Netflow Forward
These scenarios show how to configure and use Netflow to collect and export TCP forwarded flows. Different NAT topologies are described.
Netflow Without NAT
Description
Simple scenario without NAT configuration.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.0.0.2/24 set interfaces ethernet eth0 flow egress selector TCP_SEL set interfaces ethernet eth0 flow ingress selector TCP_SEL set interfaces ethernet eth1 address 20.0.0.2/24 set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system netflow app-id set system netflow destination 10.0.0.1 set system netflow engine-id 1111 set traffic selector TCP_SEL rule 1 protocol tcp
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.0.0.1/24 set protocols static route 0.0.0.0/0 next-hop 10.0.0.2 set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 20.0.0.1/24 set protocols static route 0.0.0.0/0 next-hop 20.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command system conntrack clear at DUT1.
Step 5: Ping IP address 10.0.0.1 from DUT0:
admin@DUT0$ ping 10.0.0.1 count 1 size 56 timeout 1Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.207 ms --- 10.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.207/0.207/0.207/0.000 ms
Step 6: Ping IP address 20.0.0.1 from DUT0:
admin@DUT0$ ping 20.0.0.1 count 1 size 56 timeout 1Show output
PING 20.0.0.1 (20.0.0.1) 56(84) bytes of data. 64 bytes from 20.0.0.1: icmp_seq=1 ttl=64 time=0.337 ms --- 20.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.337/0.337/0.337/0.000 ms
Step 7: Initiate a tcp connection from DUT1 to DUT2 and try to send some messages between both endpoints
admin@DUT2$ monitor test connection server 8080 tcp admin@DUT1$ monitor test connection client 20.0.0.1 8080 tcp
Step 8: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
2\s+3\s+10.0.0.1:\d+\s+20.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 0b74 0 2 3 10.0.0.1:52830 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 358 23 2 ddec 0 3 2 20.0.0.1:8080 10.0.0.1:52830 52830 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 9 576 358 23
Step 9: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
3\s+2\s+20.0.0.1:\d+\s+10.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 0b74 0 2 3 10.0.0.1:52830 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 376 41 2 ddec 0 3 2 20.0.0.1:8080 10.0.0.1:52830 52830 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 9 576 376 41
Step 10: Run command system netflow show status at DUT0 and check if output matches the following regular expressions:
Protocol\sversion\s10\s\(ipfix\) Export:.*Errors 0 pkts sock0:\s127.0.0.1:2055,.*err: sndbuf reached 0, connect 0, cberr \d+, other 0Show output
ipt_NETFLOW 2.6, srcversion AADF220789E0A3E7E537933; dir Protocol version 10 (ipfix), refresh-rate 20, timeout-rate 30, (templates 0, active 1). Timeouts: active 1800s, inactive 15s. Maxflows 2000000 Flows: active 2 (peak 8 reached 0d0h0m ago), mem 492K, worker delay 25/250 [1..25] (28 ms, 0 us, 2:0 [cpu3]). Hash: size 62967 (mem 491K), metric 1.00 [1.00, 1.00, 1.00]. InHash: 19 pkt, 1 K, InPDU 0, 0. Rate: 0 bits/sec, 0 packets/sec; Avg 1 min: 474 bps, 0 pps; 5 min: 226 bps, 0 pps cpu# pps; <search found new [metric], trunc frag alloc maxflows>, traffic: <pkt, bytes>, drop: <pkt, bytes> Total 0; 0 153 20 [1.00], 0 0 0 0, traffic: 96, 0 MB, drop: 0, 0 K cpu0 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu1 0; 0 153 19 [1.00], 0 0 0 0, traffic: 95, 0 MB, drop: 0, 0 K cpu2 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu3 0; 0 0 1 [1.00], 0 0 0 0, traffic: 1, 0 MB, drop: 0, 0 K Export: Rate 118 bytes/s; Total 12 pkts, 0 MB, 6 flows; Errors 0 pkts; Traffic lost 67 pkts, 3 Kbytes, 12 flows. sock0: 127.0.0.1:2055, sndbuf 212992, filled 1, peak 1; err: sndbuf reached 0, connect 0, cberr 0, other 0
Netflow With SNAT
Description
Scenario with SNAT in DUT0 WAN interface (eth1).
