Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 21968 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.561 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.561/0.561/0.561/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.440 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.440/0.440/0.440/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 58382 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 46.0 MBytes 386 Mbits/sec 0 1.71 MBytes [ 5] 1.00-2.00 sec 46.2 MBytes 388 Mbits/sec 171 1.73 MBytes [ 5] 2.00-3.00 sec 85.0 MBytes 713 Mbits/sec 0 1.91 MBytes [ 5] 3.00-4.00 sec 100 MBytes 839 Mbits/sec 0 2.06 MBytes [ 5] 4.00-5.00 sec 101 MBytes 849 Mbits/sec 0 2.18 MBytes [ 5] 5.00-6.00 sec 102 MBytes 860 Mbits/sec 0 2.27 MBytes [ 5] 6.00-7.00 sec 102 MBytes 860 Mbits/sec 0 2.34 MBytes [ 5] 7.00-8.00 sec 100 MBytes 839 Mbits/sec 24 1.71 MBytes [ 5] 8.00-9.00 sec 104 MBytes 870 Mbits/sec 0 1.81 MBytes [ 5] 9.00-10.00 sec 60.0 MBytes 503 Mbits/sec 0 1.88 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 847 MBytes 711 Mbits/sec 195 sender [ 5] 0.00-10.02 sec 846 MBytes 708 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/26/2025-12:52:21.991776 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58366 -> 40.0.0.2:5001 05/26/2025-12:52:21.993263 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58382 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 24225 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.525 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.525/0.525/0.525/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.517 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.517/0.517/0.517/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 37850 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 34.4 MBytes 288 Mbits/sec 1 320 KBytes [ 5] 1.00-2.00 sec 111 MBytes 933 Mbits/sec 36 1.60 MBytes [ 5] 2.00-3.00 sec 265 MBytes 2.22 Gbits/sec 0 1.76 MBytes [ 5] 3.00-4.00 sec 266 MBytes 2.23 Gbits/sec 0 1.89 MBytes [ 5] 4.00-5.00 sec 274 MBytes 2.30 Gbits/sec 0 2.00 MBytes [ 5] 5.00-6.00 sec 202 MBytes 1.70 Gbits/sec 0 2.06 MBytes [ 5] 6.00-7.00 sec 270 MBytes 2.27 Gbits/sec 0 2.13 MBytes [ 5] 7.00-8.00 sec 258 MBytes 2.16 Gbits/sec 310 1.55 MBytes [ 5] 8.00-9.00 sec 179 MBytes 1.50 Gbits/sec 11 1.77 MBytes [ 5] 9.00-10.00 sec 270 MBytes 2.27 Gbits/sec 0 1.94 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.08 GBytes 1.79 Gbits/sec 358 sender [ 5] 0.00-10.00 sec 2.08 GBytes 1.78 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/26/2025-12:52:56.728596 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:37848 -> 40.0.0.2:5001 05/26/2025-12:52:56.729542 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:37850 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 26 12:52:46.345826 osdx systemd-journald[1847]: Runtime Journal (/run/log/journal/f6c1fe6bbcb147bb817825fa9dee7ff8) is 1.9M, max 15.3M, 13.4M free. May 26 12:52:46.348274 osdx systemd-journald[1847]: Received client request to rotate journal, rotating. May 26 12:52:46.348340 osdx systemd-journald[1847]: Vacuuming done, freed 0B of archived journals from /run/log/journal/f6c1fe6bbcb147bb817825fa9dee7ff8. May 26 12:52:46.356113 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'system journal clear'. May 26 12:52:46.677682 osdx osdx-coredump[228936]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 26 12:52:46.685484 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'system coredump delete all'. May 26 12:52:47.157106 osdx OSDxCLI[228589]: User 'admin' entered the configuration menu. May 26 12:52:47.238318 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 26 12:52:47.334039 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 26 12:52:47.402566 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 26 12:52:47.511546 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 26 12:52:47.572103 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 26 12:52:47.667497 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 26 12:52:47.739868 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'show working'. May 26 12:52:47.847682 osdx INFO[228962]: FRR daemons did not change May 26 12:52:47.868254 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 26 12:52:47.952252 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 26 12:52:47.978101 osdx (udev-worker)[229061]: Network interface NamePolicy= disabled on kernel command line. May 26 12:52:48.030401 osdx (udev-worker)[229068]: Network interface NamePolicy= disabled on kernel command line. May 26 12:52:48.185399 osdx cfgd[1653]: [228589]Completed change to active configuration May 26 12:52:48.216810 osdx OSDxCLI[228589]: User 'admin' committed the configuration. May 26 12:52:48.263347 osdx OSDxCLI[228589]: User 'admin' left the configuration menu. May 26 12:52:50.450126 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 26 12:52:50.549067 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 26 12:52:50.630313 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 26 12:52:51.131241 osdx file_operation[229153]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 26 12:52:51.155811 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 26 12:52:51.291719 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 26 12:52:51.454306 osdx OSDxCLI[228589]: User 'admin' entered the configuration menu. May 26 12:52:51.517186 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 