Conntag

The following scenarios show how to configure traffic policies using the conntag feature. Conntag allows tagging conntrack entries with string values (up to 255 characters) for traffic classification and filtering. This is similar to connmark but uses human-readable string tags instead of numeric marks.

Test Policy Set Conntag Basic 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 to set a basic conntag string on incoming packets. The conntag value is stored in the conntrack entry and can be verified using the system conntrack show command.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set conntag my-traffic-tag

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and check if output contains the following tokens:

conntag=my-traffic-tag

Test Policy Set Conntag With Numbers 

Description 

This scenario tests setting a conntag that includes numeric characters mixed with text, demonstrating that conntag values can contain alphanumeric strings with hyphens.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set conntag traffic-123-test

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and check if output contains the following tokens:

conntag=traffic-123-test

Test Policy Set Conntag Special Characters 

Description 

This scenario tests setting a conntag that includes special characters like underscores, dots, and hyphens, which are commonly used in application versioning and environment naming.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set conntag app_v2.0-prod

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and check if output contains the following tokens:

conntag=app_v2.0-prod

Test Policy Set Conntag Maximum Length 

Description 

This scenario tests the conntag feature with the maximum allowed string length of 255 characters. The system should accept and correctly store strings up to this limit.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set conntag Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-sed-do-eiusmod-tempor-incididunt-ut-labore-et-dolore-magna-aliqua-Ut-enim-ad-minim-veniam-quis-nostrud-exercitation-ullamco-laboris-nisi-ut-aliquip-ex-ea-commodo-consequat-Duis-aute-irure-dolor-len255

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and expect this output:

Test Policy Set Conntag Invalid Length 

Description 

This scenario tests that the system correctly rejects conntag strings that exceed the maximum allowed length of 255 characters with an appropriate error message.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN

Step 2: Expect a failure in the following command: Run command set traffic policy POLICY_IN rule 1 set conntag Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-sed-do-eiusmod-tempor-incididunt-ut-labore-et-dolore-magna-aliqua-Ut-enim-ad-minim-veniam-quis-nostrud-exercitation-ullamco-laboris-nisi-ut-aliquip-ex-ea-commodo-consequat-Duis-aute-irure-dolor-len_256 at DUT0 and expect this output:

Test Policy Set Conntag Empty String 

Description 

This scenario tests that the system correctly rejects empty or whitespace-only conntag strings.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN

Step 2: Run command configure at DUT0 and expect this output:

Show output
admin@osdx#

Step 3: Run command set traffic policy POLICY_IN rule 1 set conntag at DUT0 and check if output contains the following tokens:

requires a value

Test Policy Set Conntag With Connmark 

Description 

This scenario demonstrates using both conntag and connmark together on the same traffic flow. This allows numeric classification (connmark) alongside descriptive string tagging (conntag) for comprehensive traffic identification.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set connmark 42
set traffic policy POLICY_IN rule 1 set conntag my-traffic-tag

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and expect this output:

Test Policy Set Conntag With VRF 

Description 

This scenario demonstrates using conntag in combination with VRF routing. Traffic is tagged with a conntag and also assigned to a specific VRF for routing purposes.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 vrf RED
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf RED
set traffic policy POLICY_IN rule 1 set conntag my-traffic-tag
set traffic policy POLICY_IN rule 1 set vrf RED

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and expect this output:

Test Policy Modify Conntag 

Description 

This scenario demonstrates modifying the conntag value on an existing traffic policy rule and verifying that new connections use the updated tag value.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set conntag initial-tag

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and check if output contains the following tokens:

conntag=initial-tag

Step 7: Run command system conntrack clear at DUT0 and expect this output:

Step 8: Modify the following configuration lines in DUT0 :

set traffic policy POLICY_IN rule 1 set conntag modified-tag

Step 9: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 10: Run command system conntrack show at DUT0 and check if output contains the following tokens:

conntag=modified-tag

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set conntag my-traffic-tag

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system conntrack clear at DUT0 and expect this output:

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 6: Run command system conntrack show at DUT0 and check if output contains the following tokens:

conntag=my-traffic-tag

Step 7: Run command system conntrack clear at DUT0 and expect this output:

Step 8: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 set
set traffic policy POLICY_IN rule 1 action accept

Step 9: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 3 size 56 timeout 1

Step 10: Run command system conntrack show at DUT0 and expect this output: