Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 2591 0 --:--:-- --:--:-- --:--:-- 2632
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.31 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.310/1.310/1.310/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.857 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.857/0.857/0.857/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 59982 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 5.95 MBytes 49.9 Mbits/sec 0 272 KBytes [ 5] 1.00-2.00 sec 11.1 MBytes 92.3 Mbits/sec 0 711 KBytes [ 5] 2.00-3.00 sec 5.00 MBytes 42.1 Mbits/sec 1 906 KBytes [ 5] 3.00-4.00 sec 18.8 MBytes 157 Mbits/sec 1 1.80 MBytes [ 5] 4.00-5.00 sec 18.8 MBytes 157 Mbits/sec 316 1.37 MBytes [ 5] 5.00-6.00 sec 40.0 MBytes 335 Mbits/sec 0 1.51 MBytes [ 5] 6.00-7.00 sec 35.0 MBytes 294 Mbits/sec 0 1.62 MBytes [ 5] 7.00-8.00 sec 55.0 MBytes 461 Mbits/sec 0 1.70 MBytes [ 5] 8.00-9.00 sec 57.5 MBytes 482 Mbits/sec 0 1.77 MBytes [ 5] 9.00-10.00 sec 47.5 MBytes 398 Mbits/sec 0 1.81 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 294 MBytes 247 Mbits/sec 318 sender [ 5] 0.00-10.03 sec 292 MBytes 245 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-20:06:10.022780 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59966 -> 40.0.0.2:5001 02/19/2025-20:06:10.025244 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59982 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 16519 0 --:--:-- --:--:-- --:--:-- 18428
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.20 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.202/1.202/1.202/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.894 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.894/0.894/0.894/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 44988 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 8.86 MBytes 74.4 Mbits/sec 0 390 KBytes [ 5] 1.00-2.00 sec 8.64 MBytes 72.4 Mbits/sec 0 673 KBytes [ 5] 2.00-3.00 sec 6.25 MBytes 52.4 Mbits/sec 0 933 KBytes [ 5] 3.00-4.00 sec 17.5 MBytes 147 Mbits/sec 0 1.46 MBytes [ 5] 4.00-5.00 sec 56.2 MBytes 472 Mbits/sec 284 1.18 MBytes [ 5] 5.00-6.00 sec 70.0 MBytes 587 Mbits/sec 0 1.26 MBytes [ 5] 6.00-7.00 sec 82.5 MBytes 692 Mbits/sec 0 1.32 MBytes [ 5] 7.00-8.00 sec 71.2 MBytes 598 Mbits/sec 0 1.36 MBytes [ 5] 8.00-9.00 sec 101 MBytes 849 Mbits/sec 0 1.39 MBytes [ 5] 9.00-10.00 sec 33.8 MBytes 283 Mbits/sec 0 1.41 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 456 MBytes 383 Mbits/sec 284 sender [ 5] 0.00-10.03 sec 454 MBytes 380 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-20:06:52.614169 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44982 -> 40.0.0.2:5001 02/19/2025-20:06:52.620955 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44988 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 19 20:06:38.561499 osdx systemd-journald[1656]: Runtime Journal (/run/log/journal/9e929e613f1a4f1290b0c92170d5d508) is 1.9M, max 15.3M, 13.4M free. Feb 19 20:06:38.563682 osdx systemd-journald[1656]: Received client request to rotate journal, rotating. Feb 19 20:06:38.563806 osdx systemd-journald[1656]: Vacuuming done, freed 0B of archived journals from /run/log/journal/9e929e613f1a4f1290b0c92170d5d508. Feb 19 20:06:38.579597 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'system journal clear'. Feb 19 20:06:39.214524 osdx osdx-coredump[266714]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 19 20:06:39.226888 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 20:06:40.088142 osdx OSDxCLI[266357]: User 'admin' entered the configuration menu. Feb 19 20:06:40.244448 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 19 20:06:40.388177 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 19 20:06:40.515773 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 20:06:40.649699 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 19 20:06:40.799112 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 19 20:06:40.915039 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 19 20:06:41.169153 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'show working'. Feb 19 20:06:41.310776 osdx INFO[266744]: FRR daemons did not change Feb 19 20:06:41.347686 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 20:06:41.495697 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 19 20:06:41.546856 osdx (udev-worker)[266844]: Network interface NamePolicy= disabled on kernel command line. Feb 19 20:06:41.937709 osdx cfgd[1455]: [266357]Completed change to active configuration Feb 19 20:06:42.000187 osdx OSDxCLI[266357]: User 'admin' committed the configuration. Feb 19 20:06:42.055124 osdx OSDxCLI[266357]: User 'admin' left the configuration menu. Feb 19 20:06:45.462058 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 19 20:06:45.606750 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 19 20:06:45.757621 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 19 20:06:46.549143 osdx file_operation[266935]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 19 20:06:46.586229 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 19 20:06:46.790320 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 19 20:06:46.977839 osdx OSDxCLI[266357]: User 'admin' entered the configuration menu. Feb 19 20:06:47.097586 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 20:06:47.231481 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 20:06:47.349576 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 