26 12:52:51.617196 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 26 12:52:51.672356 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 26 12:52:51.770771 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 26 12:52:51.835508 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 26 12:52:51.938785 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 26 12:52:52.023823 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 26 12:52:52.096593 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 26 12:52:52.194354 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 26 12:52:52.253512 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 26 12:52:52.353499 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 26 12:52:52.413365 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 26 12:52:52.630553 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 26 12:52:52.688300 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 26 12:52:52.786562 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 26 12:52:52.851810 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 26 12:52:52.942140 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 26 12:52:53.867773 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 26 12:52:53.933897 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 26 12:52:54.062270 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 26 12:52:54.165769 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'show working'. May 26 12:52:54.331348 osdx INFO[229235]: FRR daemons did not change May 26 12:52:54.590916 osdx systemd[1]: Reloading. May 26 12:52:54.724258 osdx systemd-sysv-generator[229287]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 26 12:52:54.848523 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 26 12:52:54.870888 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 26 12:52:55.080052 osdx INFO[229270]: Rules successfully loaded May 26 12:52:55.080795 osdx cfgd[1653]: [228589]Completed change to active configuration May 26 12:52:56.329932 osdx OSDxCLI[228589]: User 'admin' committed the configuration. May 26 12:52:56.345794 osdx OSDxCLI[228589]: User 'admin' left the configuration menu. May 26 12:52:56.734027 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=29431 DF PROTO=TCP SPT=37848 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 26 12:52:56.734120 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=40926 DF PROTO=TCP SPT=37850 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 26 12:53:06.872601 osdx systemd[1]: Starting logrotate.service - Rotate log files... May 26 12:53:06.896966 osdx systemd[1]: logrotate.service: Deactivated successfully. May 26 12:53:06.897077 osdx systemd[1]: Finished logrotate.service - Rotate log files. May 26 12:53:07.038417 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 58792 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 220 MBytes 1.85 Gbits/sec 107 1.29 MBytes [ 5] 1.00-2.00 sec 246 MBytes 2.07 Gbits/sec 0 1.42 MBytes [ 5] 2.00-3.00 sec 260 MBytes 2.18 Gbits/sec 0 1.55 MBytes [ 5] 3.00-4.00 sec 281 MBytes 2.36 Gbits/sec 0 1.66 MBytes [ 5] 4.00-5.00 sec 262 MBytes 2.20 Gbits/sec 161 1.31 MBytes [ 5] 5.00-6.00 sec 75.0 MBytes 629 Mbits/sec 1 1.39 MBytes [ 5] 6.00-7.00 sec 93.8 MBytes 787 Mbits/sec 503 867 KBytes [ 5] 7.00-8.00 sec 281 MBytes 2.36 Gbits/sec 0 1.17 MBytes [ 5] 8.00-9.00 sec 265 MBytes 2.22 Gbits/sec 0 1.45 MBytes [ 5] 9.00-10.00 sec 225 MBytes 1.89 Gbits/sec 0 1.69 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.16 GBytes 1.85 Gbits/sec 772 sender [ 5] 0.00-10.00 sec 2.16 GBytes 1.85 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/26/2025-12:52:56.728596 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:37848 -> 40.0.0.2:5001 05/26/2025-12:52:56.729542 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:37850 -> 40.0.0.2:5001 05/26/2025-12:53:12.332662 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58788 -> 40.0.0.2:5001 05/26/2025-12:53:12.333778 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58792 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 26 12:52:46.345826 osdx systemd-journald[1847]: Runtime Journal (/run/log/journal/f6c1fe6bbcb147bb817825fa9dee7ff8) is 1.9M, max 15.3M, 13.4M free. May 26 12:52:46.348274 osdx systemd-journald[1847]: Received client request to rotate journal, rotating. May 26 12:52:46.348340 osdx systemd-journald[1847]: Vacuuming done, freed 0B of archived journals from /run/log/journal/f6c1fe6bbcb147bb817825fa9dee7ff8. May 26 12:52:46.356113 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'system journal clear'. May 26 12:52:46.677682 osdx osdx-coredump[228936]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 26 12:52:46.685484 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'system coredump delete all'. May 26 12:52:47.157106 osdx OSDxCLI[228589]: User 'admin' entered the configuration menu. May 26 12:52:47.238318 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 26 12:52:47.334039 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 26 12:52:47.402566 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 26 12:52:47.511546 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 26 12:52:47.572103 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 26 12:52:47.667497 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 26 12:52:47.739868 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'show