Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 13992 0 --:--:-- --:--:-- --:--:-- 14333
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.481 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.481/0.481/0.481/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.548 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.548/0.548/0.548/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 51010 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 72.1 MBytes 605 Mbits/sec 207 1.72 MBytes [ 5] 1.00-2.00 sec 70.0 MBytes 587 Mbits/sec 0 1.90 MBytes [ 5] 2.00-3.00 sec 96.2 MBytes 807 Mbits/sec 0 2.04 MBytes [ 5] 3.00-4.00 sec 96.2 MBytes 807 Mbits/sec 35 1.53 MBytes [ 5] 4.00-5.00 sec 97.5 MBytes 814 Mbits/sec 0 1.61 MBytes [ 5] 5.00-6.00 sec 96.2 MBytes 811 Mbits/sec 0 1.67 MBytes [ 5] 6.00-7.00 sec 93.8 MBytes 786 Mbits/sec 0 1.71 MBytes [ 5] 7.00-8.00 sec 95.0 MBytes 797 Mbits/sec 0 1.74 MBytes [ 5] 8.00-9.00 sec 96.2 MBytes 807 Mbits/sec 0 1.75 MBytes [ 5] 9.00-10.00 sec 52.5 MBytes 440 Mbits/sec 0 1.76 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 866 MBytes 726 Mbits/sec 242 sender [ 5] 0.00-10.02 sec 865 MBytes 724 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/19/2025-16:00:02.676479 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51000 -> 40.0.0.2:5001 05/19/2025-16:00:02.677496 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51010 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 61752 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.520 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.520/0.520/0.520/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.453 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.453/0.453/0.453/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 49596 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 95.5 MBytes 801 Mbits/sec 17 1.86 MBytes [ 5] 1.00-2.00 sec 140 MBytes 1.17 Gbits/sec 68 1.43 MBytes [ 5] 2.00-3.00 sec 282 MBytes 2.37 Gbits/sec 0 1.57 MBytes [ 5] 3.00-4.00 sec 298 MBytes 2.50 Gbits/sec 24 1.23 MBytes [ 5] 4.00-5.00 sec 274 MBytes 2.30 Gbits/sec 0 1.38 MBytes [ 5] 5.00-6.00 sec 299 MBytes 2.51 Gbits/sec 0 1.51 MBytes [ 5] 6.00-7.00 sec 330 MBytes 2.77 Gbits/sec 0 1.65 MBytes [ 5] 7.00-8.00 sec 308 MBytes 2.58 Gbits/sec 0 1.78 MBytes [ 5] 8.00-9.00 sec 325 MBytes 2.73 Gbits/sec 0 1.91 MBytes [ 5] 9.00-10.00 sec 312 MBytes 2.62 Gbits/sec 0 2.03 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.60 GBytes 2.23 Gbits/sec 109 sender [ 5] 0.00-10.00 sec 2.60 GBytes 2.23 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/19/2025-16:00:34.896273 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49590 -> 40.0.0.2:5001 05/19/2025-16:00:34.897178 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49596 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 19 16:00:26.383458 osdx systemd-journald[1859]: Runtime Journal (/run/log/journal/dd53a6d251524eaf96fe5f49da605cd5) is 1.9M, max 15.3M, 13.4M free. May 19 16:00:26.383942 osdx systemd-journald[1859]: Received client request to rotate journal, rotating. May 19 16:00:26.383973 osdx systemd-journald[1859]: Vacuuming done, freed 0B of archived journals from /run/log/journal/dd53a6d251524eaf96fe5f49da605cd5. May 19 16:00:26.394908 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'system journal clear'. May 19 16:00:26.753530 osdx osdx-coredump[262242]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 19 16:00:26.761207 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'system coredump delete all'. May 19 16:00:27.251974 osdx OSDxCLI[261897]: User 'admin' entered the configuration menu. May 19 16:00:27.349205 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 19 16:00:27.443902 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 19 16:00:27.524164 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 19 16:00:27.632469 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 19 16:00:27.705434 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 19 16:00:27.811094 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 19 16:00:27.905692 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'show working'. May 19 16:00:28.027310 osdx INFO[262268]: FRR daemons did not change May 19 16:00:28.047594 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 19 16:00:28.127623 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 19 16:00:28.170304 osdx (udev-worker)[262368]: Network interface NamePolicy= disabled on kernel command line. May 19 16:00:28.240023 osdx (udev-worker)[262375]: Network interface NamePolicy= disabled on kernel command line. May 19 16:00:28.392116 osdx cfgd[1649]: [261897]Completed change to active configuration May 19 16:00:28.431826 osdx OSDxCLI[261897]: User 'admin' committed the configuration. May 19 16:00:28.450611 osdx OSDxCLI[261897]: User 'admin' left the configuration menu. May 19 16:00:30.613540 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 19 16:00:30.712035 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 19 16:00:30.804237 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 19 16:00:31.354795 osdx file_operation[262459]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 19 16:00:31.374485 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 19 16:00:31.510191 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 19 16:00:31.660368 osdx OSDxCLI[261897]: User 'admin' entered the configuration menu. May 19 16:00:31.764028 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 19 16:00:31.823453 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 19 16:00:31.912318 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 19 16:00:31.968112 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 19 16:00:32.079493 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 19 16:00:32.161724 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 19 16:00:32.296675 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 19 16:00:32.486735 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 19 16:00:32.551733 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 19 16:00:32.654354 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 19 16:00:32.711845 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 19 16:00:32.830488 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 19 16:00:32.886706 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 19 16:00:32.986646 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 19 16:00:33.057813 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 19 16:00:33.167305 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 19 16:00:33.228602 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 19 16:00:33.346801 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 19 16:00:33.400984 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 19 16:00:33.499891 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 19 16:00:33.588085 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'show working'. May 19 16:00:33.726201 osdx INFO[262541]: FRR daemons did not change May 19 16:00:33.996477 osdx systemd[1]: Reloading. May 19 16:00:34.103595 osdx systemd-sysv-generator[262594]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 19 16:00:34.243895 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 19 16:00:34.263762 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 19 16:00:34.466315 osdx INFO[262576]: Rules successfully loaded May 19 16:00:34.467116 osdx cfgd[1649]: [261897]Completed change to active configuration May 19 16:00:34.469056 osdx OSDxCLI[261897]: User 'admin' committed the configuration. May 19 16:00:34.489184 osdx OSDxCLI[261897]: User 'admin' left the configuration menu. May 19 16:00:34.899965 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=50723 DF PROTO=TCP SPT=49590 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 19 16:00:34.900050 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=27614 DF PROTO=TCP SPT=49596 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 19 16:00:45.110108 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 59334 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 308 MBytes 2.58 Gbits/sec 18 1.93 MBytes [ 5] 1.00-2.00 sec 302 MBytes 2.54 Gbits/sec 0 2.09 MBytes [ 5] 2.00-3.00 sec 298 MBytes 2.50 Gbits/sec 0 2.22 MBytes [ 5] 3.00-4.00 sec 296 MBytes 2.49 Gbits/sec 14 1.67 MBytes [ 5] 4.00-5.00 sec 285 MBytes 2.39 Gbits/sec 0 1.79 MBytes [ 5] 5.00-6.00 sec 351 MBytes 2.95 Gbits/sec 0 1.91 MBytes [ 5] 6.00-7.00 sec 372 MBytes 3.12 Gbits/sec 0 2.03 MBytes [ 5] 7.00-8.00 sec 326 MBytes 2.74 Gbits/sec 0 2.14 MBytes [ 5] 8.00-9.00 sec 296 MBytes 2.49 Gbits/sec 24 1.62 MBytes [ 5] 9.00-10.00 sec 282 MBytes 2.37 Gbits/sec 0 1.77 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 3.04 GBytes 2.62 Gbits/sec 56 sender [ 5] 0.00-10.00 sec 3.04 GBytes 2.61 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/19/2025-16:00:34.896273 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49590 -> 40.0.0.2:5001 05/19/2025-16:00:34.897178 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49596 -> 40.0.0.2:5001 05/19/2025-16:00:48.749711 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59328 -> 40.0.0.2:5001 05/19/2025-16:00:48.750634 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59334 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 19 16:00:26.383458 osdx systemd-journald[1859]: Runtime Journal (/run/log/journal/dd53a6d251524eaf96fe5f49da605cd5) is 1.9M, max 15.3M, 13.4M free. May 19 16:00:26.383942 osdx systemd-journald[1859]: Received client request to rotate journal, rotating. May 19 16:00:26.383973 osdx systemd-journald[1859]: Vacuuming done, freed 0B of archived journals from /run/log/journal/dd53a6d251524eaf96fe5f49da605cd5. May 19 16:00:26.394908 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'system journal clear'. May 19 16:00:26.753530 osdx osdx-coredump[262242]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 19 16:00:26.761207 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'system coredump delete all'. May 19 16:00:27.251974 osdx OSDxCLI[261897]: User 'admin' entered the configuration menu. May 19 16:00:27.349205 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 19 16:00:27.443902 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 19 16:00:27.524164 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 19 16:00:27.632469 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 19 16:00:27.705434 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 19 16:00:27.811094 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 19 16:00:27.905692 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'show working'. May 