20:06:47.472139 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 20:06:47.585806 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 20:06:47.722853 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 20:06:47.904547 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 20:06:48.026705 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 20:06:48.135847 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 20:06:48.258430 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 20:06:48.439605 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 20:06:48.618904 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 20:06:48.816577 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 20:06:48.991289 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 20:06:49.200502 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 20:06:49.360695 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 20:06:49.476579 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 20:06:49.665324 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 20:06:49.800761 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 20:06:49.932134 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 20:06:50.209832 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'show working'. Feb 19 20:06:50.590526 osdx INFO[267021]: FRR daemons did not change Feb 19 20:06:50.941044 osdx systemd[1]: Reloading. Feb 19 20:06:51.171698 osdx systemd-sysv-generator[267075]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 19 20:06:51.407223 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 20:06:51.440896 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 20:06:51.806154 osdx INFO[267056]: Rules successfully loaded Feb 19 20:06:51.807492 osdx cfgd[1455]: [266357]Completed change to active configuration Feb 19 20:06:51.811563 osdx OSDxCLI[266357]: User 'admin' committed the configuration. Feb 19 20:06:51.852563 osdx OSDxCLI[266357]: User 'admin' left the configuration menu. Feb 19 20:06:52.618195 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=13543 DF PROTO=TCP SPT=44982 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 20:06:52.627630 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=48146 DF PROTO=TCP SPT=44988 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 20:07:03.127337 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 19 20:07:03.173425 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 19 20:07:03.173701 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 19 20:07:03.225507 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 39808 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 52.9 MBytes 443 Mbits/sec 0 2.29 MBytes [ 5] 1.00-2.00 sec 86.2 MBytes 725 Mbits/sec 447 1.33 MBytes [ 5] 2.00-3.00 sec 76.2 MBytes 640 Mbits/sec 0 1.41 MBytes [ 5] 3.00-4.00 sec 82.5 MBytes 692 Mbits/sec 0 1.47 MBytes [ 5] 4.00-5.00 sec 78.8 MBytes 661 Mbits/sec 0 1.51 MBytes [ 5] 5.00-6.00 sec 66.2 MBytes 556 Mbits/sec 91 1.13 MBytes [ 5] 6.00-7.00 sec 70.0 MBytes 587 Mbits/sec 0 1.19 MBytes [ 5] 7.00-8.00 sec 85.0 MBytes 713 Mbits/sec 0 1.24 MBytes [ 5] 8.00-9.00 sec 91.2 MBytes 765 Mbits/sec 0 1.26 MBytes [ 5] 9.00-10.00 sec 70.0 MBytes 587 Mbits/sec 0 1.28 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 759 MBytes 637 Mbits/sec 538 sender [ 5] 0.00-10.02 sec 756 MBytes 633 Mbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-20:06:52.614169 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44982 -> 40.0.0.2:5001 02/19/2025-20:06:52.620955 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44988 -> 40.0.0.2:5001 02/19/2025-20:07:11.515178 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39804 -> 40.0.0.2:5001 02/19/2025-20:07:11.528480 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39808 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 19 20:06:38.561499 osdx systemd-journald[1656]: Runtime Journal (/run/log/journal/9e929e613f1a4f1290b0c92170d5d508) is 1.9M, max 15.3M, 13.4M free. Feb 19 20:06:38.563682 osdx systemd-journald[1656]: Received client request to rotate journal, rotating. Feb 19 20:06:38.563806 osdx systemd-journald[1656]: Vacuuming done, freed 0B of archived journals from /run/log/journal/9e929e613f1a4f1290b0c92170d5d508. Feb 19 20:06:38.579597 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'system journal clear'. Feb 19 20:06:39.214524 osdx osdx-coredump[266714]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 19 20:06:39.226888 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 20:06:40.088142 osdx OSDxCLI[266357]: User 'admin' entered the configuration menu. Feb 19 20:06:40.244448 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 19 20:06:40.388177 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 19 20:06:40.515773 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 20:06:40.649699 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 19 20:06:40.799112 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 19 20:06:40.915039 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 19 20:06:41.169153 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'show working'. Feb 19 20:06:41.310776 osdx INFO[266744]: FRR daemons did not change Feb 19 20:06:41.347686 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 20:06:41.495697 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 19 20:06:41.546856 osdx (udev-worker)[266844]: Network interface NamePolicy= disabled on kernel command line. Feb 19 