Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 21794 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.879 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.879/0.879/0.879/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.667 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.667/0.667/0.667/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 55270 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 44.2 MBytes 371 Mbits/sec 0 2.21 MBytes [ 5] 1.00-2.00 sec 45.0 MBytes 378 Mbits/sec 27 1.82 MBytes [ 5] 2.00-3.00 sec 43.8 MBytes 367 Mbits/sec 37 1.39 MBytes [ 5] 3.00-4.00 sec 45.0 MBytes 377 Mbits/sec 0 1.47 MBytes [ 5] 4.00-5.00 sec 43.8 MBytes 367 Mbits/sec 0 1.54 MBytes [ 5] 5.00-6.00 sec 66.2 MBytes 556 Mbits/sec 0 1.59 MBytes [ 5] 6.00-7.00 sec 95.0 MBytes 797 Mbits/sec 0 1.62 MBytes [ 5] 7.00-8.00 sec 76.2 MBytes 640 Mbits/sec 0 1.64 MBytes [ 5] 8.00-9.00 sec 75.0 MBytes 629 Mbits/sec 0 1.64 MBytes [ 5] 9.00-10.00 sec 53.8 MBytes 451 Mbits/sec 0 1.65 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 588 MBytes 493 Mbits/sec 64 sender [ 5] 0.00-10.01 sec 586 MBytes 491 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/18/2025-13:16:18.364871 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55260 -> 40.0.0.2:5001 03/18/2025-13:16:18.366469 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55270 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 21564 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.739 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.739/0.739/0.739/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.782 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.782/0.782/0.782/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 46014 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 75.0 MBytes 629 Mbits/sec 202 1.68 MBytes [ 5] 1.00-2.00 sec 146 MBytes 1.23 Gbits/sec 0 1.86 MBytes [ 5] 2.00-3.00 sec 154 MBytes 1.29 Gbits/sec 0 2.00 MBytes [ 5] 3.00-4.00 sec 160 MBytes 1.34 Gbits/sec 65 1.49 MBytes [ 5] 4.00-5.00 sec 170 MBytes 1.43 Gbits/sec 0 1.58 MBytes [ 5] 5.00-6.00 sec 155 MBytes 1.30 Gbits/sec 0 1.65 MBytes [ 5] 6.00-7.00 sec 158 MBytes 1.32 Gbits/sec 0 1.70 MBytes [ 5] 7.00-8.00 sec 165 MBytes 1.38 Gbits/sec 0 1.73 MBytes [ 5] 8.00-9.00 sec 164 MBytes 1.37 Gbits/sec 0 1.78 MBytes [ 5] 9.00-10.00 sec 168 MBytes 1.41 Gbits/sec 0 1.85 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.48 GBytes 1.27 Gbits/sec 267 sender [ 5] 0.00-10.01 sec 1.48 GBytes 1.27 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/18/2025-13:16:55.765175 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46006 -> 40.0.0.2:5001 03/18/2025-13:16:55.766628 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46014 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Mar 18 13:16:45.058958 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service. Mar 18 13:16:45.000515 osdx systemd-timedated[264747]: Changed local time to Tue 2025-03-18 13:16:45 UTC Mar 18 13:16:45.002164 osdx systemd-journald[1668]: Time jumped backwards, rotating. Mar 18 13:16:45.002755 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'set date 2025-03-18 13:16:45'. Mar 18 13:16:45.434098 osdx systemd-journald[1668]: Runtime Journal (/run/log/journal/72104842365c481ca7f4174cfa44e1fe) is 2.1M, max 15.3M, 13.2M free. Mar 18 13:16:45.434642 osdx systemd-journald[1668]: Received client request to rotate journal, rotating. Mar 18 13:16:45.434695 osdx systemd-journald[1668]: Vacuuming done, freed 0B of archived journals from /run/log/journal/72104842365c481ca7f4174cfa44e1fe. Mar 18 13:16:45.448149 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'system journal clear'. Mar 18 13:16:45.882097 osdx osdx-coredump[264765]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Mar 18 13:16:45.892512 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'system coredump delete all'. Mar 18 13:16:46.507911 osdx OSDxCLI[264407]: User 'admin' entered the configuration menu. Mar 18 13:16:46.649719 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Mar 18 13:16:46.728977 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Mar 18 13:16:46.816106 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Mar 18 13:16:46.906035 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Mar 18 13:16:46.999784 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Mar 18 13:16:47.084888 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Mar 18 13:16:47.197311 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'show working'. Mar 18 13:16:47.324398 osdx INFO[264795]: FRR daemons did not change Mar 18 13:16:47.350164 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Mar 18 13:16:47.454150 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Mar 18 13:16:47.492613 osdx (udev-worker)[264898]: Network interface NamePolicy= disabled on kernel command line. Mar 18 13:16:47.739004 osdx cfgd[1456]: [264407]Completed change to active configuration Mar 18 13:16:47.775174 osdx OSDxCLI[264407]: User 'admin' committed the configuration. Mar 18 13:16:47.819881 osdx OSDxCLI[264407]: User 'admin' left the configuration menu. Mar 18 13:16:50.768536 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Mar 18 13:16:50.886864 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Mar 18 13:16:51.006318 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Mar 18 13:16:51.640642 osdx file_operation[264986]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Mar 18 13:16:51.671810 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Mar 18 13:16:51.846333 