Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 23454 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.524 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.524/0.524/0.524/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.393 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.393/0.393/0.393/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 40082 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 85.8 MBytes 719 Mbits/sec 12 1.66 MBytes [ 5] 1.00-2.00 sec 87.5 MBytes 734 Mbits/sec 0 1.82 MBytes [ 5] 2.00-3.00 sec 88.8 MBytes 744 Mbits/sec 0 1.95 MBytes [ 5] 3.00-4.00 sec 88.8 MBytes 744 Mbits/sec 0 2.05 MBytes [ 5] 4.00-5.00 sec 91.2 MBytes 765 Mbits/sec 0 2.13 MBytes [ 5] 5.00-6.00 sec 88.8 MBytes 744 Mbits/sec 0 2.19 MBytes [ 5] 6.00-7.00 sec 90.0 MBytes 755 Mbits/sec 0 2.23 MBytes [ 5] 7.00-8.00 sec 92.5 MBytes 776 Mbits/sec 6 1.64 MBytes [ 5] 8.00-9.00 sec 61.2 MBytes 514 Mbits/sec 0 1.72 MBytes [ 5] 9.00-10.00 sec 48.8 MBytes 409 Mbits/sec 0 1.79 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 823 MBytes 691 Mbits/sec 18 sender [ 5] 0.00-10.02 sec 822 MBytes 688 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
01/10/2025-12:26:32.043829 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40072 -> 40.0.0.2:5001 01/10/2025-12:26:32.044672 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40082 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 44345 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.447 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.447/0.447/0.447/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.494 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.494/0.494/0.494/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 51734 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 330 MBytes 2.76 Gbits/sec 19 1.94 MBytes [ 5] 1.00-2.00 sec 334 MBytes 2.80 Gbits/sec 0 2.09 MBytes [ 5] 2.00-3.00 sec 328 MBytes 2.75 Gbits/sec 4 1.57 MBytes [ 5] 3.00-4.00 sec 359 MBytes 3.01 Gbits/sec 0 1.73 MBytes [ 5] 4.00-5.00 sec 385 MBytes 3.23 Gbits/sec 0 1.89 MBytes [ 5] 5.00-6.00 sec 392 MBytes 3.29 Gbits/sec 0 2.03 MBytes [ 5] 6.00-7.00 sec 405 MBytes 3.40 Gbits/sec 0 2.17 MBytes [ 5] 7.00-8.00 sec 432 MBytes 3.63 Gbits/sec 12 1.62 MBytes [ 5] 8.00-9.00 sec 421 MBytes 3.53 Gbits/sec 0 1.80 MBytes [ 5] 9.00-10.00 sec 416 MBytes 3.49 Gbits/sec 0 1.96 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.71 GBytes 3.19 Gbits/sec 35 sender [ 5] 0.00-10.00 sec 3.71 GBytes 3.19 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
01/10/2025-12:27:03.499548 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51730 -> 40.0.0.2:5001 01/10/2025-12:27:03.500484 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51734 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Jan 10 12:26:55.000400 osdx systemd-timedated[35101]: Changed local time to Fri 2025-01-10 12:26:55 UTC Jan 10 12:26:55.001905 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'set date 2025-01-10 12:26:55'. Jan 10 12:26:55.002048 osdx systemd-journald[1741]: Time jumped backwards, rotating. Jan 10 12:26:55.320058 osdx systemd-journald[1741]: Runtime Journal (/run/log/journal/fda2548b09bd4d8ba0d8cad09b8eab71) is 2.0M, max 15.3M, 13.2M free. Jan 10 12:26:55.321991 osdx systemd-journald[1741]: Received client request to rotate journal, rotating. Jan 10 12:26:55.322035 osdx systemd-journald[1741]: Vacuuming done, freed 0B of archived journals from /run/log/journal/fda2548b09bd4d8ba0d8cad09b8eab71. Jan 10 12:26:55.329159 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'system journal clear'. Jan 10 12:26:55.634272 osdx osdx-coredump[35119]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Jan 10 12:26:55.641584 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'system coredump delete all'. Jan 10 12:26:56.082664 osdx OSDxCLI[34770]: User 'admin' entered the configuration menu. Jan 10 12:26:56.156044 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jan 10 12:26:56.241869 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Jan 10 12:26:56.296430 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jan 10 12:26:56.397775 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Jan 10 12:26:56.456174 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Jan 10 12:26:56.555313 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Jan 10 12:26:56.631187 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'show working'. Jan 10 12:26:56.908333 osdx INFO[35149]: FRR daemons did not change Jan 10 12:26:56.925997 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jan 10 12:26:57.009997 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Jan 10 12:26:57.035955 osdx (udev-worker)[35252]: Network interface NamePolicy= disabled on kernel command line. Jan 10 12:26:57.077895 osdx (udev-worker)[35257]: Network interface NamePolicy= disabled on kernel command line. Jan 10 12:26:57.207777 osdx cfgd[1445]: [34770]Completed change to active configuration Jan 10 12:26:57.234504 osdx OSDxCLI[34770]: User 'admin' committed the configuration. Jan 10 12:26:57.283493 osdx OSDxCLI[34770]: User 'admin' left the configuration menu. Jan 10 12:26:59.266324 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jan 10 12:26:59.338531 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Jan 10 12:26:59.450666 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Jan 10 12:26:59.916039 osdx file_operation[35340]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Jan 10 12:26:59.936923 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Jan 10 12:27:00.064606 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Jan 