b/system@f6b627f530614ebebcf2fb35acc78ad6-0000000000028b14-0006575bf2236e56.journal (84.0K). Vacuuming done, freed 84.0K of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Vacuuming done, freed 0B of archived journals from /run/log/journal. Vacuuming done, freed 0B of archived journals from /var/log/journal.
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.550 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.320 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.312 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2039ms rtt min/avg/max/mdev = 0.312/0.394/0.550/0.110 ms
Step 7: Run the command system journal show | tail on DUT0 and check whether the output contains the following tokens:
[CONNTAG-1] ACCEPTShow output
Jul 24 14:11:19.291336 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 12.0M free. Jul 24 14:11:19.291760 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:19.291790 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:19.302259 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:19.408287 osdx kernel: [CONNTAG-1] ACCEPT IN=eth0 OUT= MAC=de:ad:be:ef:6c:00:de:ad:be:ef:6c:10:08:00 SRC=192.168.100.2 DST=192.168.100.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37338 DF PROTO=ICMP TYPE=8 CODE=0 ID=336 SEQ=1 Jul 24 14:11:20.423020 osdx kernel: [CONNTAG-1] ACCEPT IN=eth0 OUT= MAC=de:ad:be:ef:6c:00:de:ad:be:ef:6c:10:08:00 SRC=192.168.100.2 DST=192.168.100.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37580 DF PROTO=ICMP TYPE=8 CODE=0 ID=336 SEQ=2 Jul 24 14:11:21.447010 osdx kernel: [CONNTAG-1] ACCEPT IN=eth0 OUT= MAC=de:ad:be:ef:6c:00:de:ad:be:ef:6c:10:08:00 SRC=192.168.100.2 DST=192.168.100.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37725 DF PROTO=ICMP TYPE=8 CODE=0 ID=336 SEQ=3
Conntag Persistence Through Connection States
Description
Verify that conntag values persist through different connection states (NEW, ESTABLISHED). The tag should remain associated with the connection throughout its lifecycle.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY_TAG set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY_TAG rule 1 set conntag my-logged-tag
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.992 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.992/0.992/0.992/0.000 ms
Step 4: Run the command system conntrack clear on DUT0 and expect the following output:
Show output
Connection tracking table has been emptied
Step 5: Run the command system journal clear on DUT0 and expect the following output:
Show output
Deleted archived journal /run/log/journal/3a8dbab828fc40a183893e468c03e10b/system@f6b627f530614ebebcf2fb35acc78ad6-0000000000028b48-0006575bf2bd3d79.journal (112.0K). Vacuuming done, freed 112.0K of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Vacuuming done, freed 0B of archived journals from /var/log/journal. Vacuuming done, freed 0B of archived journals from /run/log/journal.
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.825 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.238 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.297 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2044ms rtt min/avg/max/mdev = 0.238/0.453/0.825/0.263 ms
Step 7: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
\[NEW\].*CONNTAG=my-logged-tagShow output
Jul 24 14:11:29.559264 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 12.0M free. Jul 24 14:11:29.560537 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:29.560638 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:29.572595 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:29.680038 osdx ulogd[921728]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=my-logged-tag Jul 24 14:11:29.680065 osdx ulogd[921728]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=my-logged-tag
Step 8: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
\[UPDATE\].*CONNTAG=my-logged-tagShow output
Jul 24 14:11:29.559264 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 12.0M free. Jul 24 14:11:29.560537 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:29.560638 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:29.572595 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:29.680038 osdx ulogd[921728]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=my-logged-tag Jul 24 14:11:29.680065 osdx ulogd[921728]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=my-logged-tag Jul 24 14:11:31.794923 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'.
Conntag With Long String In Logs
Description
Verify that long conntag strings are correctly logged and displayed. The system should handle strings up to 255 characters without truncation in logs.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY_TAG set system conntrack logging events new set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY_TAG rule 1 set conntag application-traffic-identifier-v1.2.3-production-env
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.628 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.628/0.628/0.628/0.000 ms
Step 4: Run the command system conntrack clear on DUT0 and expect the following output:
Show output
Connection tracking table has been emptied
Step 5: Run the command system journal clear on DUT0 and expect the following output:
Show output
Deleted archived journal /run/log/journal/3a8dbab828fc40a183893e468c03e10b/system@f6b627f530614ebebcf2fb35acc78ad6-0000000000028b9a-0006575bf374b311.journal (108.0K). Vacuuming done, freed 108.0K of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Vacuuming done, freed 0B of archived journals from /var/log/journal. Vacuuming done, freed 0B of archived journals from /run/log/journal.
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.499 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.266 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.301 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2033ms rtt min/avg/max/mdev = 0.266/0.355/0.499/0.102 ms
Step 7: Run the command system conntrack show on DUT0 and expect the following output:
Show output
icmp 1 29 src=192.168.100.2 dst=192.168.100.1 type=8 code=0 id=340 packets=3 bytes=252 src=192.168.100.1 dst=192.168.100.2 type=0 code=0 id=340 packets=3 bytes=252 mark=0 conntag=application-traffic-identifier-v1.2.3-production-env use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 8: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
CONNTAG=application-traffic-identifierShow output
Jul 24 14:11:41.974978 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:11:41.976891 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:41.976950 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:41.985589 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:42.095354 osdx ulogd[922157]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=application-traffic-identifier-v1.2.3-production-env Jul 24 14:11:44.205962 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack show'.