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Mar 18 13:16:52.043137 osdx OSDxCLI[264407]: User 'admin' entered the configuration menu. Mar 18 13:16:52.140840 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Mar 18 13:16:52.231131 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Mar 18 13:16:52.321500 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Mar 18 13:16:52.410653 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Mar 18 13:16:52.501972 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Mar 18 13:16:52.618325 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Mar 18 13:16:52.741923 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Mar 18 13:16:52.822823 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Mar 18 13:16:52.910578 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Mar 18 13:16:53.000481 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Mar 18 13:16:53.088293 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Mar 18 13:16:53.210651 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Mar 18 13:16:53.299983 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Mar 18 13:16:53.415616 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Mar 18 13:16:53.506022 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Mar 18 13:16:53.629902 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Mar 18 13:16:53.711826 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Mar 18 13:16:53.851739 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Mar 18 13:16:53.927611 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Mar 18 13:16:54.042914 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Mar 18 13:16:54.185602 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'show working'. Mar 18 13:16:54.367092 osdx INFO[265072]: FRR daemons did not change Mar 18 13:16:54.629075 osdx systemd[1]: Reloading. Mar 18 13:16:54.798148 osdx systemd-sysv-generator[265125]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Mar 18 13:16:54.958708 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Mar 18 13:16:54.981229 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Mar 18 13:16:55.251391 osdx INFO[265107]: Rules successfully loaded Mar 18 13:16:55.252366 osdx cfgd[1456]: [264407]Completed change to active configuration Mar 18 13:16:55.254911 osdx OSDxCLI[264407]: User 'admin' committed the configuration. Mar 18 13:16:55.284930 osdx OSDxCLI[264407]: User 'admin' left the configuration menu. Mar 18 13:16:55.766161 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=45727 DF PROTO=TCP SPT=46006 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 18 13:16:55.771084 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=2111 DF PROTO=TCP SPT=46014 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 18 13:17:06.102612 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 35576 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 160 MBytes 1.34 Gbits/sec 93 1.87 MBytes [ 5] 1.00-2.00 sec 161 MBytes 1.35 Gbits/sec 0 2.04 MBytes [ 5] 2.00-3.00 sec 165 MBytes 1.38 Gbits/sec 32 1.52 MBytes [ 5] 3.00-4.00 sec 176 MBytes 1.48 Gbits/sec 0 1.62 MBytes [ 5] 4.00-5.00 sec 168 MBytes 1.41 Gbits/sec 0 1.69 MBytes [ 5] 5.00-6.00 sec 164 MBytes 1.37 Gbits/sec 0 1.75 MBytes [ 5] 6.00-7.00 sec 166 MBytes 1.39 Gbits/sec 0 1.79 MBytes [ 5] 7.00-8.00 sec 194 MBytes 1.63 Gbits/sec 0 1.83 MBytes [ 5] 8.00-9.00 sec 181 MBytes 1.52 Gbits/sec 0 1.89 MBytes [ 5] 9.00-10.00 sec 168 MBytes 1.40 Gbits/sec 0 1.94 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.66 GBytes 1.43 Gbits/sec 125 sender [ 5] 0.00-10.01 sec 1.66 GBytes 1.43 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/18/2025-13:16:55.765175 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46006 -> 40.0.0.2:5001 03/18/2025-13:16:55.766628 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46014 -> 40.0.0.2:5001 03/18/2025-13:17:11.716605 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35562 -> 40.0.0.2:5001 03/18/2025-13:17:11.718309 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35576 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Mar 18 13:16:45.058958 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service. Mar 18 13:16:45.000515 osdx systemd-timedated[264747]: Changed local time to Tue 2025-03-18 13:16:45 UTC Mar 18 13:16:45.002164 osdx systemd-journald[1668]: Time jumped backwards, rotating. Mar 18 13:16:45.002755 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'set date 2025-03-18 13:16:45'. Mar 18 13:16:45.434098 osdx systemd-journald[1668]: Runtime Journal (/run/log/journal/72104842365c481ca7f4174cfa44e1fe) is 2.1M, max 15.3M, 13.2M free. Mar 18 13:16:45.434642 osdx systemd-journald[1668]: Received client request to rotate journal, rotating. Mar 18 13:16:45.434695 osdx systemd-journald[1668]: Vacuuming done, freed 0B of archived journals from /run/log/journal/72104842365c481ca7f4174cfa44e1fe. Mar 18 13:16:45.448149 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'system journal clear'. Mar 18 13:16:45.882097 osdx osdx-coredump[264765]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Mar 18 13:16:45.892512 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'system coredump delete all'. Mar 18 13:16:46.507911 osdx OSDxCLI[264407]: User 'admin' entered the configuration menu. Mar 18 13:16:46.649719 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Mar 18 13:16:46.728977 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Mar 18 13:16:46.816106 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Mar 18 13:16:46.906035 