Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 19179 0 --:--:-- --:--:-- --:--:-- 21500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.535 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.535/0.535/0.535/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.518 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.518/0.518/0.518/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 59530 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 56.8 MBytes 476 Mbits/sec 0 2.17 MBytes [ 5] 1.00-2.00 sec 47.5 MBytes 398 Mbits/sec 84 1.30 MBytes [ 5] 2.00-3.00 sec 65.0 MBytes 545 Mbits/sec 0 1.39 MBytes [ 5] 3.00-4.00 sec 60.0 MBytes 503 Mbits/sec 0 1.45 MBytes [ 5] 4.00-5.00 sec 93.8 MBytes 786 Mbits/sec 0 1.50 MBytes [ 5] 5.00-6.00 sec 97.5 MBytes 818 Mbits/sec 0 1.53 MBytes [ 5] 6.00-7.00 sec 97.5 MBytes 818 Mbits/sec 0 1.55 MBytes [ 5] 7.00-8.00 sec 97.5 MBytes 818 Mbits/sec 0 1.56 MBytes [ 5] 8.00-9.00 sec 95.0 MBytes 797 Mbits/sec 0 1.58 MBytes [ 5] 9.00-10.00 sec 97.5 MBytes 818 Mbits/sec 0 1.63 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 808 MBytes 678 Mbits/sec 84 sender [ 5] 0.00-10.01 sec 807 MBytes 676 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/14/2025-11:26:54.300592 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59522 -> 40.0.0.2:5001 05/14/2025-11:26:54.301791 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59530 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 419 0 --:--:-- --:--:-- --:--:-- 420
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.580 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.580/0.580/0.580/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.462 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.462/0.462/0.462/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 49600 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 71.0 MBytes 596 Mbits/sec 0 2.08 MBytes [ 5] 1.00-2.00 sec 214 MBytes 1.79 Gbits/sec 4 1.79 MBytes [ 5] 2.00-3.00 sec 268 MBytes 2.24 Gbits/sec 0 1.94 MBytes [ 5] 3.00-4.00 sec 304 MBytes 2.55 Gbits/sec 0 2.06 MBytes [ 5] 4.00-5.00 sec 291 MBytes 2.44 Gbits/sec 11 1.50 MBytes [ 5] 5.00-6.00 sec 279 MBytes 2.34 Gbits/sec 0 1.64 MBytes [ 5] 6.00-7.00 sec 295 MBytes 2.47 Gbits/sec 0 1.76 MBytes [ 5] 7.00-8.00 sec 312 MBytes 2.62 Gbits/sec 0 1.87 MBytes [ 5] 8.00-9.00 sec 329 MBytes 2.76 Gbits/sec 11 1.41 MBytes [ 5] 9.00-10.00 sec 301 MBytes 2.53 Gbits/sec 0 1.57 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.60 GBytes 2.23 Gbits/sec 26 sender [ 5] 0.00-10.00 sec 2.60 GBytes 2.23 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/14/2025-11:27:29.525808 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49588 -> 40.0.0.2:5001 05/14/2025-11:27:29.526875 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49600 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 14 11:27:19.000471 osdx systemd-timedated[285260]: Changed local time to Wed 2025-05-14 11:27:19 UTC May 14 11:27:19.002349 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'set date 2025-05-14 11:27:19'. May 14 11:27:19.003050 osdx systemd-journald[1884]: Time jumped backwards, rotating. May 14 11:27:19.324437 osdx systemd-journald[1884]: Runtime Journal (/run/log/journal/0288f6065d6743618e90e784ba8b9df5) is 2.1M, max 15.3M, 13.2M free. May 14 11:27:19.327067 osdx systemd-journald[1884]: Received client request to rotate journal, rotating. May 14 11:27:19.327123 osdx systemd-journald[1884]: Vacuuming done, freed 0B of archived journals from /run/log/journal/0288f6065d6743618e90e784ba8b9df5. May 14 11:27:19.336166 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'system journal clear'. May 14 11:27:19.674686 osdx osdx-coredump[285278]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 14 11:27:19.683663 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'system coredump delete all'. May 14 11:27:20.224660 osdx OSDxCLI[284835]: User 'admin' entered the configuration menu. May 14 11:27:20.347829 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 14 11:27:20.434294 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 14 11:27:20.521138 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 14 11:27:20.588653 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 14 11:27:20.693387 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 14 11:27:20.748313 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 14 11:27:20.870768 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'show working'. May 14 11:27:20.947832 osdx ubnt-cfgd[285300]: inactive May 14 11:27:20.977441 osdx INFO[285310]: FRR daemons did not change May 14 11:27:20.999080 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 14 11:27:21.071057 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 14 11:27:21.099972 osdx (udev-worker)[285433]: Network interface NamePolicy= disabled on kernel command line. May 14 11:27:21.268493 osdx cfgd[1681]: [284835]Completed change to active configuration May 14 11:27:21.279812 osdx OSDxCLI[284835]: User 'admin' committed the configuration. May 14 11:27:21.297323 osdx OSDxCLI[284835]: User 'admin' left the configuration menu. May 14 11:27:23.555987 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 14 11:27:23.634624 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 14 11:27:23.773980 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 14 11:27:24.327839 osdx file_operation[285589]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 14 11:27:24.654966 