Bypass Tests

The following scenario shows different configuration alternatives to improve the OSDx firewall performance.

Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.

Scenario 

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$

Test Capture Bypass Using Packet Mark 

Description 

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.

Performance must improve considerably compared to the Local Bypass test.

The test is extended by using other packet marks that we have customized for the firewall.

Scenario 

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic label BYPASS
set traffic policy FW-SKIP rule 1 log prefix SKIP
set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS
set traffic policy FW-SKIP rule 1 set label BYPASS
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS
set traffic selector MARKED-PACKETS rule 1 mark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$

Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

(?m)^.*\[SKIP\-1\].*$

Show output

May 04 22:08:11.000186 osdx systemd-timedated[89209]: Changed local time to Mon 2026-05-04 22:08:11 UTC
May 04 22:08:11.000579 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service.
May 04 22:08:11.001531 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'set date 2026-05-04 22:08:11'.
May 04 22:08:11.002240 osdx systemd-journald[1908]: Time jumped backwards, rotating.
May 04 22:08:11.282110 osdx systemd-journald[1908]: Runtime Journal (/run/log/journal/9e2a66651dea45ed982d8152051049c2) is 2.4M, max 13.8M, 11.3M free.
May 04 22:08:11.282686 osdx systemd-journald[1908]: Received client request to rotate journal, rotating.
May 04 22:08:11.282728 osdx systemd-journald[1908]: Vacuuming done, freed 0B of archived journals from /run/log/journal/9e2a66651dea45ed982d8152051049c2.
May 04 22:08:11.291283 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'system journal clear'.
May 04 22:08:11.508862 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'system coredump delete all'.
May 04 22:08:11.716677 osdx OSDxCLI[88731]: User 'admin' entered the configuration menu.
May 04 22:08:11.836131 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
May 04 22:08:11.887342 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'.
May 04 22:08:11.980794 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
May 04 22:08:12.032732 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'.
May 04 22:08:12.127555 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'.
May 04 22:08:12.176594 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'.
May 04 22:08:12.281823 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'show working'.
May 04 22:08:12.340219 osdx ubnt-cfgd[89242]: inactive
May 04 22:08:12.364188 osdx INFO[89248]: FRR daemons did not change
May 04 22:08:12.390246 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1
May 04 22:08:12.410495 osdx WARNING[89288]: No supported link modes on interface eth1
May 04 22:08:12.411800 osdx modulelauncher[89288]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on
May 04 22:08:12.411814 osdx modulelauncher[89288]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76.
May 04 22:08:12.413044 osdx modulelauncher[89288]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Pause off Asym_Pause off --
May 04 22:08:12.413050 osdx modulelauncher[89288]: Command '/sbin/ethtool -s eth1 autoneg on advertise Pause off Asym_Pause off --' returned non-zero exit status 75.
May 04 22:08:12.446250 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
May 04 22:08:12.487310 osdx WARNING[89368]: No supported link modes on interface eth0
May 04 22:08:12.488654 osdx modulelauncher[89368]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
May 04 22:08:12.488666 osdx modulelauncher[89368]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
May 04 22:08:12.489786 osdx modulelauncher[89368]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Pause off Asym_Pause off --
May 04 22:08:12.489793 osdx modulelauncher[89368]: Command '/sbin/ethtool -s eth0 autoneg on advertise Pause off Asym_Pause off --' returned non-zero exit status 75.
May 04 22:08:12.499257 osdx (udev-worker)[89384]: Network interface NamePolicy= disabled on kernel command line.
May 04 22:08:12.652218 osdx cfgd[1648]: [88731]Completed change to active configuration
May 04 22:08:12.663007 osdx OSDxCLI[88731]: User 'admin' committed the configuration.
May 04 22:08:12.683441 osdx OSDxCLI[88731]: User 'admin' left the configuration menu.
May 04 22:08:14.627279 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
May 04 22:08:14.700891 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'.
May 04 22:08:14.808648 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'.
May 04 22:08:15.310041 osdx file_operation[89564]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running://
May 04 22:08:15.332899 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'.
May 04 22:08:15.458414 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'file show running://test-performance.rules'.
May 04 22:08:15.602352 osdx OSDxCLI[88731]: User 'admin' entered the configuration menu.
May 04 22:08:15.659943 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'.
May 04 22:08:15.755758 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'.
May 04 22:08:15.807152 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'.
May 04 22:08:15.898573 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'.
May 04 22:08:15.950422 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'.
May 04 22:08:16.043341 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'.
May 04 22:08:16.130367 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'.
May 04 22:08:16.185149 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'.
May 04 22:08:16.273559 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'.
May 04 22:08:16.323958 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'.
May 04 22:08:16.414725 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic label BYPASS'.
May 04 22:08:16.470645 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'.
May 04 22:08:16.562077 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'.
May 04 22:08:16.615875 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'.
May 04 22:08:16.709604 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'.
May 04 22:08:16.766223 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'.
May 04 22:08:16.854765 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'.
May 04 22:08:16.908732 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'.
May 04 22:08:16.999394 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'.
May 04 22:08:17.051748 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'.
May 04 22:08:17.169264 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'show working'.
May 04 22:08:17.251005 osdx ubnt-cfgd[89612]: inactive
May 04 22:08:17.324565 osdx INFO[89657]: FRR daemons did not change
May 04 22:08:17.562758 osdx systemd[1]: Reloading.
May 04 22:08:17.650254 osdx systemd-sysv-generator[89713]: stat() failed on /etc/init.d/README, ignoring: No such file or directory
May 04 22:08:17.778840 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service...
May 04 22:08:17.807490 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service.
May 04 22:08:17.991120 osdx INFO[89694]: Rules successfully loaded
May 04 22:08:17.991810 osdx cfgd[1648]: [88731]Completed change to active configuration
May 04 22:08:17.993922 osdx OSDxCLI[88731]: User 'admin' committed the configuration.
May 04 22:08:18.007976 osdx OSDxCLI[88731]: User 'admin' left the configuration menu.
May 04 22:08:18.402879 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=44208 DF PROTO=TCP SPT=56168 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
May 04 22:08:18.402952 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=7449 DF PROTO=TCP SPT=56178 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
May 04 22:08:28.547007 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.

