Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 25323 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.31 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.311/1.311/1.311/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=4.73 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 4.734/4.734/4.734/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 49220 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.01 sec 8.68 MBytes 72.4 Mbits/sec 0 378 KBytes [ 5] 1.01-2.00 sec 11.2 MBytes 94.4 Mbits/sec 0 737 KBytes [ 5] 2.00-3.00 sec 12.5 MBytes 105 Mbits/sec 0 1.16 MBytes [ 5] 3.00-4.00 sec 8.75 MBytes 73.4 Mbits/sec 0 1.55 MBytes [ 5] 4.00-5.00 sec 8.75 MBytes 73.4 Mbits/sec 0 1.80 MBytes [ 5] 5.00-6.00 sec 11.2 MBytes 94.4 Mbits/sec 51 1.44 MBytes [ 5] 6.00-7.00 sec 11.2 MBytes 94.3 Mbits/sec 0 1.59 MBytes [ 5] 7.00-8.00 sec 10.0 MBytes 83.9 Mbits/sec 0 1.66 MBytes [ 5] 8.00-9.00 sec 10.0 MBytes 83.9 Mbits/sec 0 1.81 MBytes [ 5] 9.00-10.00 sec 12.5 MBytes 105 Mbits/sec 0 1.87 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 105 MBytes 88.0 Mbits/sec 51 sender [ 5] 0.00-10.04 sec 103 MBytes 86.1 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/21/2025-17:19:03.251710 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49218 -> 40.0.0.2:5001 03/21/2025-17:19:03.265266 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49220 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 20181 0 --:--:-- --:--:-- --:--:-- 21500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=3.99 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 3.990/3.990/3.990/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.584 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.584/0.584/0.584/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 35734 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 14.2 MBytes 119 Mbits/sec 0 595 KBytes [ 5] 1.00-2.00 sec 37.4 MBytes 314 Mbits/sec 0 2.25 MBytes [ 5] 2.00-3.00 sec 8.75 MBytes 73.3 Mbits/sec 0 2.31 MBytes [ 5] 3.00-4.00 sec 18.8 MBytes 158 Mbits/sec 80 1.78 MBytes [ 5] 4.00-5.00 sec 60.0 MBytes 503 Mbits/sec 33 1.34 MBytes [ 5] 5.00-6.00 sec 65.0 MBytes 545 Mbits/sec 0 1.41 MBytes [ 5] 6.00-7.00 sec 51.2 MBytes 430 Mbits/sec 0 1.46 MBytes [ 5] 7.00-8.00 sec 95.0 MBytes 797 Mbits/sec 0 1.50 MBytes [ 5] 8.00-9.00 sec 78.8 MBytes 661 Mbits/sec 8 1.08 MBytes [ 5] 9.00-10.00 sec 62.5 MBytes 524 Mbits/sec 0 1.15 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 492 MBytes 412 Mbits/sec 121 sender [ 5] 0.00-10.01 sec 490 MBytes 411 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/21/2025-17:20:04.908004 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35728 -> 40.0.0.2:5001 03/21/2025-17:20:04.919056 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35734 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Mar 21 17:19:39.000574 osdx systemd-timedated[225974]: Changed local time to Fri 2025-03-21 17:19:39 UTC Mar 21 17:19:39.001399 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service. Mar 21 17:19:39.004399 osdx systemd-journald[1986]: Time jumped backwards, rotating. Mar 21 17:19:39.005519 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'set date 2025-03-21 17:19:39'. Mar 21 17:19:39.551162 osdx systemd-journald[1986]: Runtime Journal (/run/log/journal/5b174a9dbeeb42728284be3b4e954aec) is 3.8M, max 15.3M, 11.5M free. Mar 21 17:19:39.552385 osdx systemd-journald[1986]: Received client request to rotate journal, rotating. Mar 21 17:19:39.552460 osdx systemd-journald[1986]: Vacuuming done, freed 0B of archived journals from /run/log/journal/5b174a9dbeeb42728284be3b4e954aec. Mar 21 17:19:39.567888 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'system journal clear'. Mar 21 17:19:40.188786 osdx osdx-coredump[225992]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Mar 21 17:19:40.204099 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'system coredump delete all'. Mar 21 17:19:41.209153 osdx OSDxCLI[225534]: User 'admin' entered the configuration menu. Mar 21 17:19:41.451793 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Mar 21 17:19:41.580431 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Mar 21 17:19:41.763520 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Mar 21 17:19:41.906805 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Mar 21 17:19:42.126207 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Mar 21 17:19:42.278372 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Mar 21 17:19:42.511216 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'show working'. Mar 21 17:19:42.770970 osdx ubnt-cfgd[226018]: inactive Mar 21 17:19:43.559985 osdx INFO[226032]: FRR daemons did not change Mar 21 17:19:43.636408 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Mar 21 17:19:43.921646 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Mar 21 