19 16:00:28.027310 osdx INFO[262268]: FRR daemons did not change May 19 16:00:28.047594 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 19 16:00:28.127623 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 19 16:00:28.170304 osdx (udev-worker)[262368]: Network interface NamePolicy= disabled on kernel command line. May 19 16:00:28.240023 osdx (udev-worker)[262375]: Network interface NamePolicy= disabled on kernel command line. May 19 16:00:28.392116 osdx cfgd[1649]: [261897]Completed change to active configuration May 19 16:00:28.431826 osdx OSDxCLI[261897]: User 'admin' committed the configuration. May 19 16:00:28.450611 osdx OSDxCLI[261897]: User 'admin' left the configuration menu. May 19 16:00:30.613540 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 19 16:00:30.712035 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 19 16:00:30.804237 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 19 16:00:31.354795 osdx file_operation[262459]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 19 16:00:31.374485 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 19 16:00:31.510191 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 19 16:00:31.660368 osdx OSDxCLI[261897]: User 'admin' entered the configuration menu. May 19 16:00:31.764028 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 19 16:00:31.823453 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 19 16:00:31.912318 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 19 16:00:31.968112 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 19 16:00:32.079493 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 19 16:00:32.161724 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 19 16:00:32.296675 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 19 16:00:32.486735 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 19 16:00:32.551733 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 19 16:00:32.654354 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 19 16:00:32.711845 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 19 16:00:32.830488 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 19 16:00:32.886706 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 19 16:00:32.986646 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 19 16:00:33.057813 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 19 16:00:33.167305 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 19 16:00:33.228602 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 19 16:00:33.346801 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 19 16:00:33.400984 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 19 16:00:33.499891 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 19 16:00:33.588085 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'show working'. May 19 16:00:33.726201 osdx INFO[262541]: FRR daemons did not change May 19 16:00:33.996477 osdx systemd[1]: Reloading. May 19 16:00:34.103595 osdx systemd-sysv-generator[262594]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 19 16:00:34.243895 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 19 16:00:34.263762 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 19 16:00:34.466315 osdx INFO[262576]: Rules successfully loaded May 19 16:00:34.467116 osdx cfgd[1649]: [261897]Completed change to active configuration May 19 16:00:34.469056 osdx OSDxCLI[261897]: User 'admin' committed the configuration. May 19 16:00:34.489184 osdx OSDxCLI[261897]: User 'admin' left the configuration menu. May 19 16:00:34.899965 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=50723 DF PROTO=TCP SPT=49590 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 19 16:00:34.900050 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=27614 DF PROTO=TCP SPT=49596 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 19 16:00:45.110108 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. May 19 16:00:45.219725 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'system journal show | cat'. May 19 16:00:45.486843 osdx OSDxCLI[261897]: User 'admin' entered the configuration menu. May 19 16:00:45.548163 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 19 16:00:45.649691 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 19 16:00:45.706307 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 19 16:00:45.806477 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 19 16:00:45.865420 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 19 16:00:45.955146 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 19 16:00:46.040565 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 19 16:00:46.115201 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 19 16:00:46.213246 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 19 16:00:46.283984 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 19 16:00:46.397669 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 19 16:00:46.502528 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 19 16:00:46.560512 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 19 16:00:46.662571 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 19 16:00:46.716710 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 19 16:00:46.818178 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 19 16:00:46.877849 