Note

The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.

Step 9: Modify the following configuration lines in DUT0 :

set service firewall FW stream bypass extra-mark 1 mask 3294967295
set service firewall FW stream bypass extra-mark 1 value 3294967295
set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK
set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295

Step 10: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$

Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

(?m)^.*\[SKIP\-1\].*$

Show output

May 04 22:08:11.000186 osdx systemd-timedated[89209]: Changed local time to Mon 2026-05-04 22:08:11 UTC
May 04 22:08:11.000579 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service.
May 04 22:08:11.001531 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'set date 2026-05-04 22:08:11'.
May 04 22:08:11.002240 osdx systemd-journald[1908]: Time jumped backwards, rotating.
May 04 22:08:11.282110 osdx systemd-journald[1908]: Runtime Journal (/run/log/journal/9e2a66651dea45ed982d8152051049c2) is 2.4M, max 13.8M, 11.3M free.
May 04 22:08:11.282686 osdx systemd-journald[1908]: Received client request to rotate journal, rotating.
May 04 22:08:11.282728 osdx systemd-journald[1908]: Vacuuming done, freed 0B of archived journals from /run/log/journal/9e2a66651dea45ed982d8152051049c2.
May 04 22:08:11.291283 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'system journal clear'.
May 04 22:08:11.508862 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'system coredump delete all'.
May 04 22:08:11.716677 osdx OSDxCLI[88731]: User 'admin' entered the configuration menu.
May 04 22:08:11.836131 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
May 04 22:08:11.887342 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'.
May 04 22:08:11.980794 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
May 04 22:08:12.032732 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'.
May 04 22:08:12.127555 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'.
May 04 22:08:12.176594 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'.
May 04 22:08:12.281823 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'show working'.
May 04 22:08:12.340219 osdx ubnt-cfgd[89242]: inactive
May 04 22:08:12.364188 osdx INFO[89248]: FRR daemons did not change
May 04 22:08:12.390246 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1
May 04 22:08:12.410495 osdx WARNING[89288]: No supported link modes on interface eth1
May 04 22:08:12.411800 osdx modulelauncher[89288]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on
May 04 22:08:12.411814 osdx modulelauncher[89288]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76.
May 04 22:08:12.413044 osdx modulelauncher[89288]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Pause off Asym_Pause off --
May 04 22:08:12.413050 osdx modulelauncher[89288]: Command '/sbin/ethtool -s eth1 autoneg on advertise Pause off Asym_Pause off --' returned non-zero exit status 75.
May 04 22:08:12.446250 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
May 04 22:08:12.487310 osdx WARNING[89368]: No supported link modes on interface eth0
May 04 22:08:12.488654 osdx modulelauncher[89368]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
May 04 22:08:12.488666 osdx modulelauncher[89368]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
May 04 22:08:12.489786 osdx modulelauncher[89368]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Pause off Asym_Pause off --
May 04 22:08:12.489793 osdx modulelauncher[89368]: Command '/sbin/ethtool -s eth0 autoneg on advertise Pause off Asym_Pause off --' returned non-zero exit status 75.
May 04 22:08:12.499257 osdx (udev-worker)[89384]: Network interface NamePolicy= disabled on kernel command line.
May 04 22:08:12.652218 osdx cfgd[1648]: [88731]Completed change to active configuration
May 04 22:08:12.663007 osdx OSDxCLI[88731]: User 'admin' committed the configuration.
May 04 22:08:12.683441 osdx OSDxCLI[88731]: User 'admin' left the configuration menu.
May 04 22:08:14.627279 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
May 04 22:08:14.700891 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'.
May 04 22:08:14.808648 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'.
May 04 22:08:15.310041 osdx file_operation[89564]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running://
May 04 22:08:15.332899 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'.
May 04 22:08:15.458414 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'file show running://test-performance.rules'.
May 04 22:08:15.602352 osdx OSDxCLI[88731]: User 'admin' entered the configuration menu.
May 04 22:08:15.659943 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'.
May 04 22:08:15.755758 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'.
May 04 22:08:15.807152 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'.
May 04 22:08:15.898573 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'.
May 04 22:08:15.950422 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'.
May 04 22:08:16.043341 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'.
May 04 22:08:16.130367 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'.
May 04 22:08:16.185149 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'.
May 04 22:08:16.273559 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'.
May 04 22:08:16.323958 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'.
May 04 22:08:16.414725 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic label BYPASS'.
May 04 22:08:16.470645 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'.