10 12:27:00.204049 osdx OSDxCLI[34770]: User 'admin' entered the configuration menu. Jan 10 12:27:00.264608 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jan 10 12:27:00.360697 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jan 10 12:27:00.416660 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jan 10 12:27:00.514946 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jan 10 12:27:00.573828 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jan 10 12:27:00.703504 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jan 10 12:27:00.790625 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jan 10 12:27:00.867769 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jan 10 12:27:00.961664 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jan 10 12:27:01.017129 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jan 10 12:27:01.111605 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jan 10 12:27:01.171330 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jan 10 12:27:01.259074 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jan 10 12:27:01.324915 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jan 10 12:27:01.433270 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jan 10 12:27:01.506554 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Jan 10 12:27:01.602146 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Jan 10 12:27:01.684249 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jan 10 12:27:01.777115 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jan 10 12:27:01.831460 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jan 10 12:27:01.960020 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'show working'. Jan 10 12:27:02.165948 osdx INFO[35425]: FRR daemons did not change Jan 10 12:27:02.654246 osdx systemd[1]: Reloading. Jan 10 12:27:02.749992 osdx systemd-sysv-generator[35485]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Jan 10 12:27:02.894367 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jan 10 12:27:02.911090 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jan 10 12:27:03.084311 osdx INFO[35467]: Rules successfully loaded Jan 10 12:27:03.085039 osdx cfgd[1445]: [34770]Completed change to active configuration Jan 10 12:27:03.086937 osdx OSDxCLI[34770]: User 'admin' committed the configuration. Jan 10 12:27:03.104540 osdx OSDxCLI[34770]: User 'admin' left the configuration menu. Jan 10 12:27:03.502010 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=29764 DF PROTO=TCP SPT=51730 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jan 10 12:27:03.502093 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=37028 DF PROTO=TCP SPT=51734 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jan 10 12:27:13.674278 osdx systemd[1]: Starting logrotate.service - Rotate log files... Jan 10 12:27:13.695990 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Jan 10 12:27:13.696935 osdx systemd[1]: logrotate.service: Deactivated successfully. Jan 10 12:27:13.697038 osdx systemd[1]: Finished logrotate.service - Rotate log files.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 40252 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 351 MBytes 2.95 Gbits/sec 4 1.92 MBytes [ 5] 1.00-2.00 sec 349 MBytes 2.93 Gbits/sec 0 2.07 MBytes [ 5] 2.00-3.00 sec 392 MBytes 3.29 Gbits/sec 78 1.49 MBytes [ 5] 3.00-4.00 sec 415 MBytes 3.48 Gbits/sec 0 1.72 MBytes [ 5] 4.00-5.00 sec 435 MBytes 3.65 Gbits/sec 0 1.89 MBytes [ 5] 5.00-6.00 sec 404 MBytes 3.39 Gbits/sec 0 2.04 MBytes [ 5] 6.00-7.00 sec 348 MBytes 2.92 Gbits/sec 10 1.52 MBytes [ 5] 7.00-8.00 sec 332 MBytes 2.79 Gbits/sec 0 1.68 MBytes [ 5] 8.00-9.00 sec 349 MBytes 2.93 Gbits/sec 0 1.82 MBytes [ 5] 9.00-10.00 sec 401 MBytes 3.37 Gbits/sec 0 1.97 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.69 GBytes 3.17 Gbits/sec 92 sender [ 5] 0.00-10.00 sec 3.69 GBytes 3.17 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
01/10/2025-12:27:03.499548 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51730 -> 40.0.0.2:5001 01/10/2025-12:27:03.500484 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51734 -> 40.0.0.2:5001 01/10/2025-12:27:18.339496 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40240 -> 40.0.0.2:5001 01/10/2025-12:27:18.340378 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40252 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Jan 10 12:26:55.000400 osdx systemd-timedated[35101]: Changed local time to Fri 2025-01-10 12:26:55 UTC Jan 10 12:26:55.001905 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'set date 2025-01-10 12:26:55'. Jan 10 12:26:55.002048 osdx systemd-journald[1741]: Time jumped backwards, rotating. Jan 10 12:26:55.320058 osdx systemd-journald[1741]: Runtime Journal (/run/log/journal/fda2548b09bd4d8ba0d8cad09b8eab71) is 2.0M, max 15.3M, 13.2M free. Jan 10 12:26:55.321991 osdx systemd-journald[1741]: Received client request to rotate journal, rotating. Jan 10 12:26:55.322035 osdx systemd-journald[1741]: Vacuuming done, freed 0B of archived journals from /run/log/journal/fda2548b09bd4d8ba0d8cad09b8eab71. Jan 10 12:26:55.329159 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'system journal clear'. Jan 10 12:26:55.634272 osdx osdx-coredump[35119]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Jan 10 12:26:55.641584 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'system coredump delete all'. Jan 10 12:26:56.082664 osdx OSDxCLI[34770]: User 'admin' entered the configuration menu. Jan 10 12:26:56.156044 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jan 10 12:26:56.241869 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Jan 