Logging

This scenario shows how to configure the logging options to retrieve useful information from the intercepted traffic.

Test Traffic-Proxy Logging

Description

This example demonstrates how to enable the service logging configuration and what commands can be used to display information about intercepted traffic.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 192.168.1.1/24
set interfaces ethernet eth0 vif 100 traffic policy in TPROXY
set interfaces ethernet eth1 vif 200 address 10.0.0.1/24
set service traffic-proxy TRAFFIC_PROXY logging connection
set service traffic-proxy TRAFFIC_PROXY logging content
set service traffic-proxy TRAFFIC_PROXY mode ssl
set service traffic-proxy TRAFFIC_PROXY port 3128
set service traffic-proxy TRAFFIC_PROXY x509 ca-cert 'running://test.crt'
set service traffic-proxy TRAFFIC_PROXY x509 ca-key 'running://test.key'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy TPROXY rule 5 action proxy tcp 3128
set traffic policy TPROXY rule 5 selector TCP_TRAFFIC
set traffic selector TCP_TRAFFIC rule 1 destination port 80,443,8080,4430
set traffic selector TCP_TRAFFIC rule 1 protocol tcp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 192.168.1.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 vif 200 address 10.0.0.2/24
set protocols static route 0.0.0.0/0 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.0.0.2 from DUT1:

admin@DUT1$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 192.168.1.2 from DUT2:

admin@DUT2$ ping 192.168.1.2 count 1 size 56 timeout 1

Step 6: Initiate a ssl connection from DUT1 to DUT2 and try to send some messages between both endpoints

admin@DUT2$ monitor test connection server 443 ssl cert running://test.crt key running://test.key
admin@DUT1$ monitor test connection client 10.0.0.2 443 ssl source-port 1234

Step 7: Run command service traffic-proxy TRAFFIC_PROXY show stats at DUT0 and check if output does not match the following regular expressions:

intercepted\s+0\s+0

Step 8: Run command service traffic-proxy TRAFFIC_PROXY show connections at DUT0 and check if output matches the following regular expressions:

ssl 192.168.1\.2 1234 10.0.0\.2 443

Step 9: Run command service traffic-proxy TRAFFIC_PROXY show content at DUT0 and check if output contains the following tokens:

Hello from server

Step 10: Run command service traffic-proxy TRAFFIC_PROXY show flows at DUT0 and check if output matches the following regular expressions:

192.168.1\.2\s+10.0.0\.2\s+1234\s+443

Attention

The previous commands can be used to retrieve much information about intercepted traffic. If for some reason, traffic does not seem to be properly intercepted, it could be useful to enable logging in the traffic policy. This can be achieved by running set traffic policy <NAME> rule 1 log prefix <PREFIX>. After generating some traffic, the system journal monitor command can be used to review log messages.