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 19 16:00:46.980907 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 19 16:00:47.056927 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 19 16:00:47.143158 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 19 16:00:47.207846 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. May 19 16:00:47.294409 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. May 19 16:00:47.356654 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. May 19 16:00:47.551688 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. May 19 16:00:47.638367 osdx OSDxCLI[261897]: User 'admin' added a new cfg line: 'show changes'. May 19 16:00:47.769917 osdx INFO[262729]: FRR daemons did not change May 19 16:00:48.015031 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... May 19 16:00:48.285938 osdx systemd[1]: suricata@FW.service: Deactivated successfully. May 19 16:00:48.286088 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. May 19 16:00:48.304074 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 19 16:00:48.321415 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 19 16:00:48.502322 osdx INFO[262754]: Rules successfully loaded May 19 16:00:48.502807 osdx cfgd[1649]: [261897]Completed change to active configuration May 19 16:00:48.504819 osdx OSDxCLI[261897]: User 'admin' committed the configuration. May 19 16:00:48.521093 osdx OSDxCLI[261897]: User 'admin' left the configuration menu. May 19 16:00:48.751601 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=42171 DF PROTO=TCP SPT=59328 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 19 16:00:48.751673 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=39292 DF PROTO=TCP SPT=59334 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 19 16:00:56.033626 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. May 19 16:00:59.012970 osdx OSDxCLI[261897]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 235 0 --:--:-- --:--:-- --:--:-- 236
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.514 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.514/0.514/0.514/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.522 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.522/0.522/0.522/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 59040 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 75.9 MBytes 636 Mbits/sec 95 1.67 MBytes [ 5] 1.00-2.00 sec 152 MBytes 1.28 Gbits/sec 84 1.31 MBytes [ 5] 2.00-3.00 sec 265 MBytes 2.22 Gbits/sec 0 1.44 MBytes [ 5] 3.00-4.00 sec 268 MBytes 2.24 Gbits/sec 0 1.57 MBytes [ 5] 4.00-5.00 sec 292 MBytes 2.45 Gbits/sec 0 1.67 MBytes [ 5] 5.00-6.00 sec 308 MBytes 2.58 Gbits/sec 0 1.80 MBytes [ 5] 6.00-7.00 sec 305 MBytes 2.56 Gbits/sec 0 1.91 MBytes [ 5] 7.00-8.00 sec 384 MBytes 3.22 Gbits/sec 0 2.04 MBytes [ 5] 8.00-9.00 sec 352 MBytes 2.96 Gbits/sec 0 2.14 MBytes [ 5] 9.00-10.00 sec 361 MBytes 3.03 Gbits/sec 0 2.24 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.70 GBytes 2.32 Gbits/sec 179 sender [ 5] 0.00-10.00 sec 2.70 GBytes 2.32 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/19/2025-16:01:20.951278 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59026 -> 40.0.0.2:5001 05/19/2025-16:01:20.952237 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59040 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=59026 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=59026 packets=13 bytes=1016 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=59040 dport=5001 packets=2001200 bytes=3001792781 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=59040 packets=166956 bytes=8675828 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=156 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=156 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=53 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=53 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 53302 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 240 MBytes 2.01 Gbits/sec 57 1.91 MBytes [ 5] 1.00-2.00 sec 309 MBytes 2.59 Gbits/sec 0 2.08 MBytes [ 5] 2.00-3.00 sec 290 MBytes 2.43 Gbits/sec 0 2.21 MBytes [ 5] 3.00-4.00 sec 285 MBytes 2.39 Gbits/sec 15 1.66 MBytes [ 5] 4.00-5.00 sec 258 MBytes 2.16 Gbits/sec 68 1.24 MBytes [ 5] 5.00-6.00 sec 275 MBytes 2.31 Gbits/sec 0 1.39 MBytes [ 5] 6.00-7.00 sec 289 MBytes 2.42 Gbits/sec 0 1.53 MBytes [ 5] 7.00-8.00 sec 274 MBytes 2.30 Gbits/sec 0 1.66 MBytes [ 5] 8.00-9.00 sec 272 MBytes 2.29 Gbits/sec 0 1.77 MBytes [ 5] 9.00-10.00 sec 291 MBytes 2.44 Gbits/sec 0 1.88 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.72 GBytes 2.33 Gbits/sec 140 sender [ 5] 0.00-10.00 sec 2.72 GBytes 2.33 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/19/2025-16:01:20.951278 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59026 -> 40.0.0.2:5001 05/19/2025-16:01:20.952237 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59040 -> 40.0.0.2:5001 05/19/2025-16:01:36.028877 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53294 -> 40.0.0.2:5001 05/19/2025-16:01:36.029877 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53302 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=53294 dport=5001 packets=16 bytes=1297 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53294 packets=13 bytes=1018 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=53302 dport=5001 packets=2014674 bytes=3021999989 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53302 packets=315067 bytes=16371656 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 3558 0 --:--:-- --:--:-- --:--:-- 3571