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 14 11:27:24.804724 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 14 11:27:24.960069 osdx OSDxCLI[284835]: User 'admin' entered the configuration menu. May 14 11:27:25.022851 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 14 11:27:25.121620 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 14 11:27:25.177328 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 14 11:27:25.275543 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 14 11:27:25.333943 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 14 11:27:25.442008 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 14 11:27:25.529451 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 14 11:27:25.614639 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 14 11:27:25.671891 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 14 11:27:25.795292 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 14 11:27:25.857753 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 14 11:27:25.961765 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 14 11:27:26.019504 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 14 11:27:26.123375 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 14 11:27:26.180221 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 14 11:27:26.281921 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 14 11:27:26.338853 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 14 11:27:27.162064 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 14 11:27:27.220117 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 14 11:27:27.316998 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 14 11:27:27.422033 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'show working'. May 14 11:27:27.514493 osdx ubnt-cfgd[285640]: inactive May 14 11:27:27.583885 osdx INFO[285677]: FRR daemons did not change May 14 11:27:27.856647 osdx systemd[1]: Reloading. May 14 11:27:27.999056 osdx systemd-sysv-generator[285730]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 14 11:27:28.119356 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 14 11:27:28.136740 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 14 11:27:28.315621 osdx INFO[285712]: Rules successfully loaded May 14 11:27:28.316378 osdx cfgd[1681]: [284835]Completed change to active configuration May 14 11:27:28.318337 osdx OSDxCLI[284835]: User 'admin' committed the configuration. May 14 11:27:29.185778 osdx OSDxCLI[284835]: User 'admin' left the configuration menu. May 14 11:27:29.527063 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=25153 DF PROTO=TCP SPT=49588 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 14 11:27:29.527144 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=25329 DF PROTO=TCP SPT=49600 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 14 11:27:39.811141 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 53762 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 293 MBytes 2.46 Gbits/sec 17 1.88 MBytes [ 5] 1.00-2.00 sec 292 MBytes 2.45 Gbits/sec 0 2.03 MBytes [ 5] 2.00-3.00 sec 298 MBytes 2.50 Gbits/sec 0 2.16 MBytes [ 5] 3.00-4.00 sec 308 MBytes 2.58 Gbits/sec 19 1.62 MBytes [ 5] 4.00-5.00 sec 310 MBytes 2.60 Gbits/sec 0 1.75 MBytes [ 5] 5.00-6.00 sec 294 MBytes 2.46 Gbits/sec 0 1.87 MBytes [ 5] 6.00-7.00 sec 278 MBytes 2.33 Gbits/sec 0 1.97 MBytes [ 5] 7.00-8.00 sec 275 MBytes 2.31 Gbits/sec 0 2.07 MBytes [ 5] 8.00-9.00 sec 310 MBytes 2.60 Gbits/sec 311 1.58 MBytes [ 5] 9.00-10.00 sec 328 MBytes 2.75 Gbits/sec 0 1.72 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.91 GBytes 2.50 Gbits/sec 347 sender [ 5] 0.00-10.00 sec 2.91 GBytes 2.50 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/14/2025-11:27:29.525808 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49588 -> 40.0.0.2:5001 05/14/2025-11:27:29.526875 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49600 -> 40.0.0.2:5001 05/14/2025-11:27:44.580919 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53758 -> 40.0.0.2:5001 05/14/2025-11:27:44.581947 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53762 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 14 11:27:19.000471 osdx systemd-timedated[285260]: Changed local time to Wed 2025-05-14 11:27:19 UTC May 14 11:27:19.002349 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'set date 2025-05-14 11:27:19'. May 14 11:27:19.003050 osdx systemd-journald[1884]: Time jumped backwards, rotating. May 14 11:27:19.324437 osdx systemd-journald[1884]: Runtime Journal (/run/log/journal/0288f6065d6743618e90e784ba8b9df5) is 2.1M, max 15.3M, 13.2M free. May 14 11:27:19.327067 osdx systemd-journald[1884]: Received client request to rotate journal, rotating. May 14 11:27:19.327123 osdx systemd-journald[1884]: Vacuuming done, freed 0B of archived journals from /run/log/journal/0288f6065d6743618e90e784ba8b9df5. May 14 11:27:19.336166 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'system journal clear'. May 14 11:27:19.674686 osdx osdx-coredump[285278]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 14 11:27:19.683663 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'system coredump delete all'. May 14 11:27:20.224660 osdx OSDxCLI[284835]: User 'admin' entered the configuration menu. May 14 11:27:20.347829 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 14 11:27:20.434294 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 14 11:27:20.521138 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 