May 04 22:08:16.562077 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'.
May 04 22:08:16.615875 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'.
May 04 22:08:16.709604 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'.
May 04 22:08:16.766223 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'.
May 04 22:08:16.854765 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'.
May 04 22:08:16.908732 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'.
May 04 22:08:16.999394 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'.
May 04 22:08:17.051748 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'.
May 04 22:08:17.169264 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'show working'.
May 04 22:08:17.251005 osdx ubnt-cfgd[89612]: inactive
May 04 22:08:17.324565 osdx INFO[89657]: FRR daemons did not change
May 04 22:08:17.562758 osdx systemd[1]: Reloading.
May 04 22:08:17.650254 osdx systemd-sysv-generator[89713]: stat() failed on /etc/init.d/README, ignoring: No such file or directory
May 04 22:08:17.778840 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service...
May 04 22:08:17.807490 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service.
May 04 22:08:17.991120 osdx INFO[89694]: Rules successfully loaded
May 04 22:08:17.991810 osdx cfgd[1648]: [88731]Completed change to active configuration
May 04 22:08:17.993922 osdx OSDxCLI[88731]: User 'admin' committed the configuration.
May 04 22:08:18.007976 osdx OSDxCLI[88731]: User 'admin' left the configuration menu.
May 04 22:08:18.402879 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=44208 DF PROTO=TCP SPT=56168 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
May 04 22:08:18.402952 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=7449 DF PROTO=TCP SPT=56178 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
May 04 22:08:28.547007 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
May 04 22:08:28.657596 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'system journal show | cat'.
May 04 22:08:28.894488 osdx OSDxCLI[88731]: User 'admin' entered the configuration menu.
May 04 22:08:28.957098 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'.
May 04 22:08:29.055871 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'.
May 04 22:08:29.113676 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'.
May 04 22:08:29.196303 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'.
May 04 22:08:29.255339 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'.
May 04 22:08:29.347565 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'.
May 04 22:08:29.433477 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'.
May 04 22:08:29.497232 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'.
May 04 22:08:29.587315 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'.
May 04 22:08:29.639082 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'.
May 04 22:08:29.733706 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic label BYPASS'.
May 04 22:08:29.788790 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'.
May 04 22:08:29.883075 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'.
May 04 22:08:29.939188 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'.
May 04 22:08:30.030583 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'.
May 04 22:08:30.092006 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'.
May 04 22:08:30.193294 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'.
May 04 22:08:30.255157 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'.
May 04 22:08:30.346601 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'.
May 04 22:08:30.399091 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'.
May 04 22:08:30.491942 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'.
May 04 22:08:30.544285 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'.
May 04 22:08:30.636985 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'.
May 04 22:08:30.703339 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'.
May 04 22:08:30.820260 osdx OSDxCLI[88731]: User 'admin' added a new cfg line: 'show changes'.
May 04 22:08:30.890868 osdx ubnt-cfgd[89836]: inactive
May 04 22:08:30.940718 osdx INFO[89856]: FRR daemons did not change
May 04 22:08:31.190739 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service...
May 04 22:08:32.768539 osdx systemd[1]: suricata@FW.service: Deactivated successfully.
May 04 22:08:32.768653 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service.
May 04 22:08:32.768685 osdx systemd[1]: suricata@FW.service: Consumed 1.674s CPU time.
May 04 22:08:32.786545 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service...
May 04 22:08:32.802718 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service.
May 04 22:08:32.975700 osdx INFO[89883]: Rules successfully loaded
May 04 22:08:32.976238 osdx cfgd[1648]: [88731]Completed change to active configuration
May 04 22:08:32.979172 osdx OSDxCLI[88731]: User 'admin' committed the configuration.
May 04 22:08:33.033012 osdx OSDxCLI[88731]: User 'admin' left the configuration menu.
May 04 22:08:33.190285 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=31067 DF PROTO=TCP SPT=39574 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff
May 04 22:08:33.190361 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=60939 DF PROTO=TCP SPT=39586 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff
May 04 22:08:41.030865 osdx systemd[1]: systemd-timedated.service: Deactivated successfully.
May 04 22:08:43.365223 osdx OSDxCLI[88731]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.