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.0.0.2/24 set interfaces ethernet eth0 flow egress selector TCP_SEL set interfaces ethernet eth0 flow ingress selector TCP_SEL set interfaces ethernet eth1 address 20.0.0.2/24 set interfaces ethernet eth1 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 traffic nat source rule 1 selector TCP_SEL set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system netflow app-id set system netflow destination 10.0.0.1 set system netflow engine-id 1111 set traffic selector TCP_SEL rule 1 protocol tcp
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.0.0.1/24 set protocols static route 0.0.0.0/0 next-hop 10.0.0.2 set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 20.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command system conntrack clear at DUT1.
Step 5: Ping IP address 10.0.0.1 from DUT0:
admin@DUT0$ ping 10.0.0.1 count 1 size 56 timeout 1Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=76.0 ms --- 10.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 76.038/76.038/76.038/0.000 ms
Step 6: Ping IP address 20.0.0.1 from DUT0:
admin@DUT0$ ping 20.0.0.1 count 1 size 56 timeout 1Show output
PING 20.0.0.1 (20.0.0.1) 56(84) bytes of data. 64 bytes from 20.0.0.1: icmp_seq=1 ttl=64 time=0.356 ms --- 20.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.356/0.356/0.356/0.000 ms
Step 7: Initiate a tcp connection from DUT1 to DUT2 and try to send some messages between both endpoints
admin@DUT2$ monitor test connection server 8080 tcp admin@DUT1$ monitor test connection client 20.0.0.1 8080 tcp
Step 8: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
2\s+3\s+10.0.0.1:\d+\s+20.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 5622 0 3 2 20.0.0.1:8080 10.0.0.1:50960 50960 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 9 576 369 30 2 c8b8 0 2 3 10.0.0.1:50960 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 369 30
Step 9: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
3\s+2\s+20.0.0.1:\d+\s+10.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 5622 0 3 2 20.0.0.1:8080 10.0.0.1:50960 50960 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 9 576 387 48 2 c8b8 0 2 3 10.0.0.1:50960 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 387 48
Step 10: Run command system netflow show status at DUT0 and check if output matches the following regular expressions:
Protocol\sversion\s10\s\(ipfix\) Export:.*Errors 0 pkts sock0:\s127.0.0.1:2055,.*err: sndbuf reached 0, connect 0, cberr \d+, other 0Show output
ipt_NETFLOW 2.6, srcversion AADF220789E0A3E7E537933; dir Protocol version 10 (ipfix), refresh-rate 20, timeout-rate 30, (templates 0, active 1). Timeouts: active 1800s, inactive 15s. Maxflows 2000000 Flows: active 2 (peak 8 reached 0d0h0m ago), mem 492K, worker delay 25/250 [1..25] (80 ms, 0 us, 2:0 [cpu3]). Hash: size 62967 (mem 491K), metric 1.00 [1.00, 1.00, 1.00]. InHash: 19 pkt, 1 K, InPDU 0, 0. Rate: 0 bits/sec, 0 packets/sec; Avg 1 min: 546 bps, 0 pps; 5 min: 266 bps, 0 pps cpu# pps; <search found new [metric], trunc frag alloc maxflows>, traffic: <pkt, bytes>, drop: <pkt, bytes> Total 0; 0 180 22 [1.00], 0 0 0 0, traffic: 115, 0 MB, drop: 0, 0 K cpu0 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu1 0; 0 180 21 [1.00], 0 0 0 0, traffic: 114, 0 MB, drop: 0, 0 K cpu2 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu3 0; 0 0 1 [1.00], 0 0 0 0, traffic: 1, 0 MB, drop: 0, 0 K Export: Rate 117 bytes/s; Total 16 pkts, 0 MB, 6 flows; Errors 0 pkts; Traffic lost 86 pkts, 5 Kbytes, 14 flows. sock0: 127.0.0.1:2055, sndbuf 212992, filled 1, peak 1; err: sndbuf reached 0, connect 0, cberr 0, other 0
Netflow With DNAT
Description
Scenario with DNAT in DUT0 LAN interface (eth0).
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.0.0.2/24 set interfaces ethernet eth0 flow egress selector TCP_SEL set interfaces ethernet eth0 flow ingress selector TCP_SEL set interfaces ethernet eth0 traffic nat destination rule 1 address 20.0.0.1 set interfaces ethernet eth0 traffic nat destination rule 1 selector TCP_SEL set interfaces ethernet eth1 address 20.0.0.2/24 set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system netflow app-id set system netflow destination 10.0.0.1 set system netflow engine-id 1111 set traffic selector TCP_SEL rule 1 protocol tcp
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.0.0.1/24 set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 20.0.0.1/24 set protocols static route 0.0.0.0/0 next-hop 20.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command system conntrack clear at DUT1.