17:19:44.010672 osdx (udev-worker)[226156]: Network interface NamePolicy= disabled on kernel command line. Mar 21 17:19:44.514368 osdx cfgd[1672]: [225534]Completed change to active configuration Mar 21 17:19:44.558677 osdx OSDxCLI[225534]: User 'admin' committed the configuration. Mar 21 17:19:44.651861 osdx OSDxCLI[225534]: User 'admin' left the configuration menu. Mar 21 17:19:53.867899 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Mar 21 17:19:54.037138 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Mar 21 17:19:54.186514 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Mar 21 17:19:54.989403 osdx file_operation[226311]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Mar 21 17:19:55.025825 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Mar 21 17:19:55.260311 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Mar 21 17:19:55.470289 osdx OSDxCLI[225534]: User 'admin' entered the configuration menu. Mar 21 17:19:55.581580 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Mar 21 17:19:55.732498 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Mar 21 17:19:55.875572 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Mar 21 17:19:56.003128 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Mar 21 17:19:56.157844 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Mar 21 17:19:56.286459 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Mar 21 17:19:56.588496 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Mar 21 17:19:56.747592 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Mar 21 17:19:56.921899 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Mar 21 17:19:57.151012 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Mar 21 17:19:57.328780 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Mar 21 17:19:57.578832 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Mar 21 17:19:57.701684 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Mar 21 17:19:57.906123 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Mar 21 17:19:58.021894 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Mar 21 17:19:58.174475 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Mar 21 17:19:58.282539 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Mar 21 17:19:58.460858 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Mar 21 17:19:58.615373 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Mar 21 17:19:58.762852 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Mar 21 17:19:58.990345 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'show working'. Mar 21 17:19:59.152592 osdx ubnt-cfgd[226367]: inactive Mar 21 17:20:01.264952 osdx INFO[226408]: FRR daemons did not change Mar 21 17:20:02.096840 osdx systemd[1]: Reloading. Mar 21 17:20:02.292403 osdx systemd-sysv-generator[226471]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Mar 21 17:20:02.571510 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Mar 21 17:20:02.653335 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Mar 21 17:20:03.009524 osdx INFO[226453]: Rules successfully loaded Mar 21 17:20:03.010566 osdx cfgd[1672]: [225534]Completed change to active configuration Mar 21 17:20:03.013426 osdx OSDxCLI[225534]: User 'admin' committed the configuration. Mar 21 17:20:03.047191 osdx OSDxCLI[225534]: User 'admin' left the configuration menu. Mar 21 17:20:04.908540 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=18118 DF PROTO=TCP SPT=35728 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 21 17:20:04.920412 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=49925 DF PROTO=TCP SPT=35734 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 21 17:20:09.032107 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Mar 21 17:20:15.560090 osdx systemd[1]: Starting logrotate.service - Rotate log files... Mar 21 17:20:15.560968 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Mar 21 17:20:15.619110 osdx systemd[1]: logrotate.service: Deactivated successfully. Mar 21 17:20:15.619296 osdx systemd[1]: Finished logrotate.service - Rotate log files.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 40116 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 56.8 MBytes 476 Mbits/sec 0 2.35 MBytes [ 5] 1.00-2.00 sec 116 MBytes 975 Mbits/sec 184 1.34 MBytes [ 5] 2.00-3.00 sec 57.5 MBytes 482 Mbits/sec 0 1.43 MBytes [ 5] 3.00-4.00 sec 97.5 MBytes 818 Mbits/sec 0 1.50 MBytes [ 5] 4.00-5.00 sec 104 MBytes 870 Mbits/sec 52 1.11 MBytes [ 5] 5.00-6.00 sec 78.8 MBytes 661 Mbits/sec 0 1.18 MBytes [ 5] 6.00-7.00 sec 68.8 MBytes 577 Mbits/sec 0 1.23 MBytes [ 5] 7.00-8.00 sec 28.8 MBytes 241 Mbits/sec 0 1.26 MBytes [ 5] 8.00-9.00 sec 40.0 MBytes 335 Mbits/sec 0 1.28 MBytes [ 5] 9.00-10.00 sec 16.2 MBytes 136 Mbits/sec 0 1.29 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 664 MBytes 557 Mbits/sec 236 sender [ 5] 0.00-10.06 sec 662 MBytes 552 Mbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/21/2025-17:20:04.908004 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35728 -> 40.0.0.2:5001 03/21/2025-17:20:04.919056 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35734 -> 40.0.0.2:5001 03/21/2025-17:20:25.562383 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40100 -> 40.0.0.2:5001 03/21/2025-17:20:25.564229 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40116 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Mar 21 17:19:39.000574 osdx systemd-timedated[225974]: Changed local time to Fri 2025-03-21 17:19:39 UTC Mar 21 17:19:39.001399 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service. Mar 21 17:19:39.004399 osdx systemd-journald[1986]: Time jumped backwards, rotating. Mar 21 17:19:39.005519 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'set date 2025-03-21 17:19:39'. Mar 21 17:19:39.551162 osdx systemd-journald[1986]: Runtime Journal (/run/log/journal/5b174a9dbeeb42728284be3b4e954aec) is 3.8M, max 15.3M, 11.5M free. Mar 21 17:19:39.552385 osdx systemd-journald[1986]: Received client request to rotate journal, rotating. Mar 21 17:19:39.552460 osdx systemd-journald[1986]: Vacuuming done, freed 0B of archived journals from /run/log/journal/5b174a9dbeeb42728284be3b4e954aec. Mar 21 17:19:39.567888 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'system journal clear'. Mar 21 17:19:40.188786 osdx osdx-coredump[225992]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Mar 21 17:19:40.204099 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'system coredump delete all'. Mar 21 17:19:41.209153 osdx OSDxCLI[225534]: User 'admin' entered the configuration menu. Mar 21 17:19:41.451793 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Mar 21 17:19:41.580431 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Mar 21 17:19:41.763520 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Mar 21 17:19:41.906805 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Mar 21 17:19:42.126207 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Mar 21 17:19:42.278372 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Mar 21 17:19:42.511216 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'show working'. Mar 21 17:19:42.770970 osdx ubnt-cfgd[226018]: inactive Mar 21 17:19:43.559985 osdx INFO[226032]: FRR daemons did not change Mar 21 17:19:43.636408 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Mar 21 17:19:43.921646 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Mar 21 17:19:44.010672 osdx (udev-worker)[226156]: Network interface NamePolicy= disabled on kernel command line. Mar 21 17:19:44.514368 osdx cfgd[1672]: [225534]Completed change to active configuration Mar 21 17:19:44.558677 osdx OSDxCLI[225534]: User 'admin' committed the configuration. Mar 21 17:19:44.651861 osdx OSDxCLI[225534]: User 'admin' left the configuration menu. Mar 21 17:19:53.867899 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Mar 21 17:19:54.037138 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Mar 21 17:19:54.186514 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Mar 21 17:19:54.989403 osdx file_operation[226311]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Mar 21 17:19:55.025825 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Mar 21 17:19:55.260311 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Mar 21 17:19:55.470289 osdx OSDxCLI[225534]: User 'admin' entered the configuration menu. Mar 21 17:19:55.581580 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Mar 21 17:19:55.732498 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Mar 21 17:19:55.875572 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Mar 21 17:19:56.003128 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Mar 21 17:19:56.157844 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Mar 21 17:19:56.286459 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Mar 21 17:19:56.588496 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Mar 21 17:19:56.747592 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Mar 21 17:19:56.921899 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Mar 21 17:19:57.151012 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Mar 21 17:19:57.328780 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Mar 21 17:19:57.578832 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Mar 21 17:19:57.701684 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Mar 21 17:19:57.906123 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Mar 21 17:19:58.021894 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Mar 21 17:19:58.174475 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Mar 21 17:19:58.282539 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Mar 21 17:19:58.460858 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Mar 21 17:19:58.615373 