Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 77898 0 --:--:-- --:--:-- --:--:-- 125k
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.837 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.837/0.837/0.837/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=7.12 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 7.115/7.115/7.115/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 38536 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 8.27 MBytes 69.4 Mbits/sec 0 366 KBytes [ 5] 1.00-2.00 sec 8.60 MBytes 72.1 Mbits/sec 0 665 KBytes [ 5] 2.00-3.00 sec 8.75 MBytes 73.5 Mbits/sec 0 967 KBytes [ 5] 3.00-4.00 sec 6.25 MBytes 52.4 Mbits/sec 0 1.27 MBytes [ 5] 4.00-5.00 sec 13.8 MBytes 115 Mbits/sec 0 1.85 MBytes [ 5] 5.00-6.00 sec 16.2 MBytes 136 Mbits/sec 267 1.42 MBytes [ 5] 6.00-7.00 sec 10.0 MBytes 83.9 Mbits/sec 1 1.56 MBytes [ 5] 7.00-8.00 sec 30.0 MBytes 252 Mbits/sec 60 1.47 MBytes [ 5] 8.00-9.00 sec 63.8 MBytes 535 Mbits/sec 0 1.60 MBytes [ 5] 9.00-10.00 sec 40.0 MBytes 336 Mbits/sec 0 1.72 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 206 MBytes 172 Mbits/sec 328 sender [ 5] 0.00-10.02 sec 203 MBytes 170 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-18:28:26.647105 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38528 -> 40.0.0.2:5001 02/19/2025-18:28:26.650044 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38536 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 887 0 --:--:-- --:--:-- --:--:-- 889
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.927 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.927/0.927/0.927/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.704 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.704/0.704/0.704/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 46576 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 9.09 MBytes 76.2 Mbits/sec 1 378 KBytes [ 5] 1.00-2.00 sec 16.8 MBytes 141 Mbits/sec 0 1010 KBytes [ 5] 2.00-3.00 sec 13.8 MBytes 115 Mbits/sec 0 1.26 MBytes [ 5] 3.00-4.00 sec 90.0 MBytes 755 Mbits/sec 487 998 KBytes [ 5] 4.00-5.00 sec 58.8 MBytes 493 Mbits/sec 0 1.27 MBytes [ 5] 5.00-6.00 sec 46.2 MBytes 388 Mbits/sec 0 1.54 MBytes [ 5] 6.00-7.00 sec 55.0 MBytes 461 Mbits/sec 0 1.75 MBytes [ 5] 7.00-8.00 sec 53.8 MBytes 451 Mbits/sec 35 1.33 MBytes [ 5] 8.00-9.00 sec 52.5 MBytes 440 Mbits/sec 0 1.40 MBytes [ 5] 9.00-10.00 sec 56.2 MBytes 472 Mbits/sec 0 1.46 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 452 MBytes 379 Mbits/sec 523 sender [ 5] 0.00-10.03 sec 450 MBytes 376 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-18:29:15.922499 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46566 -> 40.0.0.2:5001 02/19/2025-18:29:15.926237 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46576 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 19 18:28:58.630065 osdx systemd-journald[1749]: Runtime Journal (/run/log/journal/88d6d46990514354af95198d86011406) is 1.9M, max 15.3M, 13.4M free. Feb 19 18:28:58.630773 osdx systemd-journald[1749]: Received client request to rotate journal, rotating. Feb 19 18:28:58.630823 osdx systemd-journald[1749]: Vacuuming done, freed 0B of archived journals from /run/log/journal/88d6d46990514354af95198d86011406. Feb 19 18:28:58.653793 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'system journal clear'. Feb 19 18:28:59.350617 osdx osdx-coredump[348681]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 19 18:28:59.367175 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 18:29:00.221689 osdx OSDxCLI[348322]: User 'admin' entered the configuration menu. Feb 19 18:29:00.391448 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 19 18:29:00.543378 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 19 18:29:00.774059 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 18:29:00.897301 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 19 18:29:01.062828 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 19 18:29:01.198302 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 19 18:29:01.432506 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'show working'. Feb 19 18:29:01.757645 osdx INFO[348714]: FRR daemons did not change Feb 19 18:29:01.874329 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 18:29:02.138084 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 19 18:29:02.332932 osdx (udev-worker)[348819]: Network interface NamePolicy= disabled on kernel command line. Feb 19 18:29:03.003591 osdx cfgd[1448]: [348322]Completed change to active configuration Feb 19 18:29:03.064294 osdx OSDxCLI[348322]: User 'admin' committed the configuration. Feb 19 18:29:03.150130 osdx OSDxCLI[348322]: User 'admin' left the configuration menu. Feb 19 18:29:07.714015 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 19 18:29:07.910023 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 19 18:29:08.070113 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 19 18:29:09.257572 osdx file_operation[348905]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 19 18:29:09.447010 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 19 18:29:09.704743 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 19 18:29:09.961996 osdx OSDxCLI[348322]: User 'admin' entered the configuration menu. Feb 19 18:29:10.106885 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 18:29:10.236990 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 18:29:10.371230 