working'. May 26 12:52:47.847682 osdx INFO[228962]: FRR daemons did not change May 26 12:52:47.868254 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 26 12:52:47.952252 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 26 12:52:47.978101 osdx (udev-worker)[229061]: Network interface NamePolicy= disabled on kernel command line. May 26 12:52:48.030401 osdx (udev-worker)[229068]: Network interface NamePolicy= disabled on kernel command line. May 26 12:52:48.185399 osdx cfgd[1653]: [228589]Completed change to active configuration May 26 12:52:48.216810 osdx OSDxCLI[228589]: User 'admin' committed the configuration. May 26 12:52:48.263347 osdx OSDxCLI[228589]: User 'admin' left the configuration menu. May 26 12:52:50.450126 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 26 12:52:50.549067 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 26 12:52:50.630313 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 26 12:52:51.131241 osdx file_operation[229153]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 26 12:52:51.155811 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 26 12:52:51.291719 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 26 12:52:51.454306 osdx OSDxCLI[228589]: User 'admin' entered the configuration menu. May 26 12:52:51.517186 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 26 12:52:51.617196 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 26 12:52:51.672356 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 26 12:52:51.770771 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 26 12:52:51.835508 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 26 12:52:51.938785 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 26 12:52:52.023823 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 26 12:52:52.096593 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 26 12:52:52.194354 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 26 12:52:52.253512 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 26 12:52:52.353499 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 26 12:52:52.413365 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 26 12:52:52.630553 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 26 12:52:52.688300 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 26 12:52:52.786562 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 26 12:52:52.851810 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 26 12:52:52.942140 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 26 12:52:53.867773 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 26 12:52:53.933897 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 26 12:52:54.062270 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 26 12:52:54.165769 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'show working'. May 26 12:52:54.331348 osdx INFO[229235]: FRR daemons did not change May 26 12:52:54.590916 osdx systemd[1]: Reloading. May 26 12:52:54.724258 osdx systemd-sysv-generator[229287]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 26 12:52:54.848523 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 26 12:52:54.870888 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 26 12:52:55.080052 osdx INFO[229270]: Rules successfully loaded May 26 12:52:55.080795 osdx cfgd[1653]: [228589]Completed change to active configuration May 26 12:52:56.329932 osdx OSDxCLI[228589]: User 'admin' committed the configuration. May 26 12:52:56.345794 osdx OSDxCLI[228589]: User 'admin' left the configuration menu. May 26 12:52:56.734027 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=29431 DF PROTO=TCP SPT=37848 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 26 12:52:56.734120 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=40926 DF PROTO=TCP SPT=37850 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 26 12:53:06.872601 osdx systemd[1]: Starting logrotate.service - Rotate log files... May 26 12:53:06.896966 osdx systemd[1]: logrotate.service: Deactivated successfully. May 26 12:53:06.897077 osdx systemd[1]: Finished logrotate.service - Rotate log files. May 26 12:53:07.038417 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. May 26 12:53:07.136086 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'system journal show | cat'. May 26 12:53:07.336525 osdx OSDxCLI[228589]: User 'admin' entered the configuration menu. May 26 12:53:07.399412 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 26 12:53:07.510056 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 26 12:53:07.587576 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 26 12:53:07.694208 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 26 12:53:07.762249 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 26 12:53:07.872809 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 26 12:53:07.971865 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 26 12:53:08.098036 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 26 12:53:08.167942 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 26 12:53:08.269420 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 26 12:53:08.325251 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 26 12:53:08.427148 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 26 12:53:08.484321 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 26 12:53:08.620091 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 26 12:53:08.673396 