20:06:41.937709 osdx cfgd[1455]: [266357]Completed change to active configuration Feb 19 20:06:42.000187 osdx OSDxCLI[266357]: User 'admin' committed the configuration. Feb 19 20:06:42.055124 osdx OSDxCLI[266357]: User 'admin' left the configuration menu. Feb 19 20:06:45.462058 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 19 20:06:45.606750 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 19 20:06:45.757621 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 19 20:06:46.549143 osdx file_operation[266935]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 19 20:06:46.586229 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 19 20:06:46.790320 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 19 20:06:46.977839 osdx OSDxCLI[266357]: User 'admin' entered the configuration menu. Feb 19 20:06:47.097586 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 20:06:47.231481 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 20:06:47.349576 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 20:06:47.472139 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 20:06:47.585806 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 20:06:47.722853 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 20:06:47.904547 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 20:06:48.026705 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 20:06:48.135847 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 20:06:48.258430 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 20:06:48.439605 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 20:06:48.618904 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 20:06:48.816577 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 20:06:48.991289 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 20:06:49.200502 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 20:06:49.360695 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 20:06:49.476579 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 20:06:49.665324 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 20:06:49.800761 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 20:06:49.932134 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 20:06:50.209832 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'show working'. Feb 19 20:06:50.590526 osdx INFO[267021]: FRR daemons did not change Feb 19 20:06:50.941044 osdx systemd[1]: Reloading. Feb 19 20:06:51.171698 osdx systemd-sysv-generator[267075]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 19 20:06:51.407223 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 20:06:51.440896 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 20:06:51.806154 osdx INFO[267056]: Rules successfully loaded Feb 19 20:06:51.807492 osdx cfgd[1455]: [266357]Completed change to active configuration Feb 19 20:06:51.811563 osdx OSDxCLI[266357]: User 'admin' committed the configuration. Feb 19 20:06:51.852563 osdx OSDxCLI[266357]: User 'admin' left the configuration menu. Feb 19 20:06:52.618195 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=13543 DF PROTO=TCP SPT=44982 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 20:06:52.627630 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=48146 DF PROTO=TCP SPT=44988 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 20:07:03.127337 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 19 20:07:03.173425 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 19 20:07:03.173701 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 19 20:07:03.225507 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Feb 19 20:07:03.472343 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'system journal show | cat'. Feb 19 20:07:03.780763 osdx OSDxCLI[266357]: User 'admin' entered the configuration menu. Feb 19 20:07:03.933938 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 20:07:04.056363 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 20:07:04.160742 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 20:07:04.288716 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 20:07:04.416030 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 20:07:04.529278 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 20:07:04.767333 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 20:07:04.898936 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 20:07:05.051146 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 20:07:05.250254 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 20:07:05.366046 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 20:07:05.526210 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 20:07:05.664306 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 20:07:05.855353 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 20:07:05.959266 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 20:07:06.130168 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 20:07:06.234123 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 20:07:06.391435 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 20:07:06.505109 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 20:07:06.711789 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 20:07:06.859855 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Feb 19 20:07:06.968182 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Feb 19 20:07:07.122364 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Feb 19 20:07:07.270628 