Policy

The following scenarios show how to configure different traffic policies. Policies can be used to manage and classify network packets. traffic selectors can be configured to filter packets based on certain fields.

Test Policy Actions 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different traffic actions are configured to accept, drop or limit incoming traffic.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 action accept
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 action accept
set traffic policy POLICY_IN rule 1 action drop

Step 5: Expect a failure in the following command: Initiate a udp connection from DUT1 to DUT0 and try to send some messages between both endpoints

admin@DUT0$ monitor test connection server 8080 udp
admin@DUT1$ monitor test connection client 10.0.0.1 8080 udp

Step 6: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 action drop
set traffic policy POLICY_IN rule 1 action rate-limit 10

Step 7: Initiate a bandwidth test from DUT1 to DUT0

admin@DUT0$ monitor test performance server port 5001
admin@DUT1$ monitor test performance client 10.0.0.1 duration 5 port 5001 parallel 1

Note

Previous test should show a very low bandwidth rate.

Test Policy Copy 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different copy actions are configured to store the ToS value in the conntrack mark and extra conntrack mark fields.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 copy tos connmark
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 5 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

mark=12

Step 5: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 copy tos connmark
set traffic policy POLICY_IN rule 1 copy tos extra-connmark 1

Step 6: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 tos 12 count 5 size 56 timeout 1

Step 7: Run command system conntrack show at DUT0 and check if output contains the following tokens:

emark1=12

Test Policy Set 

Description 

In this scenario, an egress traffic policy is configured in DUT0 (‘eth0’ interface) to mark outgoing packets using ToS and CoS fields.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN
set traffic policy POLICY_OUT rule 1 set tos 12

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command traffic dump monitor detail interface eth0 filter "host 10.0.0.2" at DUT1.

Step 4: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Step 5: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_OUT rule 1 set tos
set traffic policy POLICY_OUT rule 1 set cos 5

Step 6: Run command traffic dump monitor detail interface eth0 filter "host 10.0.0.2" at DUT1.

Step 7: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1

Test Policy Set Conntrack Values 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). Different set actions are configured to change the conntrack mark, the app-id and the VRF.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 set connmark 15
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

mark=15

Step 5: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 set connmark
set traffic policy POLICY_IN rule 1 set app-id custom 80

Step 6: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 7: Run command system conntrack show at DUT0 and check if output contains the following tokens:

appdetect[U6:80]

Step 8: Modify the following configuration lines in DUT0 :

set system conntrack app-detect app-id-storage chained

Step 9: Run command system conntrack clear at DUT0.

Step 10: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 11: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

appdetect\[L3:1;U6:80\]

Step 12: Modify the following configuration lines in DUT0 :

delete traffic policy POLICY_IN rule 1 set app-id
set interfaces ethernet eth0 vif 100 vrf RED
set system vrf RED
set traffic policy POLICY_IN rule 1 set vrf RED

Step 13: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 14: Run command system conntrack show at DUT0 and check if output contains the following tokens:

vrf=RED

Test Policy Log 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The log option is configured to show system messages that help debug and analyze the network status. Additionally, an invalid log prefix is included to illustrate the maximum length allowed.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 log level err
set traffic policy POLICY_IN rule 1 log prefix Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Run command system journal show | tail at DUT0 and check if output contains the following tokens:

[Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit-1] ACCEPT IN=eth0

Step 5: Run command configure at DUT0 and expect this output:

Show output
admin@osdx#

Step 6: Run command set traffic policy INVALID_LOG_PREFIX rule 1 log prefix Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-amet-vita at DUT0 and check if output contains the following tokens:

Log prefix must be 92 characters or less and must contain printable characters except those defined as part of the space character class

Test Policy Advisor 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The advisor option is configured to enable/disable the rule depending on the advisor status. If the rule is enabled, incoming traffic will be dropped.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system advisor ADV test false
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POLICY_IN rule 1 action drop
set traffic policy POLICY_IN rule 1 advisor ADV
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 4: Modify the following configuration lines in DUT0 :

set system advisor ADV test true

Step 5: Expect a failure in the following command: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 6: Modify the following configuration lines in DUT0 :

set system advisor ADV test false

Step 7: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Test Policy Set Label 

Description 

In this scenario, an ingress traffic policy is configured in DUT0 (‘eth0’ interface). The set label action is configured to assign a label to conntrack entries. Labels are used to classify and identify connections in the conntrack table, which can be useful for traffic analysis and policy enforcement.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 vif 100 address 10.0.0.1/24
set interfaces ethernet eth0 vif 100 traffic policy in POLICY_IN
set interfaces ethernet eth0 vif 100 traffic policy out POLICY_OUT
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic label TESTLABEL
set traffic policy POLICY_IN rule 1 set label TESTLABEL
set traffic policy POLICY_OUT

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 vif 100 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 4: Run command system conntrack show at DUT0 and check if output contains the following tokens:

labels=TESTLABEL