14 11:27:20.588653 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 14 11:27:20.693387 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 14 11:27:20.748313 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 14 11:27:20.870768 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'show working'. May 14 11:27:20.947832 osdx ubnt-cfgd[285300]: inactive May 14 11:27:20.977441 osdx INFO[285310]: FRR daemons did not change May 14 11:27:20.999080 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 14 11:27:21.071057 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 14 11:27:21.099972 osdx (udev-worker)[285433]: Network interface NamePolicy= disabled on kernel command line. May 14 11:27:21.268493 osdx cfgd[1681]: [284835]Completed change to active configuration May 14 11:27:21.279812 osdx OSDxCLI[284835]: User 'admin' committed the configuration. May 14 11:27:21.297323 osdx OSDxCLI[284835]: User 'admin' left the configuration menu. May 14 11:27:23.555987 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 14 11:27:23.634624 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 14 11:27:23.773980 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 14 11:27:24.327839 osdx file_operation[285589]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 14 11:27:24.654966 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 14 11:27:24.804724 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 14 11:27:24.960069 osdx OSDxCLI[284835]: User 'admin' entered the configuration menu. May 14 11:27:25.022851 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 14 11:27:25.121620 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 14 11:27:25.177328 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 14 11:27:25.275543 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 14 11:27:25.333943 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 14 11:27:25.442008 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 14 11:27:25.529451 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 14 11:27:25.614639 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 14 11:27:25.671891 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 14 11:27:25.795292 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 14 11:27:25.857753 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 14 11:27:25.961765 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 14 11:27:26.019504 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 14 11:27:26.123375 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 14 11:27:26.180221 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 14 11:27:26.281921 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 14 11:27:26.338853 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 14 11:27:27.162064 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 14 11:27:27.220117 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 14 11:27:27.316998 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 14 11:27:27.422033 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'show working'. May 14 11:27:27.514493 osdx ubnt-cfgd[285640]: inactive May 14 11:27:27.583885 osdx INFO[285677]: FRR daemons did not change May 14 11:27:27.856647 osdx systemd[1]: Reloading. May 14 11:27:27.999056 osdx systemd-sysv-generator[285730]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 14 11:27:28.119356 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 14 11:27:28.136740 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 14 11:27:28.315621 osdx INFO[285712]: Rules successfully loaded May 14 11:27:28.316378 osdx cfgd[1681]: [284835]Completed change to active configuration May 14 11:27:28.318337 osdx OSDxCLI[284835]: User 'admin' committed the configuration. May 14 11:27:29.185778 osdx OSDxCLI[284835]: User 'admin' left the configuration menu. May 14 11:27:29.527063 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=25153 DF PROTO=TCP SPT=49588 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 14 11:27:29.527144 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=25329 DF PROTO=TCP SPT=49600 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 14 11:27:39.811141 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. May 14 11:27:39.914460 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'system journal show | cat'. May 14 11:27:40.105084 osdx OSDxCLI[284835]: User 'admin' entered the configuration menu. May 14 11:27:40.164857 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 14 11:27:40.271294 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 14 11:27:40.325235 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 14 11:27:40.421812 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 14 11:27:40.478891 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 14 11:27:40.575304 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 14 11:27:40.653545 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 14 11:27:40.731838 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 14 11:27:40.786922 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 14 11:27:40.889950 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 14 11:27:40.945091 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 14 11:27:41.048080 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 14 11:27:41.104756 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 14 11:27:41.205808 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 14 11:27:41.259103 