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 18:29:10.512931 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 18:29:10.668019 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 18:29:10.882337 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 18:29:11.124130 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 18:29:11.318419 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 18:29:11.514170 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 18:29:11.655561 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 18:29:11.767680 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 18:29:11.893915 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 18:29:12.020016 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 18:29:12.381812 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 18:29:12.513407 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 18:29:12.722540 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 18:29:12.872025 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 18:29:13.069120 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 18:29:13.168818 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 18:29:13.296511 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 18:29:13.496602 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'show working'. Feb 19 18:29:13.896326 osdx INFO[348991]: FRR daemons did not change Feb 19 18:29:14.269337 osdx systemd[1]: Reloading. Feb 19 18:29:14.482127 osdx systemd-sysv-generator[349044]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 19 18:29:14.734666 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 19 18:29:14.741550 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 18:29:14.787079 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 19 18:29:14.787287 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 19 18:29:14.802303 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 18:29:15.162098 osdx INFO[349026]: Rules successfully loaded Feb 19 18:29:15.163166 osdx cfgd[1448]: [348322]Completed change to active configuration Feb 19 18:29:15.166700 osdx OSDxCLI[348322]: User 'admin' committed the configuration. Feb 19 18:29:15.214779 osdx OSDxCLI[348322]: User 'admin' left the configuration menu. Feb 19 18:29:15.926144 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=6474 DF PROTO=TCP SPT=46566 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 18:29:15.926313 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=7582 DF PROTO=TCP SPT=46576 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 18:29:26.451720 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 33376 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 27.0 MBytes 226 Mbits/sec 0 1.18 MBytes [ 5] 1.00-2.00 sec 57.5 MBytes 482 Mbits/sec 193 1.29 MBytes [ 5] 2.00-3.00 sec 53.8 MBytes 451 Mbits/sec 0 1.38 MBytes [ 5] 3.00-4.00 sec 58.8 MBytes 493 Mbits/sec 0 1.45 MBytes [ 5] 4.00-5.00 sec 53.8 MBytes 451 Mbits/sec 0 1.49 MBytes [ 5] 5.00-6.00 sec 52.5 MBytes 440 Mbits/sec 0 1.52 MBytes [ 5] 6.00-7.00 sec 56.2 MBytes 472 Mbits/sec 60 1.12 MBytes [ 5] 7.00-8.00 sec 50.0 MBytes 419 Mbits/sec 0 1.19 MBytes [ 5] 8.00-9.00 sec 53.8 MBytes 450 Mbits/sec 0 1.24 MBytes [ 5] 9.00-10.00 sec 35.0 MBytes 294 Mbits/sec 0 1.27 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 498 MBytes 418 Mbits/sec 253 sender [ 5] 0.00-10.01 sec 496 MBytes 415 Mbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-18:29:15.922499 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46566 -> 40.0.0.2:5001 02/19/2025-18:29:15.926237 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46576 -> 40.0.0.2:5001 02/19/2025-18:29:34.623267 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33370 -> 40.0.0.2:5001 02/19/2025-18:29:34.626897 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33376 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 19 18:28:58.630065 osdx systemd-journald[1749]: Runtime Journal (/run/log/journal/88d6d46990514354af95198d86011406) is 1.9M, max 15.3M, 13.4M free. Feb 19 18:28:58.630773 osdx systemd-journald[1749]: Received client request to rotate journal, rotating. Feb 19 18:28:58.630823 osdx systemd-journald[1749]: Vacuuming done, freed 0B of archived journals from /run/log/journal/88d6d46990514354af95198d86011406. Feb 19 18:28:58.653793 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'system journal clear'. Feb 19 18:28:59.350617 osdx osdx-coredump[348681]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 19 18:28:59.367175 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 18:29:00.221689 osdx OSDxCLI[348322]: User 'admin' entered the configuration menu. Feb 19 18:29:00.391448 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 19 18:29:00.543378 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 19 18:29:00.774059 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 18:29:00.897301 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 19 18:29:01.062828 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 19 18:29:01.198302 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 19 18:29:01.432506 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'show working'. Feb 19 18:29:01.757645 osdx INFO[348714]: FRR daemons did not change Feb 19 18:29:01.874329 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 18:29:02.138084 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 19 18:29:02.332932 osdx (udev-worker)[348819]: Network interface NamePolicy= disabled