Step 5: Ping IP address 10.0.0.1 from DUT0:
admin@DUT0$ ping 10.0.0.1 count 1 size 56 timeout 1Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.247 ms --- 10.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.247/0.247/0.247/0.000 ms
Step 6: Ping IP address 20.0.0.1 from DUT0:
admin@DUT0$ ping 20.0.0.1 count 1 size 56 timeout 1Show output
PING 20.0.0.1 (20.0.0.1) 56(84) bytes of data. 64 bytes from 20.0.0.1: icmp_seq=1 ttl=64 time=0.322 ms --- 20.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.322/0.322/0.322/0.000 ms
Step 7: Initiate a tcp connection from DUT1 to DUT2 and try to send some messages between both endpoints
admin@DUT2$ monitor test connection server 8080 tcp admin@DUT1$ monitor test connection client 10.0.0.2 8080 tcp
Step 8: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
2\s+3\s+10.0.0.1:\d+\s+20.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 16e1 0 2 3 10.0.0.1:58666 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 372 27 2 31ea 0 3 2 20.0.0.1:8080 10.0.0.1:58666 58666 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 9 576 372 27
Step 9: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
3\s+2\s+20.0.0.1:\d+\s+10.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 16e1 0 2 3 10.0.0.1:58666 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 390 45 2 31ea 0 3 2 20.0.0.1:8080 10.0.0.1:58666 58666 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 9 576 390 45
Step 10: Run command system netflow show status at DUT0 and check if output matches the following regular expressions:
Protocol\sversion\s10\s\(ipfix\) Export:.*Errors 0 pkts sock0:\s127.0.0.1:2055,.*err: sndbuf reached 0, connect 0, cberr \d+, other 0Show output
ipt_NETFLOW 2.6, srcversion AADF220789E0A3E7E537933; dir Protocol version 10 (ipfix), refresh-rate 20, timeout-rate 30, (templates 0, active 1). Timeouts: active 1800s, inactive 15s. Maxflows 2000000 Flows: active 2 (peak 8 reached 0d0h0m ago), mem 492K, worker delay 25/250 [1..25] (56 ms, 0 us, 2:0 [cpu0]). Hash: size 62967 (mem 491K), metric 1.00 [1.00, 1.00, 1.00]. InHash: 19 pkt, 1 K, InPDU 0, 0. Rate: 0 bits/sec, 0 packets/sec; Avg 1 min: 595 bps, 0 pps; 5 min: 303 bps, 0 pps cpu# pps; <search found new [metric], trunc frag alloc maxflows>, traffic: <pkt, bytes>, drop: <pkt, bytes> Total 0; 0 207 24 [1.00], 0 0 0 0, traffic: 134, 0 MB, drop: 0, 0 K cpu0 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu1 0; 0 207 23 [1.00], 0 0 0 0, traffic: 133, 0 MB, drop: 0, 0 K cpu2 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu3 0; 0 0 1 [1.00], 0 0 0 0, traffic: 1, 0 MB, drop: 0, 0 K Export: Rate 117 bytes/s; Total 20 pkts, 0 MB, 6 flows; Errors 0 pkts; Traffic lost 105 pkts, 6 Kbytes, 16 flows. sock0: 127.0.0.1:2055, sndbuf 212992, filled 1, peak 1; err: sndbuf reached 0, connect 0, cberr 0, other 0
Netflow With SDNAT
Description
Scenario with SNAT in DUT0 WAN interface (eth1)
and DNAT in DUT0 LAN interface (eth0).
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.0.0.2/24 set interfaces ethernet eth0 flow egress selector TCP_SEL set interfaces ethernet eth0 flow ingress selector TCP_SEL set interfaces ethernet eth0 traffic nat destination rule 1 address 20.0.0.1 set interfaces ethernet eth0 traffic nat destination rule 1 selector TCP_SEL set interfaces ethernet eth1 address 20.0.0.2/24 set interfaces ethernet eth1 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 traffic nat source rule 1 selector TCP_SEL set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system netflow app-id set system netflow destination 10.0.0.1 set system netflow engine-id 1111 set traffic selector TCP_SEL rule 1 protocol tcp
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.0.0.1/24 set system conntrack app-detect set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 20.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command system conntrack clear at DUT1.