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 26 12:53:08.776859 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 26 12:53:08.834899 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 26 12:53:08.935834 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 26 12:53:09.017082 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 26 12:53:09.100847 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 26 12:53:09.156808 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. May 26 12:53:09.251860 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. May 26 12:53:09.307410 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. May 26 12:53:09.410008 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. May 26 12:53:09.488412 osdx OSDxCLI[228589]: User 'admin' added a new cfg line: 'show changes'. May 26 12:53:09.603188 osdx INFO[229429]: FRR daemons did not change May 26 12:53:09.885401 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... May 26 12:53:11.839060 osdx systemd[1]: suricata@FW.service: Deactivated successfully. May 26 12:53:11.839174 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. May 26 12:53:11.839209 osdx systemd[1]: suricata@FW.service: Consumed 2.092s CPU time. May 26 12:53:11.864754 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 26 12:53:11.889205 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 26 12:53:12.094100 osdx INFO[229454]: Rules successfully loaded May 26 12:53:12.094720 osdx cfgd[1653]: [228589]Completed change to active configuration May 26 12:53:12.096805 osdx OSDxCLI[228589]: User 'admin' committed the configuration. May 26 12:53:12.115206 osdx OSDxCLI[228589]: User 'admin' left the configuration menu. May 26 12:53:12.337858 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=34925 DF PROTO=TCP SPT=58788 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 26 12:53:12.337991 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=51371 DF PROTO=TCP SPT=58792 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 26 12:53:16.032765 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. May 26 12:53:22.599081 osdx OSDxCLI[228589]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 25524 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.563 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.563/0.563/0.563/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.431 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.431/0.431/0.431/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 48224 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 48.8 MBytes 409 Mbits/sec 0 1.36 MBytes [ 5] 1.00-2.00 sec 82.5 MBytes 692 Mbits/sec 16 1.79 MBytes [ 5] 2.00-3.00 sec 254 MBytes 2.13 Gbits/sec 0 1.97 MBytes [ 5] 3.00-4.00 sec 311 MBytes 2.61 Gbits/sec 0 2.13 MBytes [ 5] 4.00-5.00 sec 268 MBytes 2.24 Gbits/sec 11 1.15 MBytes [ 5] 5.00-6.00 sec 256 MBytes 2.15 Gbits/sec 0 1.30 MBytes [ 5] 6.00-7.00 sec 259 MBytes 2.17 Gbits/sec 0 1.45 MBytes [ 5] 7.00-8.00 sec 272 MBytes 2.29 Gbits/sec 0 1.58 MBytes [ 5] 8.00-9.00 sec 266 MBytes 2.23 Gbits/sec 0 1.70 MBytes [ 5] 9.00-10.00 sec 275 MBytes 2.31 Gbits/sec 13 1.28 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.24 GBytes 1.92 Gbits/sec 40 sender [ 5] 0.00-10.00 sec 2.24 GBytes 1.92 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/26/2025-12:53:45.473826 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48218 -> 40.0.0.2:5001 05/26/2025-12:53:45.474776 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48224 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=48224 dport=5001 packets=1659692 bytes=2489527837 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=48224 packets=204951 bytes=10649648 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=382 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=382 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=76 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=76 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=48218 dport=5001 packets=16 bytes=1299 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=48218 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 40756 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 232 MBytes 1.95 Gbits/sec 14 1.90 MBytes [ 5] 1.00-2.00 sec 258 MBytes 2.16 Gbits/sec 0 2.07 MBytes [ 5] 2.00-3.00 sec 279 MBytes 2.34 Gbits/sec 10 1.57 MBytes [ 5] 3.00-4.00 sec 275 MBytes 2.31 Gbits/sec 0 1.69 MBytes [ 5] 4.00-5.00 sec 259 MBytes 2.17 Gbits/sec 0 1.80 MBytes [ 5] 5.00-6.00 sec 256 MBytes 2.15 Gbits/sec 0 1.90 MBytes [ 5] 6.00-7.00 sec 262 MBytes 2.20 Gbits/sec 0 1.99 MBytes [ 5] 7.00-8.00 sec 250 MBytes 2.10 Gbits/sec 0 2.08 MBytes [ 5] 8.00-9.00 sec 246 MBytes 2.07 Gbits/sec 0 2.16 MBytes [ 5] 9.00-10.00 sec 261 MBytes 2.19 Gbits/sec 7 1.64 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.52 GBytes 2.16 Gbits/sec 31 sender [ 5] 0.00-10.00 sec 2.52 GBytes 2.16 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/26/2025-12:53:45.473826 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48218 -> 40.0.0.2:5001 05/26/2025-12:53:45.474776 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48224 -> 40.0.0.2:5001 05/26/2025-12:54:00.295248 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40746 -> 40.0.0.2:5001 05/26/2025-12:54:00.296753 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40756 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=40746 dport=5001 packets=14 bytes=1197 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=40746 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=40756 dport=5001 packets=1867060 bytes=2800578237 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=40756 packets=309092 bytes=16060744 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 823 0 --:--:-- --:--:-- --:--:-- 823