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Mar 18 13:16:46.999784 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Mar 18 13:16:47.084888 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Mar 18 13:16:47.197311 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'show working'. Mar 18 13:16:47.324398 osdx INFO[264795]: FRR daemons did not change Mar 18 13:16:47.350164 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Mar 18 13:16:47.454150 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Mar 18 13:16:47.492613 osdx (udev-worker)[264898]: Network interface NamePolicy= disabled on kernel command line. Mar 18 13:16:47.739004 osdx cfgd[1456]: [264407]Completed change to active configuration Mar 18 13:16:47.775174 osdx OSDxCLI[264407]: User 'admin' committed the configuration. Mar 18 13:16:47.819881 osdx OSDxCLI[264407]: User 'admin' left the configuration menu. Mar 18 13:16:50.768536 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Mar 18 13:16:50.886864 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Mar 18 13:16:51.006318 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Mar 18 13:16:51.640642 osdx file_operation[264986]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Mar 18 13:16:51.671810 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Mar 18 13:16:51.846333 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Mar 18 13:16:52.043137 osdx OSDxCLI[264407]: User 'admin' entered the configuration menu. Mar 18 13:16:52.140840 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Mar 18 13:16:52.231131 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Mar 18 13:16:52.321500 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Mar 18 13:16:52.410653 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Mar 18 13:16:52.501972 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Mar 18 13:16:52.618325 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Mar 18 13:16:52.741923 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Mar 18 13:16:52.822823 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Mar 18 13:16:52.910578 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Mar 18 13:16:53.000481 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Mar 18 13:16:53.088293 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Mar 18 13:16:53.210651 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Mar 18 13:16:53.299983 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Mar 18 13:16:53.415616 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Mar 18 13:16:53.506022 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Mar 18 13:16:53.629902 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Mar 18 13:16:53.711826 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Mar 18 13:16:53.851739 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Mar 18 13:16:53.927611 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Mar 18 13:16:54.042914 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Mar 18 13:16:54.185602 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'show working'. Mar 18 13:16:54.367092 osdx INFO[265072]: FRR daemons did not change Mar 18 13:16:54.629075 osdx systemd[1]: Reloading. Mar 18 13:16:54.798148 osdx systemd-sysv-generator[265125]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Mar 18 13:16:54.958708 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Mar 18 13:16:54.981229 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Mar 18 13:16:55.251391 osdx INFO[265107]: Rules successfully loaded Mar 18 13:16:55.252366 osdx cfgd[1456]: [264407]Completed change to active configuration Mar 18 13:16:55.254911 osdx OSDxCLI[264407]: User 'admin' committed the configuration. Mar 18 13:16:55.284930 osdx OSDxCLI[264407]: User 'admin' left the configuration menu. Mar 18 13:16:55.766161 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=45727 DF PROTO=TCP SPT=46006 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 18 13:16:55.771084 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=2111 DF PROTO=TCP SPT=46014 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 18 13:17:06.102612 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Mar 18 13:17:06.233212 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'system journal show | cat'. Mar 18 13:17:06.468140 osdx OSDxCLI[264407]: User 'admin' entered the configuration menu. Mar 18 13:17:06.564247 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Mar 18 13:17:06.698708 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Mar 18 13:17:06.788744 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Mar 18 13:17:06.907892 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Mar 18 13:17:06.998565 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Mar 18 13:17:07.088869 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Mar 18 13:17:07.211200 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Mar 18 13:17:07.289555 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Mar 18 13:17:07.375083 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Mar 18 13:17:07.463700 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Mar 18 13:17:07.549330 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Mar 18 13:17:07.665859 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Mar 18 13:17:07.757004 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Mar 18 13:17:07.875732 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Mar 18 13:17:07.958530 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Mar 18 13:17:08.050173 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Mar 