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Feb 19 20:07:07.439233 osdx OSDxCLI[266357]: User 'admin' added a new cfg line: 'show changes'. Feb 19 20:07:07.655254 osdx INFO[267217]: FRR daemons did not change Feb 19 20:07:07.978227 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Feb 19 20:07:08.034047 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Feb 19 20:07:10.035129 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Feb 19 20:07:10.035322 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Feb 19 20:07:10.035371 osdx systemd[1]: suricata@FW.service: Consumed 2.177s CPU time. Feb 19 20:07:10.060204 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 20:07:10.115722 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 20:07:10.980487 osdx INFO[267243]: Rules successfully loaded Feb 19 20:07:10.983494 osdx cfgd[1455]: [266357]Completed change to active configuration Feb 19 20:07:10.989272 osdx OSDxCLI[266357]: User 'admin' committed the configuration. Feb 19 20:07:11.045592 osdx OSDxCLI[266357]: User 'admin' left the configuration menu. Feb 19 20:07:11.515772 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=61852 DF PROTO=TCP SPT=39804 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 19 20:07:11.531707 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=63299 DF PROTO=TCP SPT=39808 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 19 20:07:22.061334 osdx OSDxCLI[266357]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 647 0 --:--:-- --:--:-- --:--:-- 645
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.894 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.894/0.894/0.894/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.764 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.764/0.764/0.764/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 33610 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 9.47 MBytes 79.4 Mbits/sec 0 518 KBytes [ 5] 1.00-2.00 sec 3.65 MBytes 30.7 Mbits/sec 0 634 KBytes [ 5] 2.00-3.00 sec 7.50 MBytes 62.9 Mbits/sec 1 921 KBytes [ 5] 3.00-4.00 sec 8.75 MBytes 73.4 Mbits/sec 1 1.30 MBytes [ 5] 4.00-5.00 sec 26.2 MBytes 220 Mbits/sec 0 2.28 MBytes [ 5] 5.00-6.00 sec 28.8 MBytes 241 Mbits/sec 231 1.26 MBytes [ 5] 6.00-7.00 sec 53.8 MBytes 451 Mbits/sec 0 1.34 MBytes [ 5] 7.00-8.00 sec 51.2 MBytes 429 Mbits/sec 0 1.40 MBytes [ 5] 8.00-9.00 sec 43.8 MBytes 368 Mbits/sec 0 1.45 MBytes [ 5] 9.00-10.00 sec 56.2 MBytes 472 Mbits/sec 0 1.48 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 289 MBytes 243 Mbits/sec 233 sender [ 5] 0.00-10.03 sec 287 MBytes 241 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-20:07:56.460267 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33598 -> 40.0.0.2:5001 02/19/2025-20:07:56.463361 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33610 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=33610 dport=5001 packets=209498 bytes=314237853 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=33610 packets=14261 bytes=734464 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 18 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=480 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=480 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 18 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=109 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=109 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=33598 dport=5001 packets=14 bytes=1197 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=33598 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 38584 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 49.6 MBytes 416 Mbits/sec 0 2.16 MBytes [ 5] 1.00-2.00 sec 21.2 MBytes 178 Mbits/sec 57 1.80 MBytes [ 5] 2.00-3.00 sec 70.0 MBytes 589 Mbits/sec 280 1.36 MBytes [ 5] 3.00-4.00 sec 75.0 MBytes 629 Mbits/sec 0 1.44 MBytes [ 5] 4.00-5.01 sec 48.8 MBytes 405 Mbits/sec 0 1.50 MBytes [ 5] 5.01-6.00 sec 51.2 MBytes 434 Mbits/sec 0 1.53 MBytes [ 5] 6.00-7.00 sec 65.0 MBytes 545 Mbits/sec 0 1.56 MBytes [ 5] 7.00-8.00 sec 20.0 MBytes 168 Mbits/sec 1 1.41 KBytes [ 5] 8.00-9.00 sec 0.00 Bytes 0.00 bits/sec 2 1.41 KBytes [ 5] 9.00-10.00 sec 0.00 Bytes 0.00 bits/sec 0 1.41 KBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 401 MBytes 336 Mbits/sec 340 sender [ 5] 0.00-10.23 sec 399 MBytes 327 Mbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-20:07:56.460267 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33598 -> 40.0.0.2:5001 02/19/2025-20:07:56.463361 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33610 -> 40.0.0.2:5001 02/19/2025-20:08:13.203320 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38576 -> 40.0.0.2:5001 02/19/2025-20:08:13.205389 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38584 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=38584 dport=5001 packets=289708 bytes=434553357 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=38584 packets=18016 bytes=940776 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=38576 dport=5001 packets=15 bytes=1249 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=38576 packets=14 bytes=1082 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 10165 0 --:--:-- --:--:-- --:--:-- 10526