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 14 11:27:41.528033 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 14 11:27:41.586839 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 14 11:27:41.723269 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 14 11:27:41.782783 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 14 11:27:41.870806 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 14 11:27:41.930936 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. May 14 11:27:42.029827 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. May 14 11:27:42.088287 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. May 14 11:27:42.192147 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. May 14 11:27:42.273585 osdx OSDxCLI[284835]: User 'admin' added a new cfg line: 'show changes'. May 14 11:27:42.374459 osdx ubnt-cfgd[285855]: inactive May 14 11:27:42.423065 osdx INFO[285871]: FRR daemons did not change May 14 11:27:42.699579 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... May 14 11:27:44.101759 osdx systemd[1]: suricata@FW.service: Deactivated successfully. May 14 11:27:44.101858 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. May 14 11:27:44.101888 osdx systemd[1]: suricata@FW.service: Consumed 1.439s CPU time. May 14 11:27:44.123495 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 14 11:27:44.140941 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 14 11:27:44.324914 osdx INFO[285896]: Rules successfully loaded May 14 11:27:44.325461 osdx cfgd[1681]: [284835]Completed change to active configuration May 14 11:27:44.327701 osdx OSDxCLI[284835]: User 'admin' committed the configuration. May 14 11:27:44.352825 osdx OSDxCLI[284835]: User 'admin' left the configuration menu. May 14 11:27:44.583086 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=5036 DF PROTO=TCP SPT=53758 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 14 11:27:44.583160 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=36731 DF PROTO=TCP SPT=53762 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 14 11:27:49.032080 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. May 14 11:27:54.859152 osdx OSDxCLI[284835]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 56554 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.595 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.595/0.595/0.595/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.524 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.524/0.524/0.524/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 35120 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 86.2 MBytes 722 Mbits/sec 17 1.80 MBytes [ 5] 1.00-2.00 sec 65.0 MBytes 546 Mbits/sec 0 1.96 MBytes [ 5] 2.00-3.00 sec 256 MBytes 2.15 Gbits/sec 103 1.51 MBytes [ 5] 3.00-4.00 sec 254 MBytes 2.13 Gbits/sec 0 1.61 MBytes [ 5] 4.00-5.00 sec 336 MBytes 2.82 Gbits/sec 0 1.73 MBytes [ 5] 5.00-6.00 sec 310 MBytes 2.60 Gbits/sec 0 1.83 MBytes [ 5] 6.00-7.00 sec 269 MBytes 2.25 Gbits/sec 0 1.92 MBytes [ 5] 7.00-8.00 sec 261 MBytes 2.19 Gbits/sec 165 1.41 MBytes [ 5] 8.00-9.00 sec 301 MBytes 2.53 Gbits/sec 0 1.57 MBytes [ 5] 9.00-10.00 sec 274 MBytes 2.30 Gbits/sec 0 1.70 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.36 GBytes 2.02 Gbits/sec 285 sender [ 5] 0.00-10.01 sec 2.35 GBytes 2.02 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/14/2025-11:28:18.973095 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35118 -> 40.0.0.2:5001 05/14/2025-11:28:18.974102 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35120 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=35118 dport=5001 packets=16 bytes=1302 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=35118 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=510 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=510 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=35120 dport=5001 packets=1746656 bytes=2619973221 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=35120 packets=94336 bytes=4908564 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=122 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=122 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 50752 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 254 MBytes 2.13 Gbits/sec 8 1.90 MBytes [ 5] 1.00-2.00 sec 288 MBytes 2.41 Gbits/sec 0 2.06 MBytes [ 5] 2.00-3.00 sec 278 MBytes 2.33 Gbits/sec 0 2.19 MBytes [ 5] 3.00-4.00 sec 265 MBytes 2.21 Gbits/sec 151 1.14 MBytes [ 5] 4.00-5.00 sec 248 MBytes 2.09 Gbits/sec 0 1.28 MBytes [ 5] 5.00-6.00 sec 291 MBytes 2.44 Gbits/sec 0 1.44 MBytes [ 5] 6.00-7.00 sec 301 MBytes 2.53 Gbits/sec 0 1.58 MBytes [ 5] 7.00-8.00 sec 309 MBytes 2.59 Gbits/sec 0 1.72 MBytes [ 5] 8.00-9.00 sec 272 MBytes 2.29 Gbits/sec 0 1.83 MBytes [ 5] 9.00-10.00 sec 250 MBytes 2.10 Gbits/sec 0 1.92 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.69 GBytes 2.31 Gbits/sec 159 sender [ 5] 0.00-10.00 sec 2.69 GBytes 2.31 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/14/2025-11:28:18.973095 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35118 -> 40.0.0.2:5001 05/14/2025-11:28:18.974102 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35120 -> 40.0.0.2:5001 05/14/2025-11:28:33.668539 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:50736 -> 40.0.0.2:5001 05/14/2025-11:28:33.669379 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:50752 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=50736 dport=5001 packets=16 bytes=1298 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=50736 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=50752 dport=5001 packets=1995423 bytes=2993124409 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=50752 packets=332053 bytes=17254848 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 1764 0 --:--:-- --:--:-- --:--:-- 1769