10 12:26:56.296430 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jan 10 12:26:56.397775 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Jan 10 12:26:56.456174 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Jan 10 12:26:56.555313 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Jan 10 12:26:56.631187 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'show working'. Jan 10 12:26:56.908333 osdx INFO[35149]: FRR daemons did not change Jan 10 12:26:56.925997 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jan 10 12:26:57.009997 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Jan 10 12:26:57.035955 osdx (udev-worker)[35252]: Network interface NamePolicy= disabled on kernel command line. Jan 10 12:26:57.077895 osdx (udev-worker)[35257]: Network interface NamePolicy= disabled on kernel command line. Jan 10 12:26:57.207777 osdx cfgd[1445]: [34770]Completed change to active configuration Jan 10 12:26:57.234504 osdx OSDxCLI[34770]: User 'admin' committed the configuration. Jan 10 12:26:57.283493 osdx OSDxCLI[34770]: User 'admin' left the configuration menu. Jan 10 12:26:59.266324 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jan 10 12:26:59.338531 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Jan 10 12:26:59.450666 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Jan 10 12:26:59.916039 osdx file_operation[35340]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Jan 10 12:26:59.936923 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Jan 10 12:27:00.064606 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Jan 10 12:27:00.204049 osdx OSDxCLI[34770]: User 'admin' entered the configuration menu. Jan 10 12:27:00.264608 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jan 10 12:27:00.360697 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jan 10 12:27:00.416660 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jan 10 12:27:00.514946 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jan 10 12:27:00.573828 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jan 10 12:27:00.703504 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jan 10 12:27:00.790625 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jan 10 12:27:00.867769 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jan 10 12:27:00.961664 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jan 10 12:27:01.017129 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jan 10 12:27:01.111605 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jan 10 12:27:01.171330 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jan 10 12:27:01.259074 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jan 10 12:27:01.324915 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jan 10 12:27:01.433270 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jan 10 12:27:01.506554 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Jan 10 12:27:01.602146 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Jan 10 12:27:01.684249 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jan 10 12:27:01.777115 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jan 10 12:27:01.831460 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jan 10 12:27:01.960020 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'show working'. Jan 10 12:27:02.165948 osdx INFO[35425]: FRR daemons did not change Jan 10 12:27:02.654246 osdx systemd[1]: Reloading. Jan 10 12:27:02.749992 osdx systemd-sysv-generator[35485]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Jan 10 12:27:02.894367 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jan 10 12:27:02.911090 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jan 10 12:27:03.084311 osdx INFO[35467]: Rules successfully loaded Jan 10 12:27:03.085039 osdx cfgd[1445]: [34770]Completed change to active configuration Jan 10 12:27:03.086937 osdx OSDxCLI[34770]: User 'admin' committed the configuration. Jan 10 12:27:03.104540 osdx OSDxCLI[34770]: User 'admin' left the configuration menu. Jan 10 12:27:03.502010 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=29764 DF PROTO=TCP SPT=51730 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jan 10 12:27:03.502093 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=37028 DF PROTO=TCP SPT=51734 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jan 10 12:27:13.674278 osdx systemd[1]: Starting logrotate.service - Rotate log files... Jan 10 12:27:13.695990 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Jan 10 12:27:13.696935 osdx systemd[1]: logrotate.service: Deactivated successfully. Jan 10 12:27:13.697038 osdx systemd[1]: Finished logrotate.service - Rotate log files. Jan 10 12:27:13.790719 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'system journal show | cat'. Jan 10 12:27:13.948106 osdx OSDxCLI[34770]: User 'admin' entered the configuration menu. Jan 10 12:27:14.008658 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jan 10 12:27:14.112007 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jan 10 12:27:14.165276 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jan 10 12:27:14.260715 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jan 10 12:27:14.316374 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jan 10 12:27:14.417419 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jan 10 12:27:14.491760 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jan 10 12:27:14.571646 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jan 10 12:27:14.624800 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jan 10 12:27:14.720361 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jan 10 12:27:14.774009 