Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 3750 0 --:--:-- --:--:-- --:--:-- 3794
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.533 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.533/0.533/0.533/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.486 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.486/0.486/0.486/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 54238 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 64.1 MBytes 537 Mbits/sec 9 1.58 MBytes [ 5] 1.00-2.00 sec 75.0 MBytes 630 Mbits/sec 0 1.76 MBytes [ 5] 2.00-3.00 sec 105 MBytes 881 Mbits/sec 0 1.89 MBytes [ 5] 3.00-4.00 sec 110 MBytes 923 Mbits/sec 0 1.99 MBytes [ 5] 4.00-5.00 sec 112 MBytes 944 Mbits/sec 132 1.49 MBytes [ 5] 5.00-6.00 sec 104 MBytes 870 Mbits/sec 0 1.56 MBytes [ 5] 6.00-7.00 sec 60.0 MBytes 503 Mbits/sec 0 1.62 MBytes [ 5] 7.00-8.00 sec 52.5 MBytes 440 Mbits/sec 0 1.66 MBytes [ 5] 8.00-9.00 sec 78.8 MBytes 660 Mbits/sec 0 1.68 MBytes [ 5] 9.00-10.00 sec 112 MBytes 944 Mbits/sec 0 1.70 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 874 MBytes 733 Mbits/sec 141 sender [ 5] 0.00-10.01 sec 872 MBytes 731 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/13/2025-18:04:09.513757 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54226 -> 40.0.0.2:5001 05/13/2025-18:04:09.514704 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54238 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 21680 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.475 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.475/0.475/0.475/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.501 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.501/0.501/0.501/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 57340 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 251 MBytes 2.11 Gbits/sec 49 1.93 MBytes [ 5] 1.00-2.00 sec 279 MBytes 2.34 Gbits/sec 82 1.47 MBytes [ 5] 2.00-3.00 sec 288 MBytes 2.41 Gbits/sec 0 1.61 MBytes [ 5] 3.00-4.00 sec 304 MBytes 2.55 Gbits/sec 0 1.74 MBytes [ 5] 4.00-5.00 sec 278 MBytes 2.33 Gbits/sec 0 1.85 MBytes [ 5] 5.00-6.00 sec 176 MBytes 1.48 Gbits/sec 3 1.81 MBytes [ 5] 6.00-7.00 sec 295 MBytes 2.47 Gbits/sec 0 1.99 MBytes [ 5] 7.00-8.00 sec 295 MBytes 2.47 Gbits/sec 0 2.14 MBytes [ 5] 8.00-9.00 sec 346 MBytes 2.90 Gbits/sec 0 2.26 MBytes [ 5] 9.00-10.00 sec 289 MBytes 2.42 Gbits/sec 6 1.69 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.73 GBytes 2.35 Gbits/sec 140 sender [ 5] 0.00-10.00 sec 2.73 GBytes 2.35 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/13/2025-18:04:43.728706 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57324 -> 40.0.0.2:5001 05/13/2025-18:04:43.729615 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57340 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 13 18:04:34.414808 osdx systemd-journald[27261]: Runtime Journal (/run/log/journal/29acf74054db4c3a94b562797c4c13a9) is 1.9M, max 15.3M, 13.4M free. May 13 18:04:34.417326 osdx systemd-journald[27261]: Received client request to rotate journal, rotating. May 13 18:04:34.417390 osdx systemd-journald[27261]: Vacuuming done, freed 0B of archived journals from /run/log/journal/29acf74054db4c3a94b562797c4c13a9. May 13 18:04:34.426231 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'system journal clear'. May 13 18:04:34.892518 osdx osdx-coredump[313305]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 13 18:04:34.902290 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'system coredump delete all'. May 13 18:04:35.439001 osdx OSDxCLI[312864]: User 'admin' entered the configuration menu. May 13 18:04:35.546501 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 13 18:04:35.621910 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 13 18:04:35.725796 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 13 18:04:35.818690 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 13 18:04:35.925218 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 13 18:04:36.080490 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 13 18:04:36.242384 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'show working'. May 13 18:04:36.336334 osdx ubnt-cfgd[313327]: inactive May 13 18:04:36.372803 osdx INFO[313337]: FRR daemons did not change May 13 18:04:36.397346 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 13 18:04:36.469356 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 13 18:04:36.493694 osdx (udev-worker)[313459]: Network interface NamePolicy= disabled on kernel command line. May 13 18:04:36.651754 osdx cfgd[1470]: [312864]Completed change to active configuration May 13 18:04:36.663745 osdx OSDxCLI[312864]: User 'admin' committed the configuration. May 13 18:04:36.693338 osdx OSDxCLI[312864]: User 'admin' left the configuration menu. May 13 18:04:39.170982 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 13 18:04:39.293666 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 13 18:04:39.412532 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 13 18:04:40.017444 osdx file_operation[313616]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 13 18:04:40.044785 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 13 18:04:40.215747 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 13 18:04:40.365212 osdx OSDxCLI[312864]: User 'admin' entered the configuration menu. May 13 18:04:40.440704 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 13 18:04:40.538517 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 