on kernel command line. Feb 19 18:29:03.003591 osdx cfgd[1448]: [348322]Completed change to active configuration Feb 19 18:29:03.064294 osdx OSDxCLI[348322]: User 'admin' committed the configuration. Feb 19 18:29:03.150130 osdx OSDxCLI[348322]: User 'admin' left the configuration menu. Feb 19 18:29:07.714015 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 19 18:29:07.910023 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 19 18:29:08.070113 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 19 18:29:09.257572 osdx file_operation[348905]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 19 18:29:09.447010 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 19 18:29:09.704743 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 19 18:29:09.961996 osdx OSDxCLI[348322]: User 'admin' entered the configuration menu. Feb 19 18:29:10.106885 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 18:29:10.236990 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 18:29:10.371230 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 18:29:10.512931 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 18:29:10.668019 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 18:29:10.882337 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 18:29:11.124130 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 18:29:11.318419 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 18:29:11.514170 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 18:29:11.655561 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 18:29:11.767680 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 18:29:11.893915 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 18:29:12.020016 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 18:29:12.381812 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 18:29:12.513407 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 18:29:12.722540 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 18:29:12.872025 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 18:29:13.069120 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 18:29:13.168818 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 18:29:13.296511 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 18:29:13.496602 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'show working'. Feb 19 18:29:13.896326 osdx INFO[348991]: FRR daemons did not change Feb 19 18:29:14.269337 osdx systemd[1]: Reloading. Feb 19 18:29:14.482127 osdx systemd-sysv-generator[349044]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 19 18:29:14.734666 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 19 18:29:14.741550 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 18:29:14.787079 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 19 18:29:14.787287 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 19 18:29:14.802303 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 18:29:15.162098 osdx INFO[349026]: Rules successfully loaded Feb 19 18:29:15.163166 osdx cfgd[1448]: [348322]Completed change to active configuration Feb 19 18:29:15.166700 osdx OSDxCLI[348322]: User 'admin' committed the configuration. Feb 19 18:29:15.214779 osdx OSDxCLI[348322]: User 'admin' left the configuration menu. Feb 19 18:29:15.926144 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=6474 DF PROTO=TCP SPT=46566 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 18:29:15.926313 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=7582 DF PROTO=TCP SPT=46576 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 18:29:26.451720 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Feb 19 18:29:26.731702 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'system journal show | cat'. Feb 19 18:29:27.164138 osdx OSDxCLI[348322]: User 'admin' entered the configuration menu. Feb 19 18:29:27.347894 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 18:29:27.511202 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 18:29:27.678264 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 18:29:27.835180 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 18:29:27.975395 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 18:29:28.033407 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Feb 19 18:29:28.129591 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 18:29:28.384193 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 18:29:28.497152 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 18:29:28.746487 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 18:29:28.929605 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 18:29:29.142548 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 18:29:29.271906 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 18:29:29.471266 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 18:29:29.712351 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 18:29:29.860154 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 18:29:30.037688 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 18:29:30.196906 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 18:29:30.376821 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 18:29:30.571508 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 18:29:30.707213 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 18:29:30.837819 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Feb 19 18:29:31.023086 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Feb 