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.483 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.483/0.483/0.483/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.475 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.475/0.475/0.475/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/14/2025-11:29:05.844423 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45044 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=45044 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=45044 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=125 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=125 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=513 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=513 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/14/2025-11:29:05.844423 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45044 -> 40.0.0.2:5000 05/14/2025-11:29:12.189911 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45044 -> 40.0.0.2:5000 05/14/2025-11:29:13.713578 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56700 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=56700 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=56700 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 780 2 - 5 5 281 281 --------------------------------------------------------------------- Total 11 11 780 780
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 42630 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.505 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.505/0.505/0.505/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.478 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.478/0.478/0.478/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/14/2025-11:29:37.570976 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44416 -> 40.0.0.2:5001 05/14/2025-11:29:37.572027 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44430 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=516 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=516 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=44416 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=44416 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=44430 dport=5001 packets=19106 bytes=28653253 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=44430 packets=2778 bytes=144512 [ASSURED] [OFFLOAD, packets=19096 bytes=28642552 packets=2776 bytes=144400] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=128 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=128 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 1162 0 --:--:-- --:--:-- --:--:-- 1166
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
05/14/2025-11:29:37.570976 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44416 -> 40.0.0.2:5001 05/14/2025-11:29:37.572027 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:44430 -> 40.0.0.2:5001 05/14/2025-11:29:40.755534 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:38778 -> 40.0.0.2:5001 05/14/2025-11:29:40.757202 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:53854 -> 40.0.0.2:5001 05/14/2025-11:29:40.767893 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:53854 -> 40.0.0.2:5001 05/14/2025-11:29:40.779888 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:53854 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
udp 17 src=20.0.0.2 dst=40.0.0.2 sport=53854 dport=5001 packets=21 bytes=29552 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53854 packets=1 bytes=32 [OFFLOAD, packets=17 bytes=25092 packets=0 bytes=0] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=38778 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=38778 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 40841 0 --:--:-- --:--:-- --:--:-- 50000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.612 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.612/0.612/0.612/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.568 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.568/0.568/0.568/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/14/2025-11:30:01.736473 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45242 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 45242 5000 yes 201 0 8 673 40.0.0.2 20.0.0.2 5000 45242 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250328s ending at 1747222205.483211 XDP_DROP 9 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10073409 pkts ( 8 pps) 13153134 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
05/14/2025-11:30:01.736473 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:45242 -> 40.0.0.2:5000 05/14/2025-11:30:05.653035 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:56419 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 45242 5000 yes 201 0 11 847 20.0.0.2 40.0.0.2 56419 5001 no 201 0 0 0 40.0.0.2 20.0.0.2 5001 56419 no 201 0 0 0 40.0.0.2 20.0.0.2 5000 45242 yes 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250136s ending at 1747222209.370236 XDP_DROP 11 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10073449 pkts ( 0 pps) 13153137 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)