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jan 10 12:27:14.871706 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jan 10 12:27:14.928853 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jan 10 12:27:15.031745 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jan 10 12:27:15.082488 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jan 10 12:27:15.184228 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Jan 10 12:27:15.238249 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Jan 10 12:27:15.338695 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jan 10 12:27:15.393400 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jan 10 12:27:15.489494 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jan 10 12:27:15.805128 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Jan 10 12:27:15.859853 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Jan 10 12:27:15.957335 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Jan 10 12:27:16.017498 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Jan 10 12:27:16.138904 osdx OSDxCLI[34770]: User 'admin' added a new cfg line: 'show changes'. Jan 10 12:27:16.287838 osdx INFO[35620]: FRR daemons did not change Jan 10 12:27:16.639786 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Jan 10 12:27:17.905176 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Jan 10 12:27:17.905288 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Jan 10 12:27:17.905320 osdx systemd[1]: suricata@FW.service: Consumed 1.289s CPU time. Jan 10 12:27:17.926249 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jan 10 12:27:17.943417 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jan 10 12:27:18.116336 osdx INFO[35645]: Rules successfully loaded Jan 10 12:27:18.116855 osdx cfgd[1445]: [34770]Completed change to active configuration Jan 10 12:27:18.118809 osdx OSDxCLI[34770]: User 'admin' committed the configuration. Jan 10 12:27:18.134644 osdx OSDxCLI[34770]: User 'admin' left the configuration menu. Jan 10 12:27:18.342008 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=28317 DF PROTO=TCP SPT=40240 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Jan 10 12:27:18.342071 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=58573 DF PROTO=TCP SPT=40252 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Jan 10 12:27:25.031537 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Jan 10 12:27:28.549294 osdx OSDxCLI[34770]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 24538 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.509 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.509/0.509/0.509/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.361 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.361/0.361/0.361/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 45416 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 374 MBytes 3.14 Gbits/sec 36 1.93 MBytes [ 5] 1.00-2.00 sec 341 MBytes 2.86 Gbits/sec 0 2.09 MBytes [ 5] 2.00-3.00 sec 348 MBytes 2.92 Gbits/sec 8 1.61 MBytes [ 5] 3.00-4.00 sec 339 MBytes 2.84 Gbits/sec 0 1.76 MBytes [ 5] 4.00-5.00 sec 339 MBytes 2.84 Gbits/sec 0 1.90 MBytes [ 5] 5.00-6.00 sec 380 MBytes 3.19 Gbits/sec 209 1.44 MBytes [ 5] 6.00-7.00 sec 408 MBytes 3.42 Gbits/sec 0 1.63 MBytes [ 5] 7.00-8.00 sec 418 MBytes 3.50 Gbits/sec 0 1.81 MBytes [ 5] 8.00-9.00 sec 410 MBytes 3.44 Gbits/sec 53 1.38 MBytes [ 5] 9.00-10.00 sec 369 MBytes 3.09 Gbits/sec 0 1.56 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.64 GBytes 3.12 Gbits/sec 306 sender [ 5] 0.00-10.00 sec 3.63 GBytes 3.12 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
01/10/2025-12:27:51.625019 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45404 -> 40.0.0.2:5001 01/10/2025-12:27:51.625853 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45416 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=78 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=78 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=45416 dport=5001 packets=2696651 bytes=4044966409 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=45416 packets=292858 bytes=15221420 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=40 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=40 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=45404 dport=5001 packets=16 bytes=1302 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=45404 packets=13 bytes=1017 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 43214 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 348 MBytes 2.92 Gbits/sec 3 1.91 MBytes [ 5] 1.00-2.00 sec 365 MBytes 3.06 Gbits/sec 0 2.07 MBytes [ 5] 2.00-3.00 sec 365 MBytes 3.06 Gbits/sec 5 1.55 MBytes [ 5] 3.00-4.00 sec 458 MBytes 3.84 Gbits/sec 0 1.75 MBytes [ 5] 4.00-5.00 sec 384 MBytes 3.22 Gbits/sec 0 1.90 MBytes [ 5] 5.00-6.00 sec 381 MBytes 3.20 Gbits/sec 0 2.05 MBytes [ 5] 6.00-7.00 sec 366 MBytes 3.07 Gbits/sec 35 1.57 MBytes [ 5] 7.00-8.00 sec 441 MBytes 3.70 Gbits/sec 0 1.77 MBytes [ 5] 8.00-9.00 sec 426 MBytes 3.58 Gbits/sec 0 1.93 MBytes [ 5] 9.00-10.00 sec 379 MBytes 3.18 Gbits/sec 167 1.50 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.82 GBytes 3.28 Gbits/sec 210 sender [ 5] 0.00-10.00 sec 3.82 GBytes 3.28 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