19 18:29:31.307357 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Feb 19 18:29:31.513567 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Feb 19 18:29:31.736339 osdx OSDxCLI[348322]: User 'admin' added a new cfg line: 'show changes'. Feb 19 18:29:32.102360 osdx INFO[349180]: FRR daemons did not change Feb 19 18:29:32.631659 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Feb 19 18:29:33.817543 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Feb 19 18:29:33.817715 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Feb 19 18:29:33.817758 osdx systemd[1]: suricata@FW.service: Consumed 1.370s CPU time. Feb 19 18:29:33.844925 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 18:29:33.928287 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 18:29:34.020523 osdx INFO[349205]: Rules successfully loaded Feb 19 18:29:34.024364 osdx cfgd[1448]: [348322]Completed change to active configuration Feb 19 18:29:34.028218 osdx OSDxCLI[348322]: User 'admin' committed the configuration. Feb 19 18:29:34.079335 osdx OSDxCLI[348322]: User 'admin' left the configuration menu. Feb 19 18:29:34.631331 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=62281 DF PROTO=TCP SPT=33370 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 19 18:29:34.631414 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=40211 DF PROTO=TCP SPT=33376 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 19 18:29:45.258332 osdx OSDxCLI[348322]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 19694 0 --:--:-- --:--:-- --:--:-- 21500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.756 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.756/0.756/0.756/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.941 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.941/0.941/0.941/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 41628 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 10.9 MBytes 91.2 Mbits/sec 0 468 KBytes [ 5] 1.00-2.00 sec 9.75 MBytes 81.8 Mbits/sec 0 824 KBytes [ 5] 2.00-3.01 sec 11.2 MBytes 93.9 Mbits/sec 0 1.18 MBytes [ 5] 3.01-4.00 sec 62.5 MBytes 527 Mbits/sec 233 1.37 MBytes [ 5] 4.00-5.00 sec 72.5 MBytes 608 Mbits/sec 19 1.04 MBytes [ 5] 5.00-6.00 sec 48.8 MBytes 409 Mbits/sec 0 1.11 MBytes [ 5] 6.00-7.00 sec 31.2 MBytes 262 Mbits/sec 0 1.16 MBytes [ 5] 7.00-8.00 sec 43.8 MBytes 367 Mbits/sec 0 1.20 MBytes [ 5] 8.00-9.01 sec 76.2 MBytes 635 Mbits/sec 0 1.22 MBytes [ 5] 9.01-10.00 sec 56.2 MBytes 476 Mbits/sec 0 1.23 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 423 MBytes 355 Mbits/sec 252 sender [ 5] 0.00-10.01 sec 420 MBytes 352 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-18:30:24.543101 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41620 -> 40.0.0.2:5001 02/19/2025-18:30:24.545505 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41628 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
icmp 1 18 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=281 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=281 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=41628 dport=5001 packets=305388 bytes=458077701 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=41628 packets=16517 bytes=861364 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=41620 dport=5001 packets=15 bytes=1261 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=41620 packets=15 bytes=1122 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=34 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=34 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 34244 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 25.1 MBytes 211 Mbits/sec 0 1.10 MBytes [ 5] 1.00-2.00 sec 77.5 MBytes 650 Mbits/sec 37 1.79 MBytes [ 5] 2.00-3.00 sec 36.2 MBytes 304 Mbits/sec 66 1.34 MBytes [ 5] 3.00-4.00 sec 27.5 MBytes 231 Mbits/sec 0 1.41 MBytes [ 5] 4.00-5.00 sec 55.0 MBytes 461 Mbits/sec 0 1.46 MBytes [ 5] 5.00-6.00 sec 42.5 MBytes 357 Mbits/sec 0 1.50 MBytes [ 5] 6.00-7.00 sec 41.2 MBytes 346 Mbits/sec 0 1.52 MBytes [ 5] 7.00-8.00 sec 58.8 MBytes 493 Mbits/sec 0 1.53 MBytes [ 5] 8.00-9.00 sec 58.8 MBytes 493 Mbits/sec 0 1.53 MBytes [ 5] 9.00-10.00 sec 65.0 MBytes 545 Mbits/sec 0 1.53 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 488 MBytes 409 Mbits/sec 103 sender [ 5] 0.00-10.01 sec 486 MBytes 408 Mbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-18:30:24.543101 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41620 -> 40.0.0.2:5001 02/19/2025-18:30:24.545505 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41628 -> 40.0.0.2:5001 02/19/2025-18:30:40.853017 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34238 -> 40.0.0.2:5001 02/19/2025-18:30:40.856880 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34244 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=34244 dport=5001 packets=352382 bytes=528567253 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=34244 packets=13151 bytes=684024 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=34238 dport=5001 packets=14 bytes=1196 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=34238 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 2086 0 --:--:-- --:--:-- --:--:-- 2105