Test Capture Bypass Using Conntrack Mark 

Description 

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.

Performance must improve considerably compared to the Local Bypass test.

Then this test is broadened by using other conntrack marks that we have customized for the firewall.

Scenario 

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW stream bypass set-connmark
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$

Note

The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.

Step 9: Modify the following configuration lines in DUT0 :

set service firewall FW stream bypass extra-mark 2 mask 3294967295
set service firewall FW stream bypass extra-mark 2 set-extra-connmark
set service firewall FW stream bypass extra-mark 2 value 3294967295
set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK
set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295

Step 10: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$

Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$

Test Bypass-Drop Using Conntrack Marks 

Description 

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.

Scenario 

Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:

Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW bypass action drop set connmark mark 147652983
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://drop-performance.rules'
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action drop
set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_DROP rule 1 connmark 147652983

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$

Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:

(?m)^1\s+FW_SEL_DROP\s+[1-9].*$

Note

Testing with another conntrack mark.

Step 10: Modify the following configuration lines in DUT0 :

delete service firewall FW bypass action drop set connmark mark
set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294
set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM
set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294

Step 11: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1

Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$

Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$

Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:

(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$

Test Capture And Offload 

Description 

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.

Performance must improve considerably compared to the previous test, to reach its top value.

Scenario 

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass action accept set conntrack offload-flag
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW stream bypass set-connmark
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$

Step 9: Stop the current bandwidth test between DUT2 and DUT1

Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:

Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:

Step 12: Modify the following configuration lines in DUT0 :

set service firewall FW ruleset file 'running://test-performance-udp.rules'

Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1

Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance UDP traffic).+$

Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$

Step 16: Stop the current bandwidth test between DUT2 and DUT1

Test Traffic Early Dropping 

Description 

Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.

The contents of the rule file are:

drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)

This rule allows the connection to be established and traffic to be dropped later.

Scenario 

Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:

Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://drop-performance.rules'
set service firewall FW stream bypass action drop set xdp-early-drop eth1
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$

Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:

yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*

Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:

Step 10: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1

Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping UDP performance test traffic).+$

Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:

yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*

Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output: