Check Link Hook

This scenario shows how to attach a traffic policy to the link hook in a Cellular interface. This hook is triggered at a very early stage of the network packet stack (level 2 layer).

Test Early Packet Drop

Description

In DUT0, the cellular interface is configured with a traffic policy to drop all incoming traffic at the link stage and only allow ARP and UDP packets.

Scenario

Step 1: Set the following configuration in DUT0 :

set cellular profile CELPROFILE apn movistar.es
set controllers cellular wwan0 sim select socket_1
set controllers cellular wwan0 sim socket socket_1 encrypted-pin U2FsdGVkX1/gh4g293fkmPexhlj6+VIC30dmbtsZZWs=
set controllers cellular wwan0 sim socket socket_1 pdp 1 profile CELPROFILE
set interfaces cellular cell0 address dhcp
set interfaces cellular cell0 phy wwan0 pdp 1
set service dns forwarding dhcp interface cell0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run command controllers cellular wwan0 pdp 1 show network-data-connection at DUT0 and check if output matches the following regular expressions:

Connection status\s* = connected

Step 3: Ping IP address 8.8.8.8 from DUT0:

admin@DUT0$ ping 8.8.8.8 count 1 size 56 timeout 1

Note

In the previous command it is observed that the ICMP packets corresponding to the ping command are received without problems. This is because the traffic policy responsible for dropping these packets has not yet been applied to the cellular interface.

Note

However, when the traffic policy is applied, it can be verified that the ping command fails since ICMP packets are now being dropped.

Step 4: Modify the following configuration lines in DUT0 :

set interfaces cellular cell0 traffic policy link-in EDROP_POLICY
set traffic policy EDROP_POLICY rule 1 action accept
set traffic policy EDROP_POLICY rule 1 selector ACCEPT_SEL
set traffic policy EDROP_POLICY rule 2 action drop
set traffic selector ACCEPT_SEL rule 1 protocol udp
set traffic selector ACCEPT_SEL rule 2 ether-type arp

Step 5: Expect a failure in the following command: Ping IP address 8.8.8.8 from DUT0:

admin@DUT0$ ping 8.8.8.8 count 1 size 56 timeout 1

Note

On the other hand, the applied traffic policy allows receiving UDP packets, so the nslookup command works without problems.

Step 6: Run command nslookup www.google.es at DUT0 and check if output matches the following regular expressions:

Server:\s+(\d+\.){3}\d+

Note

Finally, with the following operational command the statistics of the traffic policy are displayed.

Step 7: Run command traffic policy show at DUT0 and check if output matches the following regular expressions:

1\s+ACCEPT_SEL\s+\b[^0]\d*