Connlimit

The following scenario shows how to filter packets based on the number of simultaneous connections.

Test System Drop Over Connections 

Description 

This scenario shows how to limit the number of simultaneous system connections using traffic selectors

Scenario 

Note

In the example below, we use NSM operation on both DUT1 and DUT2 devices to establish two ICMP connections.

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth1 address 10.0.1.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system traffic policy local-in DROP_CONNLIMIT
set traffic policy DROP_CONNLIMIT rule 1 action drop
set traffic policy DROP_CONNLIMIT rule 1 selector CONNLIMIT_SEL
set traffic selector CONNLIMIT_SEL rule 1 connlimit 2
set traffic selector CONNLIMIT_SEL rule 1 protocol icmp
set traffic selector CONNLIMIT_SEL rule 1 state new

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set interfaces ethernet eth1 address 10.0.1.2/24
set service nsm operation TEST_OPER_1 destination-address 10.0.0.1
set service nsm operation TEST_OPER_1 interval 0.10
set service nsm operation TEST_OPER_1 type icmp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.0.0.3/24
set service nsm operation TEST_OPER_1 destination-address 10.0.0.1
set service nsm operation TEST_OPER_1 interval 0.10
set service nsm operation TEST_OPER_1 type icmp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command system conntrack show protocol icmp destination 10.0.0.1 at DUT1 and expect this output:

Step 5: Run command service nsm operation show at DUT1 and expect this output:

Step 6: Run command system conntrack show protocol icmp destination 10.0.0.1 at DUT2 and expect this output:

Step 7: Run command service nsm operation show at DUT2 and expect this output:

Step 8: Expect a failure in the following command: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 9: Expect a failure in the following command: Ping IP address 10.0.1.1 from DUT1:

admin@DUT1$ ping 10.0.1.1 count 5 size 56 timeout 1

Note

In this case, both pings fail because the policy is applied at system level.

Test Interface Drop Over Connections 

Description 

This scenario shows how to limit the number of simultaneous interface connections using traffic selectors

Scenario 

Note

In the example below, we use NSM operation on both DUT1 and DUT2 devices to establish two ICMP connections.

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy local-in DROP_CONNLIMIT
set interfaces ethernet eth1 address 10.0.1.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy DROP_CONNLIMIT rule 1 action drop
set traffic policy DROP_CONNLIMIT rule 1 selector CONNLIMIT_SEL
set traffic selector CONNLIMIT_SEL rule 1 connlimit 2
set traffic selector CONNLIMIT_SEL rule 1 protocol icmp
set traffic selector CONNLIMIT_SEL rule 1 state new

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set interfaces ethernet eth1 address 10.0.1.2/24
set service nsm operation TEST_OPER_1 destination-address 10.0.0.1
set service nsm operation TEST_OPER_1 interval 0.10
set service nsm operation TEST_OPER_1 type icmp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.0.0.3/24
set service nsm operation TEST_OPER_1 destination-address 10.0.0.1
set service nsm operation TEST_OPER_1 interval 0.10
set service nsm operation TEST_OPER_1 type icmp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command system conntrack show protocol icmp destination 10.0.0.1 at DUT1 and expect this output:

Step 5: Run command service nsm operation show at DUT1 and expect this output:

Step 6: Run command system conntrack show protocol icmp destination 10.0.0.1 at DUT2 and expect this output:

Step 7: Run command service nsm operation show at DUT2 and expect this output:

Step 8: Expect a failure in the following command: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 5 size 56 timeout 1

Step 9: Ping IP address 10.0.1.1 from DUT1:

admin@DUT1$ ping 10.0.1.1 count 5 size 56 timeout 1

Note

In this case, the second ping succeeds because the policy is applied at interface level.

Test Interface Log Under Connections 

Description 

This scenario shows how to log new incomming connections using traffic selectors

Scenario 

Note

In the example below, we use NSM operation on both DUT1 and DUT2 devices to establish two ICMP connections.

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy local-in DROP_CONNLIMIT
set interfaces ethernet eth1 address 10.0.1.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy DROP_CONNLIMIT rule 1 action accept
set traffic policy DROP_CONNLIMIT rule 1 log prefix Incomming_connection
set traffic policy DROP_CONNLIMIT rule 1 selector CONNLIMIT_SEL
set traffic selector CONNLIMIT_SEL rule 1 not connlimit 2
set traffic selector CONNLIMIT_SEL rule 1 protocol icmp
set traffic selector CONNLIMIT_SEL rule 1 state new

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set interfaces ethernet eth1 address 10.0.1.2/24
set service nsm operation TEST_OPER_1 destination-address 10.0.0.1
set service nsm operation TEST_OPER_1 interval 0.10
set service nsm operation TEST_OPER_1 type icmp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.0.0.3/24
set service nsm operation TEST_OPER_1 destination-address 10.0.0.1
set service nsm operation TEST_OPER_1 interval 0.10
set service nsm operation TEST_OPER_1 type icmp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command system conntrack show protocol icmp destination 10.0.0.1 at DUT1 and expect this output:

Step 5: Run command service nsm operation show at DUT1 and expect this output:

Step 6: Run command system conntrack show protocol icmp destination 10.0.0.1 at DUT2 and expect this output:

Step 7: Run command service nsm operation show at DUT2 and expect this output:

Step 8: Ping IP address 10.0.1.1 from DUT1:

admin@DUT1$ ping 10.0.1.1 count 5 size 56 timeout 1

Step 9: Run command system journal show | grep "kernel:.*Incomming_connection-1.*ACCEPT" at DUT0 and expect this output:

Note

As you can see in the output of the previous command, only the first two incoming connections are logged in the journal.