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=12.4 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 12.402/12.402/12.402/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.685 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.685/0.685/0.685/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2025-18:31:29.022511 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43800 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=43800 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=43800 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 25 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=37 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=37 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 25 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=284 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=284 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 5 8 263 491 2 - 3 3 228 228 ------------------------------------------------------------------ Total 8 8 491 491 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2025-18:31:29.022511 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43800 -> 40.0.0.2:5000 02/19/2025-18:31:38.244180 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:43800 -> 40.0.0.2:5000 02/19/2025-18:31:40.365253 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40010 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=40010 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=40010 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 5 8 263 416 2 - 3 3 153 153 --------------------------------------------------------------------- Total 8 8 416 416 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 10 499 790 2 - 4 4 291 291 --------------------------------------------------------------------- Total 10 10 790 790
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 6153 0 --:--:-- --:--:-- --:--:-- 6450
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=11.9 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 11.887/11.887/11.887/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.785 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.785/0.785/0.785/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2025-18:32:22.693761 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59770 -> 40.0.0.2:5001 02/19/2025-18:32:22.696565 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59776 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=59770 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=59770 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=388 packets=4 bytes=211] mark=129834765 use=2 icmp 1 28 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=287 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=287 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=59776 dport=5001 packets=3578 bytes=5362701 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=59776 packets=694 bytes=36096 [ASSURED] [OFFLOAD, packets=3567 bytes=5350500 packets=692 bytes=35984] mark=129834765 use=2 icmp 1 28 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=40 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=40 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 2195 0 --:--:-- --:--:-- --:--:-- 2216
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
02/19/2025-18:32:22.693761 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59770 -> 40.0.0.2:5001 02/19/2025-18:32:22.696565 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59776 -> 40.0.0.2:5001 02/19/2025-18:32:27.423646 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59788 -> 40.0.0.2:5001 02/19/2025-18:32:27.449436 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:36722 -> 40.0.0.2:5001 02/19/2025-18:32:27.454707 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:36722 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=59788 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=59788 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=406 packets=4 bytes=211] mark=129834765 use=2 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=36722 dport=5001 packets=32 bytes=45788 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=36722 packets=1 bytes=32 [OFFLOAD, packets=29 bytes=42804 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 54914 0 --:--:-- --:--:-- --:--:-- 66666
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=8.83 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 8.828/8.828/8.828/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=4.56 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 4.558/4.558/4.558/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2025-18:33:03.896357 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40302 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 40302 yes 201 0 0 0 20.0.0.2 40.0.0.2 40302 5000 yes 201 0 8 673
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250180s ending at 1739989987.894478 XDP_DROP 9 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 1568329 pkts ( 0 pps) 2224276 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
02/19/2025-18:33:03.896357 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40302 -> 40.0.0.2:5000 02/19/2025-18:33:08.194562 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:33010 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 33010 no 201 0 0 0 40.0.0.2 20.0.0.2 5000 40302 yes 201 0 0 0 20.0.0.2 40.0.0.2 40302 5000 yes 201 0 11 847 20.0.0.2 40.0.0.2 33010 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250188s ending at 1739989992.425172 XDP_DROP 11 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 1568367 pkts ( 0 pps) 2224279 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)