13 18:04:40.596683 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 13 18:04:40.693879 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 13 18:04:40.754226 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 13 18:04:40.841460 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 13 18:04:40.946769 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 13 18:04:41.054144 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 13 18:04:41.176363 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 13 18:04:41.275513 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 13 18:04:41.332841 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 13 18:04:41.451830 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 13 18:04:41.700483 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 13 18:04:41.778326 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 13 18:04:41.924486 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 13 18:04:42.051558 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 13 18:04:42.142244 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 13 18:04:42.224165 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 13 18:04:42.300401 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 13 18:04:42.398276 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 13 18:04:42.493245 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'show working'. May 13 18:04:42.577538 osdx ubnt-cfgd[313667]: inactive May 13 18:04:42.649275 osdx INFO[313704]: FRR daemons did not change May 13 18:04:42.916968 osdx systemd[1]: Reloading. May 13 18:04:42.937320 osdx systemd-sysv-generator[313757]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 13 18:04:43.073703 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 13 18:04:43.091591 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 13 18:04:43.309571 osdx INFO[313739]: Rules successfully loaded May 13 18:04:43.310377 osdx cfgd[1470]: [312864]Completed change to active configuration May 13 18:04:43.312180 osdx OSDxCLI[312864]: User 'admin' committed the configuration. May 13 18:04:43.330146 osdx OSDxCLI[312864]: User 'admin' left the configuration menu. May 13 18:04:43.729319 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=32274 DF PROTO=TCP SPT=57324 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 13 18:04:43.733513 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=45332 DF PROTO=TCP SPT=57340 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 13 18:04:54.006409 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 41700 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 242 MBytes 2.03 Gbits/sec 57 1.28 MBytes [ 5] 1.00-2.00 sec 232 MBytes 1.95 Gbits/sec 0 1.41 MBytes [ 5] 2.00-3.00 sec 242 MBytes 2.03 Gbits/sec 0 1.52 MBytes [ 5] 3.00-4.00 sec 269 MBytes 2.25 Gbits/sec 0 1.64 MBytes [ 5] 4.00-5.00 sec 240 MBytes 2.01 Gbits/sec 0 1.74 MBytes [ 5] 5.00-6.00 sec 265 MBytes 2.22 Gbits/sec 0 1.84 MBytes [ 5] 6.00-7.00 sec 274 MBytes 2.30 Gbits/sec 0 1.94 MBytes [ 5] 7.00-8.00 sec 285 MBytes 2.39 Gbits/sec 0 2.05 MBytes [ 5] 8.00-9.00 sec 321 MBytes 2.69 Gbits/sec 0 2.15 MBytes [ 5] 9.00-10.00 sec 335 MBytes 2.81 Gbits/sec 0 2.24 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.64 GBytes 2.27 Gbits/sec 57 sender [ 5] 0.00-10.00 sec 2.64 GBytes 2.27 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/13/2025-18:04:43.728706 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57324 -> 40.0.0.2:5001 05/13/2025-18:04:43.729615 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57340 -> 40.0.0.2:5001 05/13/2025-18:04:59.596108 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41688 -> 40.0.0.2:5001 05/13/2025-18:04:59.597224 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41700 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
May 13 18:04:34.414808 osdx systemd-journald[27261]: Runtime Journal (/run/log/journal/29acf74054db4c3a94b562797c4c13a9) is 1.9M, max 15.3M, 13.4M free. May 13 18:04:34.417326 osdx systemd-journald[27261]: Received client request to rotate journal, rotating. May 13 18:04:34.417390 osdx systemd-journald[27261]: Vacuuming done, freed 0B of archived journals from /run/log/journal/29acf74054db4c3a94b562797c4c13a9. May 13 18:04:34.426231 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'system journal clear'. May 13 18:04:34.892518 osdx osdx-coredump[313305]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... May 13 18:04:34.902290 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'system coredump delete all'. May 13 18:04:35.439001 osdx OSDxCLI[312864]: User 'admin' entered the configuration menu. May 13 18:04:35.546501 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. May 13 18:04:35.621910 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. May 13 18:04:35.725796 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. May 13 18:04:35.818690 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. May 13 18:04:35.925218 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. May 13 18:04:36.080490 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. May 13 18:04:36.242384 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'show working'. May 13 18:04:36.336334 osdx ubnt-cfgd[313327]: inactive May 13 18:04:36.372803 osdx INFO[313337]: FRR daemons did not change May 13 18:04:36.397346 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 May 13 18:04:36.469356 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 May 13 18:04:36.493694 