01/10/2025-12:27:51.625019 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45404 -> 40.0.0.2:5001 01/10/2025-12:27:51.625853 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45416 -> 40.0.0.2:5001 01/10/2025-12:28:05.505823 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43202 -> 40.0.0.2:5001 01/10/2025-12:28:05.506584 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43214 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=43202 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=43202 packets=13 bytes=1018 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=43214 dport=5001 packets=2833157 bytes=4249723961 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=43214 packets=349403 bytes=18160720 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 79113 0 --:--:-- --:--:-- --:--:-- 97k
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.459 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.459/0.459/0.459/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.370 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.370/0.370/0.370/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
01/10/2025-12:28:36.523277 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43482 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=81 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=81 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=43482 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=43482 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=43 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=43 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
01/10/2025-12:28:36.523277 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43482 -> 40.0.0.2:5000 01/10/2025-12:28:42.944879 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43482 -> 40.0.0.2:5000 01/10/2025-12:28:44.373573 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34850 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=34850 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=34850 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 830 2 - 5 5 331 331 --------------------------------------------------------------------- Total 11 11 830 830
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 24845 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.487 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.487/0.487/0.487/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.354 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.354/0.354/0.354/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
01/10/2025-12:29:05.832095 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58530 -> 40.0.0.2:5001 01/10/2025-12:29:05.832929 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58534 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=58534 dport=5001 packets=92284 bytes=138418805 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=58534 packets=16253 bytes=846016 [ASSURED] [OFFLOAD, packets=92273 bytes=138406604 packets=16251 bytes=845904] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=58530 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=58530 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=388 packets=4 bytes=211] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=46 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=46 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=84 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=84 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 31412 0 --:--:-- --:--:-- --:--:-- 33250
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
01/10/2025-12:29:05.832095 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58530 -> 40.0.0.2:5001 01/10/2025-12:29:05.832929 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58534 -> 40.0.0.2:5001 01/10/2025-12:29:07.876527 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52492 -> 40.0.0.2:5001 01/10/2025-12:29:07.877947 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:43047 -> 40.0.0.2:5001 01/10/2025-12:29:07.888601 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:43047 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
udp 17 src=20.0.0.2 dst=40.0.0.2 sport=43047 dport=5001 packets=16 bytes=22172 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=43047 packets=1 bytes=32 [OFFLOAD, packets=13 bytes=19188 packets=0 bytes=0] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=52492 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=52492 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=406 packets=4 bytes=211] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 82815 0 --:--:-- --:--:-- --:--:-- 97k
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.493 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.493/0.493/0.493/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.433 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.433/0.433/0.433/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
01/10/2025-12:29:27.047330 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54394 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 54394 5000 yes 201 0 8 673 40.0.0.2 20.0.0.2 5000 54394 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250117s ending at 1736512170.716490 XDP_DROP 8 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 13 pkts ( 0 pps) 1 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
01/10/2025-12:29:27.047330 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54394 -> 40.0.0.2:5000 01/10/2025-12:29:30.865915 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:43953 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 43953 no 201 0 0 0 20.0.0.2 40.0.0.2 54394 5000 yes 201 0 11 847 40.0.0.2 20.0.0.2 5000 54394 yes 201 0 0 0 20.0.0.2 40.0.0.2 43953 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250124s ending at 1736512174.569104 XDP_DROP 11 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 33 pkts ( 0 pps) 2 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)