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Mar 21 17:19:58.762852 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Mar 21 17:19:58.990345 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'show working'. Mar 21 17:19:59.152592 osdx ubnt-cfgd[226367]: inactive Mar 21 17:20:01.264952 osdx INFO[226408]: FRR daemons did not change Mar 21 17:20:02.096840 osdx systemd[1]: Reloading. Mar 21 17:20:02.292403 osdx systemd-sysv-generator[226471]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Mar 21 17:20:02.571510 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Mar 21 17:20:02.653335 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Mar 21 17:20:03.009524 osdx INFO[226453]: Rules successfully loaded Mar 21 17:20:03.010566 osdx cfgd[1672]: [225534]Completed change to active configuration Mar 21 17:20:03.013426 osdx OSDxCLI[225534]: User 'admin' committed the configuration. Mar 21 17:20:03.047191 osdx OSDxCLI[225534]: User 'admin' left the configuration menu. Mar 21 17:20:04.908540 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=18118 DF PROTO=TCP SPT=35728 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 21 17:20:04.920412 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=49925 DF PROTO=TCP SPT=35734 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Mar 21 17:20:09.032107 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Mar 21 17:20:15.560090 osdx systemd[1]: Starting logrotate.service - Rotate log files... Mar 21 17:20:15.560968 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Mar 21 17:20:15.619110 osdx systemd[1]: logrotate.service: Deactivated successfully. Mar 21 17:20:15.619296 osdx systemd[1]: Finished logrotate.service - Rotate log files. Mar 21 17:20:15.811976 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'system journal show | cat'. Mar 21 17:20:16.493806 osdx OSDxCLI[225534]: User 'admin' entered the configuration menu. Mar 21 17:20:16.646170 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Mar 21 17:20:16.825600 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Mar 21 17:20:17.002549 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Mar 21 17:20:17.214782 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Mar 21 17:20:17.403519 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Mar 21 17:20:17.566503 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Mar 21 17:20:17.889054 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Mar 21 17:20:18.133391 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Mar 21 17:20:18.269679 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Mar 21 17:20:18.487806 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Mar 21 17:20:18.666893 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Mar 21 17:20:18.847806 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Mar 21 17:20:19.034417 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Mar 21 17:20:19.218632 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Mar 21 17:20:19.435820 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Mar 21 17:20:19.589370 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Mar 21 17:20:19.784391 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Mar 21 17:20:20.022574 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Mar 21 17:20:20.179234 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Mar 21 17:20:20.319688 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Mar 21 17:20:20.463459 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Mar 21 17:20:20.898572 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Mar 21 17:20:21.019657 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Mar 21 17:20:21.232815 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Mar 21 17:20:21.414280 osdx OSDxCLI[225534]: User 'admin' added a new cfg line: 'show changes'. Mar 21 17:20:21.590628 osdx ubnt-cfgd[226600]: inactive Mar 21 17:20:22.347625 osdx INFO[226620]: FRR daemons did not change Mar 21 17:20:22.649847 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Mar 21 17:20:24.655405 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Mar 21 17:20:24.655548 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Mar 21 17:20:24.655595 osdx systemd[1]: suricata@FW.service: Consumed 2.201s CPU time. Mar 21 17:20:24.673016 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Mar 21 17:20:24.700428 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Mar 21 17:20:25.114135 osdx INFO[226645]: Rules successfully loaded Mar 21 17:20:25.115573 osdx cfgd[1672]: [225534]Completed change to active configuration Mar 21 17:20:25.119087 osdx OSDxCLI[225534]: User 'admin' committed the configuration. Mar 21 17:20:25.151346 osdx OSDxCLI[225534]: User 'admin' left the configuration menu. Mar 21 17:20:25.564410 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=2784 DF PROTO=TCP SPT=40100 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Mar 21 17:20:25.564552 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=56156 DF PROTO=TCP SPT=40116 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Mar 21 17:20:36.047311 osdx OSDxCLI[225534]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 10315 0 --:--:-- --:--:-- --:--:-- 10750