18 13:17:08.138564 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Mar 18 13:17:08.252997 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Mar 18 13:17:08.345907 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Mar 18 13:17:08.435133 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Mar 18 13:17:08.523856 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Mar 18 13:17:08.611109 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Mar 18 13:17:08.700995 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Mar 18 13:17:08.796136 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Mar 18 13:17:08.919042 osdx OSDxCLI[264407]: User 'admin' added a new cfg line: 'show changes'. Mar 18 13:17:09.059322 osdx INFO[265267]: FRR daemons did not change Mar 18 13:17:09.346577 osdx systemd[1]: Starting logrotate.service - Rotate log files... Mar 18 13:17:09.348733 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Mar 18 13:17:09.387143 osdx systemd[1]: logrotate.service: Deactivated successfully. Mar 18 13:17:09.387315 osdx systemd[1]: Finished logrotate.service - Rotate log files. Mar 18 13:17:11.104178 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Mar 18 13:17:11.104306 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Mar 18 13:17:11.104339 osdx systemd[1]: suricata@FW.service: Consumed 1.857s CPU time. Mar 18 13:17:11.122638 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Mar 18 13:17:11.145841 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Mar 18 13:17:11.408917 osdx INFO[265292]: Rules successfully loaded Mar 18 13:17:11.409842 osdx cfgd[1456]: [264407]Completed change to active configuration Mar 18 13:17:11.412682 osdx OSDxCLI[264407]: User 'admin' committed the configuration. Mar 18 13:17:11.438019 osdx OSDxCLI[264407]: User 'admin' left the configuration menu. Mar 18 13:17:11.718181 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=8870 DF PROTO=TCP SPT=35562 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Mar 18 13:17:11.722217 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=38907 DF PROTO=TCP SPT=35576 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Mar 18 13:17:15.031771 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Mar 18 13:17:22.066638 osdx OSDxCLI[264407]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 47531 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.706 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.706/0.706/0.706/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.681 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.681/0.681/0.681/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 33136 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 94.5 MBytes 793 Mbits/sec 429 1.22 MBytes [ 5] 1.00-2.00 sec 146 MBytes 1.23 Gbits/sec 0 1.31 MBytes [ 5] 2.00-3.00 sec 151 MBytes 1.27 Gbits/sec 0 1.37 MBytes [ 5] 3.00-4.00 sec 164 MBytes 1.37 Gbits/sec 0 1.43 MBytes [ 5] 4.00-5.00 sec 164 MBytes 1.37 Gbits/sec 0 1.51 MBytes [ 5] 5.00-6.00 sec 175 MBytes 1.47 Gbits/sec 0 1.57 MBytes [ 5] 6.00-7.00 sec 185 MBytes 1.55 Gbits/sec 0 1.63 MBytes [ 5] 7.00-8.00 sec 166 MBytes 1.39 Gbits/sec 0 1.69 MBytes [ 5] 8.00-9.00 sec 170 MBytes 1.43 Gbits/sec 0 1.76 MBytes [ 5] 9.00-10.00 sec 179 MBytes 1.50 Gbits/sec 0 1.82 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.56 GBytes 1.34 Gbits/sec 429 sender [ 5] 0.00-10.01 sec 1.55 GBytes 1.33 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/18/2025-13:17:49.841218 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33122 -> 40.0.0.2:5001 03/18/2025-13:17:49.843150 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33136 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=33136 dport=5001 packets=1154582 bytes=1731867253 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=33136 packets=190103 bytes=9877172 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=75 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=75 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=393 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=393 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=33122 dport=5001 packets=17 bytes=1647 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=33122 packets=15 bytes=1134 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 49930 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 165 MBytes 1.38 Gbits/sec 9 1.67 MBytes [ 5] 1.00-2.00 sec 158 MBytes 1.32 Gbits/sec 0 1.81 MBytes [ 5] 2.00-3.00 sec 156 MBytes 1.31 Gbits/sec 0 1.93 MBytes [ 5] 3.00-4.00 sec 169 MBytes 1.42 Gbits/sec 0 2.02 MBytes [ 5] 4.00-5.00 sec 170 MBytes 1.43 Gbits/sec 486 1.50 MBytes [ 5] 5.00-6.00 sec 180 MBytes 1.51 Gbits/sec 0 1.58 MBytes [ 5] 6.00-7.00 sec 168 MBytes 1.41 Gbits/sec 0 1.65 MBytes [ 5] 7.00-8.00 sec 170 MBytes 1.43 Gbits/sec 0 1.70 MBytes [ 5] 8.00-9.00 sec 200 MBytes 1.68 Gbits/sec 0 1.77 MBytes [ 5] 9.00-10.00 sec 169 MBytes 1.42 Gbits/sec 0 1.83 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.66 GBytes 1.43 Gbits/sec 495 sender [ 5] 0.00-10.01 sec 1.66 GBytes 1.43 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/18/2025-13:17:49.841218 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33122 -> 40.0.0.2:5001 03/18/2025-13:17:49.843150 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33136 -> 40.0.0.2:5001 03/18/2025-13:18:04.599487 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49920 -> 40.0.0.2:5001 03/18/2025-13:18:04.600964 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49930 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=49920 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49920 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=49930 dport=5001 packets=1233997 bytes=1850989761 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49930 packets=193391 bytes=10050976 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 23215 0 --:--:-- --:--:-- --:--:-- 25000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.899 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.899/0.899/0.899/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.853 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.853/0.853/0.853/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