Conntag With Multiple Policies
Description
Verify that different traffic policies can set different conntag values, and each connection is tagged appropriately based on which policy rule matched.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY_MULTI set service ssh set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY_MULTI rule 1 selector SEL_ICMP set traffic policy POLICY_MULTI rule 1 set conntag icmp-traffic-tag set traffic policy POLICY_MULTI rule 2 selector SEL_TCP set traffic policy POLICY_MULTI rule 2 set conntag tcp-traffic-tag set traffic selector SEL_ICMP rule 1 protocol icmp set traffic selector SEL_TCP rule 1 protocol tcp
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.840 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.260 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.374 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2051ms rtt min/avg/max/mdev = 0.260/0.491/0.840/0.250 ms
Step 4: Run the command system conntrack clear on DUT0 and expect the following output:
Show output
Connection tracking table has been emptied
Step 5: Run the command system journal clear on DUT0 and expect the following output:
Show output
Vacuuming done, freed 0B of archived journals from /var/log/journal. Vacuuming done, freed 0B of archived journals from /run/log/journal. Deleted archived journal /run/log/journal/3a8dbab828fc40a183893e468c03e10b/system@f6b627f530614ebebcf2fb35acc78ad6-0000000000028be9-0006575bf42a6c89.journal (120.0K). Vacuuming done, freed 120.0K of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.444 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.285 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.322 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 0.285/0.350/0.444/0.067 ms
Step 7: Initiate an SSH connection from DUT1 to IP address 192.168.100.1 using user admin:
admin@DUT1$ ssh admin@192.168.100.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/nullShow output
Warning: Permanently added '192.168.100.1' (ECDSA) to the list of known hosts. admin@192.168.100.1's password: Welcome to Teldat OSDx v4.2.10.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Fri Jul 24 14:10:17 2026 admin@osdx$
Step 8: Run the command system conntrack show on DUT0 and expect the following output:
Show output
icmp 1 29 src=192.168.100.2 dst=192.168.100.1 type=8 code=0 id=342 packets=3 bytes=252 src=192.168.100.1 dst=192.168.100.2 type=0 code=0 id=342 packets=3 bytes=252 mark=0 conntag=icmp-traffic-tag use=1 tcp 6 19 TIME_WAIT src=192.168.100.2 dst=192.168.100.1 sport=52078 dport=22 packets=26 bytes=5161 src=192.168.100.1 dst=192.168.100.2 sport=22 dport=52078 packets=20 bytes=4777 [ASSURED] mark=0 conntag=tcp-traffic-tag use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 9: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
CONNTAG=icmp-traffic-tagShow output
Jul 24 14:11:56.120163 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:11:56.123070 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:56.123142 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:56.162590 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:56.287518 osdx ulogd[922671]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=icmp-traffic-tag Jul 24 14:11:56.287542 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=icmp-traffic-tag Jul 24 14:11:58.419216 osdx ulogd[922671]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.419238 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.419724 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.661241 osdx sshd[922729]: Accepted password for admin from 192.168.100.2 port 52078 ssh2 Jul 24 14:11:58.671543 osdx sshd[922729]: pam_env(sshd:session): deprecated reading of user environment enabled Jul 24 14:11:58.755325 osdx OSDxCLI[922739]: User 'admin' has logged in. Jul 24 14:11:58.793153 osdx OSDxCLI[922739]: User 'admin' has logged out. Jul 24 14:11:58.803134 osdx sshd[922738]: Received disconnect from 192.168.100.2 port 52078:11: disconnected by user Jul 24 14:11:58.803313 osdx sshd[922738]: Disconnected from user admin 192.168.100.2 port 52078 Jul 24 14:11:58.803764 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.803793 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.804902 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.808111 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.980491 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack show'.
Step 10: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
CONNTAG=tcp-traffic-tagShow output
Jul 24 14:11:56.120163 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:11:56.123070 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:11:56.123142 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:11:56.162590 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:11:56.287518 osdx ulogd[922671]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=icmp-traffic-tag Jul 24 14:11:56.287542 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 CONNTAG=icmp-traffic-tag Jul 24 14:11:58.419216 osdx ulogd[922671]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.419238 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.419724 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.661241 osdx sshd[922729]: Accepted password for admin from 192.168.100.2 port 52078 ssh2 Jul 24 14:11:58.671543 osdx sshd[922729]: pam_env(sshd:session): deprecated reading of user environment enabled Jul 24 14:11:58.755325 osdx OSDxCLI[922739]: User 'admin' has logged in. Jul 24 14:11:58.793153 osdx OSDxCLI[922739]: User 'admin' has logged out. Jul 24 14:11:58.803134 osdx sshd[922738]: Received disconnect from 192.168.100.2 port 52078:11: disconnected by user Jul 24 14:11:58.803313 osdx sshd[922738]: Disconnected from user admin 192.168.100.2 port 52078 Jul 24 14:11:58.803764 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.803793 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.804902 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.808111 osdx ulogd[922671]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=TCP SPT=52078 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=52078 PKTS=0 BYTES=0 CONNTAG=tcp-traffic-tag Jul 24 14:11:58.980491 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system conntrack show'. Jul 24 14:11:59.100211 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'.