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=1.65 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.647/1.647/1.647/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.968 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.968/0.968/0.968/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 46944 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 10.3 MBytes 86.6 Mbits/sec 0 410 KBytes [ 5] 1.00-2.00 sec 11.7 MBytes 97.9 Mbits/sec 0 881 KBytes [ 5] 2.00-3.00 sec 48.8 MBytes 409 Mbits/sec 185 1.47 MBytes [ 5] 3.00-4.00 sec 31.2 MBytes 262 Mbits/sec 1 1.13 MBytes [ 5] 4.00-5.00 sec 56.2 MBytes 472 Mbits/sec 0 1.20 MBytes [ 5] 5.00-6.00 sec 50.0 MBytes 420 Mbits/sec 0 1.25 MBytes [ 5] 6.00-7.00 sec 101 MBytes 849 Mbits/sec 0 1.29 MBytes [ 5] 7.00-8.00 sec 81.2 MBytes 682 Mbits/sec 0 1.31 MBytes [ 5] 8.00-9.00 sec 91.2 MBytes 765 Mbits/sec 0 1.32 MBytes [ 5] 9.00-10.00 sec 141 MBytes 1.19 Gbits/sec 0 1.37 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 623 MBytes 523 Mbits/sec 186 sender [ 5] 0.00-10.01 sec 621 MBytes 521 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/21/2025-17:21:29.969006 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46928 -> 40.0.0.2:5001 03/21/2025-17:21:29.978106 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46944 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=46928 dport=5001 packets=14 bytes=1195 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46928 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=46944 dport=5001 packets=451015 bytes=676518201 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46944 packets=37639 bytes=1952436 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 18 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=9 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=9 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 18 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=105 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=105 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 49808 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 62.8 MBytes 526 Mbits/sec 46 1.36 MBytes [ 5] 1.00-2.00 sec 41.2 MBytes 346 Mbits/sec 0 1.50 MBytes [ 5] 2.00-3.00 sec 130 MBytes 1.09 Gbits/sec 85 1.14 MBytes [ 5] 3.00-4.00 sec 60.0 MBytes 503 Mbits/sec 0 1.21 MBytes [ 5] 4.00-5.00 sec 62.5 MBytes 524 Mbits/sec 0 1.26 MBytes [ 5] 5.00-6.00 sec 73.8 MBytes 619 Mbits/sec 0 1.30 MBytes [ 5] 6.00-7.00 sec 48.8 MBytes 409 Mbits/sec 0 1.32 MBytes [ 5] 7.00-8.00 sec 68.8 MBytes 577 Mbits/sec 0 1.33 MBytes [ 5] 8.00-9.00 sec 53.8 MBytes 451 Mbits/sec 0 1.33 MBytes [ 5] 9.00-10.00 sec 50.0 MBytes 419 Mbits/sec 0 1.35 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 652 MBytes 546 Mbits/sec 131 sender [ 5] 0.00-10.05 sec 649 MBytes 542 Mbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/21/2025-17:21:29.969006 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46928 -> 40.0.0.2:5001 03/21/2025-17:21:29.978106 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46944 -> 40.0.0.2:5001 03/21/2025-17:21:50.793149 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49798 -> 40.0.0.2:5001 03/21/2025-17:21:50.797039 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49808 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 18 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=49798 dport=5001 packets=17 bytes=1365 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49798 packets=15 bytes=1133 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 8 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=49808 dport=5001 packets=471088 bytes=706627701 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49808 packets=29506 bytes=1533324 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 951 0 --:--:-- --:--:-- --:--:-- 952
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.730 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.730/0.730/0.730/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.787 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.787/0.787/0.787/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
03/21/2025-17:22:46.129044 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49386 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 25 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=108 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=108 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=12 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=12 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=49386 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=49386 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