Step 5: Ping IP address 10.0.0.1 from DUT0:
admin@DUT0$ ping 10.0.0.1 count 1 size 56 timeout 1Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.226 ms --- 10.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.226/0.226/0.226/0.000 ms
Step 6: Ping IP address 20.0.0.1 from DUT0:
admin@DUT0$ ping 20.0.0.1 count 1 size 56 timeout 1Show output
PING 20.0.0.1 (20.0.0.1) 56(84) bytes of data. 64 bytes from 20.0.0.1: icmp_seq=1 ttl=64 time=0.285 ms --- 20.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.285/0.285/0.285/0.000 ms
Step 7: Initiate a tcp connection from DUT1 to DUT2 and try to send some messages between both endpoints
admin@DUT2$ monitor test connection server 8080 tcp admin@DUT1$ monitor test connection client 10.0.0.2 8080 tcp
Step 8: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
2\s+3\s+10.0.0.1:\d+\s+20.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 44df 0 3 2 20.0.0.1:8080 10.0.0.1:49330 49330 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 364 26 2 8bea 0 2 3 10.0.0.1:49330 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 364 26
Step 9: Run command system netflow show flows detailed at DUT0 and check if output matches the following regular expressions:
3\s+2\s+20.0.0.1:\d+\s+10.0.0.1:\d+\s*\d*\s*\d+[^\[]*\[L4:8080\]Show output
------------------------------------------------------------------------------------------ Field Description ------------------------------------------------------------------------------------------ # Numeric flow identifier hash Hash of the flow a Shows if the flow is pending of being exported iif Input interface oif Output interface src Source IP:PORT dst Destination IP:PORT protocol Protocol identifier nexthop Next-hop [Layer 4:Port] tos Type of service identificator tcpflags TCP flags options Optional IP options tcpoptions TCP Options (MSS, Window Scaling, Selective Acknowledgements, Timestamps, Nop) pkts Packets counter bytes Bytes counter ts_first Timestamp of fist packet that passed through the flow ts_last Timestamp of last packet that passed through the flow ---------------------------------------------------------------------------------------------------------------------------------------------------- # hash a iif oif src dst protocol nexthop tos tcpflags options tcpoptions pkts bytes ts_first ts_last ---------------------------------------------------------------------------------------------------------------------------------------------------- 1 44df 0 3 2 20.0.0.1:8080 10.0.0.1:49330 49330 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 381 43 2 8bea 0 2 3 10.0.0.1:49330 20.0.0.1:8080 8080 0.0.0.0[L4:8080] 0x0 0x1b 0x0 0xf1000000 10 628 381 43
Step 10: Run command system netflow show status at DUT0 and check if output matches the following regular expressions:
Protocol\sversion\s10\s\(ipfix\) Export:.*Errors 0 pkts sock0:\s127.0.0.1:2055,.*err: sndbuf reached 0, connect 0, cberr \d+, other 0Show output
ipt_NETFLOW 2.6, srcversion AADF220789E0A3E7E537933; dir Protocol version 10 (ipfix), refresh-rate 20, timeout-rate 30, (templates 0, active 1). Timeouts: active 1800s, inactive 15s. Maxflows 2000000 Flows: active 2 (peak 8 reached 0d0h0m ago), mem 492K, worker delay 25/250 [1..25] (36 ms, 0 us, 2:0 [cpu1]). Hash: size 62967 (mem 491K), metric 1.00 [1.00, 1.00, 1.00]. InHash: 20 pkt, 1 K, InPDU 0, 0. Rate: 344 bits/sec, 0 packets/sec; Avg 1 min: 671 bps, 0 pps; 5 min: 345 bps, 0 pps cpu# pps; <search found new [metric], trunc frag alloc maxflows>, traffic: <pkt, bytes>, drop: <pkt, bytes> Total 0; 0 235 26 [1.00], 0 0 0 0, traffic: 154, 0 MB, drop: 0, 0 K cpu0 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu1 0; 0 235 25 [1.00], 0 0 0 0, traffic: 153, 0 MB, drop: 0, 0 K cpu2 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K cpu3 0; 0 0 1 [1.00], 0 0 0 0, traffic: 1, 0 MB, drop: 0, 0 K Export: Rate 117 bytes/s; Total 24 pkts, 0 MB, 6 flows; Errors 0 pkts; Traffic lost 124 pkts, 7 Kbytes, 18 flows. sock0: 127.0.0.1:2055, sndbuf 212992, filled 1, peak 1; err: sndbuf reached 0, connect 0, cberr 0, other 0