03/18/2025-13:18:40.858128 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59368 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=78 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=78 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=59368 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=59368 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=396 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=396 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
03/18/2025-13:18:40.858128 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59368 -> 40.0.0.2:5000 03/18/2025-13:18:47.097265 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59368 -> 40.0.0.2:5000 03/18/2025-13:18:48.103380 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59368 -> 40.0.0.2:5000 03/18/2025-13:18:49.705589 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49136 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=49136 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=49136 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 780 2 - 5 5 281 281 --------------------------------------------------------------------- Total 11 11 780 780
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 19023 0 --:--:-- --:--:-- --:--:-- 21500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.637 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.637/0.637/0.637/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.634 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.634/0.634/0.634/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/18/2025-13:19:19.960675 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53308 -> 40.0.0.2:5001 03/18/2025-13:19:19.962413 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53320 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=399 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=399 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53320 dport=5001 packets=13305 bytes=19951753 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53320 packets=2053 bytes=106764 [ASSURED] [OFFLOAD, packets=13292 bytes=19936552 packets=2051 bytes=106652] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=81 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=81 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53308 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53308 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 18327 0 --:--:-- --:--:-- --:--:-- 19000
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
03/18/2025-13:19:19.960675 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53308 -> 40.0.0.2:5001 03/18/2025-13:19:19.962413 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53320 -> 40.0.0.2:5001 03/18/2025-13:19:23.068142 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53328 -> 40.0.0.2:5001 03/18/2025-13:19:23.070160 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:33238 -> 40.0.0.2:5001 03/18/2025-13:19:23.080766 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:33238 -> 40.0.0.2:5001 03/18/2025-13:19:23.092802 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:33238 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53328 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53328 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=33238 dport=5001 packets=24 bytes=33980 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=33238 packets=1 bytes=32 [OFFLOAD, packets=20 bytes=29520 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 33772 0 --:--:-- --:--:-- --:--:-- 40000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.811 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.811/0.811/0.811/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.807 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.807/0.807/0.807/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
03/18/2025-13:19:48.629262 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42922 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 42922 5000 yes 201 0 9 731 40.0.0.2 20.0.0.2 5000 42922 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250167s ending at 1742303992.564141 XDP_DROP 10 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 6424755 pkts ( 8 pps) 8259712 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
03/18/2025-13:19:48.629262 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42922 -> 40.0.0.2:5000 03/18/2025-13:19:52.822957 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:50592 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 42922 5000 yes 201 0 12 905 40.0.0.2 20.0.0.2 5000 42922 yes 201 0 0 0 20.0.0.2 40.0.0.2 50592 5001 no 201 0 0 0 40.0.0.2 20.0.0.2 5001 50592 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250130s ending at 1742303996.730990 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 6424793 pkts ( 0 pps) 8259715 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)