Check Link Hook

This scenario shows how to attach a traffic policy to the link hook in an Ethernet interface. This hook is triggered at a very early stage of the network packet stack (level 2 layer).

Test Early Packet Drop

Description

A traffic policy is configured in DUT0 to drop all incoming traffic at the link stage. ARP and ICMP packets are allowed.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy link-in EDROP_POLICY
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy EDROP_POLICY rule 1 action accept
set traffic policy EDROP_POLICY rule 1 selector ACCEPT_SEL
set traffic policy EDROP_POLICY rule 2 action drop
set traffic selector ACCEPT_SEL rule 1 protocol icmp
set traffic selector ACCEPT_SEL rule 2 ether-type arp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Send arp ping from DUT1 to IP address 10.0.0.1:

admin@DUT1$ arping 10.0.0.1 interface eth0 timeout 5 count 1

Show output

ARPING 10.0.0.1 from 10.0.0.2 eth0
Unicast reply from 10.0.0.1 [DE:AD:BE:EF:6C:00]  0.737ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)

Step 4: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Show output

PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.313 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.313/0.313/0.313/0.000 ms

Step 5: Expect a failure in the following command: Initiate a tcp connection from DUT1 to DUT0 and try to send some messages between both endpoints

admin@DUT0$ monitor test connection server 2000 tcp
admin@DUT1$ monitor test connection client 10.0.0.1 2000 tcp

Step 6: Expect a failure in the following command: Initiate a udp connection from DUT1 to DUT0 and try to send some messages between both endpoints

admin@DUT0$ monitor test connection server 3000 udp
admin@DUT1$ monitor test connection client 10.0.0.1 3000 udp

Step 7: Run command traffic policy show at DUT0 and check if output matches the following regular expressions:

1\s+ACCEPT_SEL\s+\b[^0]\d*

Show output

Policy EDROP_POLICY -- ifc eth0 -- hook link-in prio very-high

-----------------------------------------------------------------
rule    selector   pkts match  pkts eval  bytes match  bytes eval
-----------------------------------------------------------------
1      ACCEPT_SEL           4         10          168         516
2      -                    6          6          348         348
-----------------------------------------------------------------
Total                      10         10          516         516

---