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.500 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.500/0.500/0.500/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.501 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.501/0.501/0.501/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/19/2025-16:02:08.598593 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59408 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=56 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=56 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=159 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=159 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=59408 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=59408 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/19/2025-16:02:08.598593 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59408 -> 40.0.0.2:5000 05/19/2025-16:02:14.908339 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59408 -> 40.0.0.2:5000 05/19/2025-16:02:16.414666 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57480 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=57480 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=57480 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 830 2 - 5 5 331 331 --------------------------------------------------------------------- Total 11 11 830 830
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 20459 0 --:--:-- --:--:-- --:--:-- 21500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.527 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.527/0.527/0.527/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.473 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.473/0.473/0.473/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/19/2025-16:02:47.195559 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53050 -> 40.0.0.2:5001 05/19/2025-16:02:47.196635 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53058 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53050 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53050 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=162 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=162 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53058 dport=5001 packets=46892 bytes=70329357 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53058 packets=7849 bytes=409284 [ASSURED] [OFFLOAD, packets=46880 bytes=70315656 packets=7847 bytes=409172] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=59 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=59 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 4860 0 --:--:-- --:--:-- --:--:-- 4925
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
05/19/2025-16:02:47.195559 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53050 -> 40.0.0.2:5001 05/19/2025-16:02:47.196635 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53058 -> 40.0.0.2:5001 05/19/2025-16:02:49.512445 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53064 -> 40.0.0.2:5001 05/19/2025-16:02:49.514039 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:51992 -> 40.0.0.2:5001 05/19/2025-16:02:49.524697 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:51992 -> 40.0.0.2:5001 05/19/2025-16:02:49.536718 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:51992 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53064 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53064 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=51992 dport=5001 packets=16 bytes=22172 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=51992 packets=1 bytes=32 [OFFLOAD, packets=12 bytes=17712 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 35650 0 --:--:-- --:--:-- --:--:-- 40000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.592 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.592/0.592/0.592/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.499 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.499/0.499/0.499/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/19/2025-16:03:11.015243 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38742 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 38742 5000 yes 201 0 9 731 40.0.0.2 20.0.0.2 5000 38742 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250129s ending at 1747670594.728901 XDP_DROP 10 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10876815 pkts ( 8 pps) 14245430 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
05/19/2025-16:03:11.015243 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38742 -> 40.0.0.2:5000 05/19/2025-16:03:14.885274 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:59005 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 59005 no 201 0 0 0 20.0.0.2 40.0.0.2 59005 5001 no 201 0 0 0 20.0.0.2 40.0.0.2 38742 5000 yes 201 0 12 905 40.0.0.2 20.0.0.2 5000 38742 yes 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250130s ending at 1747670598.670656 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10876855 pkts ( 0 pps) 14245433 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)