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=7.31 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 7.307/7.307/7.307/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.812 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.812/0.812/0.812/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2025-20:09:00.687168 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51162 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 25 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=112 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=112 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=51162 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=51162 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 25 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=483 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=483 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 5 8 263 491 2 - 3 3 228 228 ------------------------------------------------------------------ Total 8 8 491 491 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2025-20:09:00.687168 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51162 -> 40.0.0.2:5000 02/19/2025-20:09:08.887439 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51162 -> 40.0.0.2:5000 02/19/2025-20:09:11.382133 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46880 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=46880 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=46880 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 5 7 263 376 2 - 2 2 113 113 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 10 499 740 2 - 4 4 241 241 --------------------------------------------------------------------- Total 10 10 740 740
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 32290 0 --:--:-- --:--:-- --:--:-- 43000
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=3.75 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 3.753/3.753/3.753/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.916 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.916/0.916/0.916/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-20:09:50.242451 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51860 -> 40.0.0.2:5001 02/19/2025-20:09:50.265123 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51874 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 28 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=115 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=115 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 28 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=486 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=486 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=51874 dport=5001 packets=5625 bytes=8433201 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=51874 packets=1162 bytes=60432 [ASSURED] [OFFLOAD, packets=5612 bytes=8418000 packets=1160 bytes=60320] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=51860 dport=5001 packets=8 bytes=601 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=51860 packets=8 bytes=429 [ASSURED] [OFFLOAD, packets=5 bytes=400 packets=5 bytes=264] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 2232 0 --:--:-- --:--:-- --:--:-- 2254
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
02/19/2025-20:09:50.242451 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51860 -> 40.0.0.2:5001 02/19/2025-20:09:50.265123 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51874 -> 40.0.0.2:5001 02/19/2025-20:09:55.547305 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41824 -> 40.0.0.2:5001 02/19/2025-20:09:55.552829 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:58214 -> 40.0.0.2:5001 02/19/2025-20:09:55.563734 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:58214 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
udp 17 src=20.0.0.2 dst=40.0.0.2 sport=58214 dport=5001 packets=42 bytes=60548 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=58214 packets=1 bytes=32 [OFFLOAD, packets=39 bytes=57564 packets=0 bytes=0] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=41824 dport=5001 packets=7 bytes=555 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=41824 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=4 bytes=354 packets=4 bytes=211] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 53864 0 --:--:-- --:--:-- --:--:-- 66666
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.68 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.678/1.678/1.678/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=4.65 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 4.647/4.647/4.647/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2025-20:10:29.311189 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51786 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 51786 yes 201 0 0 0 20.0.0.2 40.0.0.2 51786 5000 yes 201 0 10 789
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250168s ending at 1739995833.769586 XDP_DROP 10 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 15 pkts ( 0 pps) 1 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
02/19/2025-20:10:29.311189 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51786 -> 40.0.0.2:5000 02/19/2025-20:10:34.153836 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:55389 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 55389 no 201 0 0 0 40.0.0.2 20.0.0.2 5000 51786 yes 201 0 0 0 20.0.0.2 40.0.0.2 51786 5000 yes 201 0 12 905 20.0.0.2 40.0.0.2 55389 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250255s ending at 1739995838.520312 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 34 pkts ( 0 pps) 2 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)