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.556 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.556/0.556/0.556/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.509 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.509/0.509/0.509/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/26/2025-12:54:34.621044 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56678 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=385 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=385 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=56678 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=56678 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=79 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=79 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/26/2025-12:54:34.621044 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56678 -> 40.0.0.2:5000 05/26/2025-12:54:40.976172 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56678 -> 40.0.0.2:5000 05/26/2025-12:54:42.484013 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55150 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=55150 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=55150 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 830 2 - 5 5 331 331 --------------------------------------------------------------------- Total 11 11 830 830
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 26434 0 --:--:-- --:--:-- --:--:-- 32250
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.489 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.489/0.489/0.489/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.488 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.488/0.488/0.488/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/26/2025-12:55:06.245355 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49258 -> 40.0.0.2:5001 05/26/2025-12:55:06.246307 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49274 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=388 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=388 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=49274 dport=5001 packets=9187 bytes=13774753 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49274 packets=1499 bytes=77956 [ASSURED] [OFFLOAD, packets=9174 bytes=13759552 packets=1497 bytes=77844] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=82 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=82 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=49258 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49258 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 3813 0 --:--:-- --:--:-- --:--:-- 3911
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
05/26/2025-12:55:06.245355 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49258 -> 40.0.0.2:5001 05/26/2025-12:55:06.246307 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49274 -> 40.0.0.2:5001 05/26/2025-12:55:08.488428 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49288 -> 40.0.0.2:5001 05/26/2025-12:55:08.489859 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:38491 -> 40.0.0.2:5001 05/26/2025-12:55:08.500643 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:38491 -> 40.0.0.2:5001 05/26/2025-12:55:08.512612 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:38491 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=49288 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49288 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=38491 dport=5001 packets=15 bytes=20696 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=38491 packets=1 bytes=32 [OFFLOAD, packets=11 bytes=16236 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 37608 0 --:--:-- --:--:-- --:--:-- 40000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.592 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.592/0.592/0.592/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.597 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.597/0.597/0.597/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/26/2025-12:55:28.992038 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42736 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 42736 5000 yes 201 0 9 731 40.0.0.2 20.0.0.2 5000 42736 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250117s ending at 1748264132.677395 XDP_DROP 10 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 8394089 pkts ( 8 pps) 10890882 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
05/26/2025-12:55:28.992038 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42736 -> 40.0.0.2:5000 05/26/2025-12:55:32.820181 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:49488 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 49488 no 201 0 0 0 20.0.0.2 40.0.0.2 49488 5001 no 201 0 0 0 20.0.0.2 40.0.0.2 42736 5000 yes 201 0 12 905 40.0.0.2 20.0.0.2 5000 42736 yes 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250122s ending at 1748264136.528526 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 8394127 pkts ( 0 pps) 10890885 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)