03/21/2025-17:22:46.129044 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49386 -> 40.0.0.2:5000 03/21/2025-17:22:54.730181 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49386 -> 40.0.0.2:5000 03/21/2025-17:22:56.862953 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41542 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=41542 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=41542 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 5 7 263 376 2 - 2 2 113 113 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 10 499 740 2 - 4 4 241 241 --------------------------------------------------------------------- Total 10 10 740 740
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 27873 0 --:--:-- --:--:-- --:--:-- 32250
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=3.42 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 3.423/3.423/3.423/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=9.60 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 9.599/9.599/9.599/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
03/21/2025-17:23:37.642059 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46788 -> 40.0.0.2:5001 03/21/2025-17:23:37.691936 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46804 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46804 dport=5001 packets=2998 bytes=4492701 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46804 packets=412 bytes=21528 [ASSURED] [OFFLOAD, packets=2989 bytes=4483500 packets=410 bytes=21416] mark=129834765 use=2 icmp 1 28 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=111 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=111 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 28 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=15 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=15 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46788 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46788 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 94125 0 --:--:-- --:--:-- --:--:-- 129k
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
03/21/2025-17:23:37.642059 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46788 -> 40.0.0.2:5001 03/21/2025-17:23:37.691936 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46804 -> 40.0.0.2:5001 03/21/2025-17:23:42.333602 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46820 -> 40.0.0.2:5001 03/21/2025-17:23:42.341901 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:57916 -> 40.0.0.2:5001 03/21/2025-17:23:42.357382 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:57916 -> 40.0.0.2:5001 03/21/2025-17:23:42.382170 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:57916 -> 40.0.0.2:5001 03/21/2025-17:23:42.382279 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:57916 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
udp 17 src=20.0.0.2 dst=40.0.0.2 sport=57916 dport=5001 packets=33 bytes=47264 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=57916 packets=1 bytes=32 [OFFLOAD, packets=28 bytes=41328 packets=0 bytes=0] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46820 dport=5001 packets=7 bytes=555 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46820 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=4 bytes=211] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 19306 0 --:--:-- --:--:-- --:--:-- 20000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=8.85 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 8.851/8.851/8.851/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.829 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.829/0.829/0.829/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
03/21/2025-17:24:18.517169 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47378 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 47378 yes 201 0 0 0 20.0.0.2 40.0.0.2 47378 5000 yes 201 0 9 731
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250211s ending at 1742577862.727769 XDP_DROP 10 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 15 pkts ( 0 pps) 1 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
03/21/2025-17:24:18.517169 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47378 -> 40.0.0.2:5000 03/21/2025-17:24:23.078614 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:57943 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 57943 no 201 0 0 0 40.0.0.2 20.0.0.2 5000 47378 yes 201 0 0 0 20.0.0.2 40.0.0.2 47378 5000 yes 201 0 12 905 20.0.0.2 40.0.0.2 57943 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250433s ending at 1742577867.052035 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 35 pkts ( 0 pps) 2 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)