osdx (udev-worker)[313459]: Network interface NamePolicy= disabled on kernel command line. May 13 18:04:36.651754 osdx cfgd[1470]: [312864]Completed change to active configuration May 13 18:04:36.663745 osdx OSDxCLI[312864]: User 'admin' committed the configuration. May 13 18:04:36.693338 osdx OSDxCLI[312864]: User 'admin' left the configuration menu. May 13 18:04:39.170982 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. May 13 18:04:39.293666 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. May 13 18:04:39.412532 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. May 13 18:04:40.017444 osdx file_operation[313616]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// May 13 18:04:40.044785 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. May 13 18:04:40.215747 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'file show running://test-performance.rules'. May 13 18:04:40.365212 osdx OSDxCLI[312864]: User 'admin' entered the configuration menu. May 13 18:04:40.440704 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 13 18:04:40.538517 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 13 18:04:40.596683 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 13 18:04:40.693879 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 13 18:04:40.754226 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 13 18:04:40.841460 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 13 18:04:40.946769 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 13 18:04:41.054144 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 13 18:04:41.176363 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 13 18:04:41.275513 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 13 18:04:41.332841 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 13 18:04:41.451830 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 13 18:04:41.700483 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 13 18:04:41.778326 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 13 18:04:41.924486 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 13 18:04:42.051558 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 13 18:04:42.142244 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 13 18:04:42.224165 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 13 18:04:42.300401 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 13 18:04:42.398276 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 13 18:04:42.493245 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'show working'. May 13 18:04:42.577538 osdx ubnt-cfgd[313667]: inactive May 13 18:04:42.649275 osdx INFO[313704]: FRR daemons did not change May 13 18:04:42.916968 osdx systemd[1]: Reloading. May 13 18:04:42.937320 osdx systemd-sysv-generator[313757]: stat() failed on /etc/init.d/README, ignoring: No such file or directory May 13 18:04:43.073703 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 13 18:04:43.091591 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 13 18:04:43.309571 osdx INFO[313739]: Rules successfully loaded May 13 18:04:43.310377 osdx cfgd[1470]: [312864]Completed change to active configuration May 13 18:04:43.312180 osdx OSDxCLI[312864]: User 'admin' committed the configuration. May 13 18:04:43.330146 osdx OSDxCLI[312864]: User 'admin' left the configuration menu. May 13 18:04:43.729319 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=32274 DF PROTO=TCP SPT=57324 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 13 18:04:43.733513 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=45332 DF PROTO=TCP SPT=57340 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d May 13 18:04:54.006409 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. May 13 18:04:54.102634 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'system journal show | cat'. May 13 18:04:54.387999 osdx OSDxCLI[312864]: User 'admin' entered the configuration menu. May 13 18:04:54.449429 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. May 13 18:04:54.563655 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. May 13 18:04:54.652674 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. May 13 18:04:54.753192 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. May 13 18:04:54.814987 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. May 13 18:04:54.918935 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. May 13 18:04:55.391449 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. May 13 18:04:55.453837 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. May 13 18:04:55.550147 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. May 13 18:04:55.609165 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. May 13 18:04:55.713071 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. May 13 18:04:55.776366 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. May 13 18:04:55.890486 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. May 13 18:04:56.007501 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. May 13 18:04:56.107828 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. May 13 18:04:56.189200 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. May 13 18:04:56.248064 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. May 13 18:04:56.366607 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. May 13 18:04:56.497880 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. May 13 18:04:56.553090 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. May 13 18:04:56.667814 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. May 13 18:04:56.746824 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. May 13 18:04:56.879994 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. May 13 18:04:56.942631 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. May 13 18:04:57.070689 osdx OSDxCLI[312864]: User 'admin' added a new cfg line: 'show changes'. May 13 18:04:57.162351 osdx ubnt-cfgd[313883]: inactive May 13 18:04:57.204688 osdx INFO[313899]: FRR daemons did not change May 13 18:04:57.445989 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... May 13 18:04:59.105568 osdx systemd[1]: suricata@FW.service: Deactivated successfully. May 13 18:04:59.105706 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. May 13 18:04:59.105744 osdx systemd[1]: suricata@FW.service: Consumed 1.720s CPU time. May 13 18:04:59.125747 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... May 13 18:04:59.143458 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. May 13 18:04:59.336681 osdx INFO[313924]: Rules successfully loaded May 13 18:04:59.337568 osdx cfgd[1470]: [312864]Completed change to active configuration May 13 18:04:59.339527 osdx OSDxCLI[312864]: User 'admin' committed the configuration. May 13 18:04:59.355984 osdx OSDxCLI[312864]: User 'admin' left the configuration menu. May 13 18:04:59.597345 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=55489 DF PROTO=TCP SPT=41688 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 13 18:04:59.597446 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=42149 DF PROTO=TCP SPT=41700 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff May 13 18:05:04.031935 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. May 13 18:05:09.781754 osdx systemd[1]: Starting logrotate.service - Rotate log files... May 13 18:05:09.811106 osdx systemd[1]: logrotate.service: Deactivated successfully. May 13 18:05:09.811271 osdx systemd[1]: Finished logrotate.service - Rotate log files. May 13 18:05:09.833742 osdx OSDxCLI[312864]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 24869 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.597 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.597/0.597/0.597/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.499 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.499/0.499/0.499/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 42368 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 165 MBytes 1.39 Gbits/sec 357 1.18 MBytes [ 5] 1.00-2.00 sec 241 MBytes 2.02 Gbits/sec 0 1.32 MBytes [ 5] 2.00-3.00 sec 242 MBytes 2.03 Gbits/sec 0 1.44 MBytes [ 5] 3.00-4.00 sec 260 MBytes 2.18 Gbits/sec 0 1.56 MBytes [ 5] 4.00-5.00 sec 262 MBytes 2.20 Gbits/sec 0 1.67 MBytes [ 5] 5.00-6.00 sec 252 MBytes 2.12 Gbits/sec 170 1.31 MBytes [ 5] 6.00-7.00 sec 281 MBytes 2.36 Gbits/sec 0 1.44 MBytes [ 5] 7.00-8.00 sec 275 MBytes 2.31 Gbits/sec 0 1.55 MBytes [ 5] 8.00-9.00 sec 249 MBytes 2.09 Gbits/sec 0 1.66 MBytes [ 5] 9.00-10.00 sec 251 MBytes 2.11 Gbits/sec 0 1.76 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.42 GBytes 2.08 Gbits/sec 527 sender [ 5] 0.00-10.00 sec 2.42 GBytes 2.08 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/13/2025-18:05:32.423687 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42362 -> 40.0.0.2:5001 05/13/2025-18:05:32.424679 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42368 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=130 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=130 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=42368 dport=5001 packets=1796270 bytes=2694393757 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=42368 packets=177949 bytes=9246504 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=42362 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=42362 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=522 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=522 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 48654 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 224 MBytes 1.88 Gbits/sec 29 1.89 MBytes [ 5] 1.00-2.00 sec 291 MBytes 2.44 Gbits/sec 71 1.46 MBytes [ 5] 2.00-3.00 sec 344 MBytes 2.88 Gbits/sec 0 1.61 MBytes [ 5] 3.00-4.00 sec 284 MBytes 2.38 Gbits/sec 0 1.74 MBytes [ 5] 4.00-5.00 sec 279 MBytes 2.34 Gbits/sec 0 1.85 MBytes [ 5] 5.00-6.00 sec 291 MBytes 2.44 Gbits/sec 0 1.96 MBytes [ 5] 6.00-7.00 sec 294 MBytes 2.46 Gbits/sec 0 2.07 MBytes [ 5] 7.00-8.00 sec 299 MBytes 2.51 Gbits/sec 0 2.17 MBytes [ 5] 8.00-9.00 sec 288 MBytes 2.41 Gbits/sec 17 1.68 MBytes [ 5] 9.00-10.00 sec 290 MBytes 2.43 Gbits/sec 0 1.82 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.82 GBytes 2.42 Gbits/sec 117 sender [ 5] 0.00-10.00 sec 2.81 GBytes 2.42 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/13/2025-18:05:32.423687 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42362 -> 40.0.0.2:5001 05/13/2025-18:05:32.424679 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:42368 -> 40.0.0.2:5001 05/13/2025-18:05:47.294520 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48646 -> 40.0.0.2:5001 05/13/2025-18:05:47.295471 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:48654 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=48646 dport=5001 packets=14 bytes=1199 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=48646 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=43708 dport=2055 packets=1 bytes=114 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=2055 dport=43708 packets=0 bytes=0 mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=48654 dport=5001 packets=2087908 bytes=3131849749 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=48654 packets=323695 bytes=16825644 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 982 0 --:--:-- --:--:-- --:--:-- 980
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.545 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.545/0.545/0.545/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.461 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.461/0.461/0.461/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/13/2025-18:06:19.595944 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57206 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=133 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=133 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=57206 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=57206 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=525 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=525 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/13/2025-18:06:19.595944 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57206 -> 40.0.0.2:5000 05/13/2025-18:06:25.930439 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57206 -> 40.0.0.2:5000 05/13/2025-18:06:27.371268 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57852 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=57852 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=57852 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 830 2 - 5 5 331 331 --------------------------------------------------------------------- Total 11 11 830 830
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 23748 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.500 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.500/0.500/0.500/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.473 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.473/0.473/0.473/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
05/13/2025-18:06:50.225071 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46104 -> 40.0.0.2:5001 05/13/2025-18:06:50.226269 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46114 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46104 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46104 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=528 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=528 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46114 dport=5001 packets=26087 bytes=39126201 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46114 packets=3391 bytes=176352 [ASSURED] [OFFLOAD, packets=26075 bytes=39112500 packets=3389 bytes=176240] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=136 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=136 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 1645 0 --:--:-- --:--:-- --:--:-- 1662
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
05/13/2025-18:06:50.225071 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46104 -> 40.0.0.2:5001 05/13/2025-18:06:50.226269 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46114 -> 40.0.0.2:5001 05/13/2025-18:06:53.808615 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46130 -> 40.0.0.2:5001 05/13/2025-18:06:53.809934 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:48126 -> 40.0.0.2:5001 05/13/2025-18:06:53.820881 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:48126 -> 40.0.0.2:5001 05/13/2025-18:06:53.832747 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:48126 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
udp 17 src=20.0.0.2 dst=40.0.0.2 sport=48126 dport=5001 packets=16 bytes=22172 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=48126 packets=1 bytes=32 [OFFLOAD, packets=12 bytes=17712 packets=0 bytes=0] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46130 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46130 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 49788 0 --:--:-- --:--:-- --:--:-- 66666
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.561 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.561/0.561/0.561/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.527 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.527/0.527/0.527/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
05/13/2025-18:07:16.298991 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34836 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 34836 yes 201 0 0 0 20.0.0.2 40.0.0.2 34836 5000 yes 201 0 8 673
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250117s ending at 1747159640.092582 XDP_DROP 9 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10344922 pkts ( 8 pps) 13524288 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
05/13/2025-18:07:16.298991 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34836 -> 40.0.0.2:5000 05/13/2025-18:07:20.230053 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:33747 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 33747 5001 no 201 0 0 0 40.0.0.2 20.0.0.2 5000 34836 yes 201 0 0 0 20.0.0.2 40.0.0.2 34836 5000 yes 201 0 11 847 40.0.0.2 20.0.0.2 5001 33747 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250125s ending at 1747159644.003857 XDP_DROP 11 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10344960 pkts ( 0 pps) 13524291 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)