# Scripting for Production Tests This document shows how to set up and remotely script devices with a focus on production testing. ## VLAN Snake As part of production tests, verification of Ethernet ports is usually expected. A common way for devices with multiple bridged Ethernet ports is to connect a test PC to two ports and send a *ping* traversing all ports. This can be achieved by using VLANs, on the switch, as described in this section. The resulting configuration file can be applied to the running configuration of the produced unit, e.g, use config file restore as [described previously][2]. In this example we assume a 10 port switch, with ports e1-e10. The following VLAN configuration and cable connections will be used: | VLAN & Ports | Connect | |:------------------|:----------| | VLAN 10: e1 & e2 | e2 <=> e3 | | VLAN 20: e3 & e4 | e4 <=> e5 | | VLAN 30: e5 & e6 | e6 <=> e7 | | VLAN 40: e7 & e8 | e8 <=> e9 | | VLAN 50: e9 & e10 | | The test PC is connected to e1 and e10 via different interfaces (alternatively, two different PCs are used). > [!TIP] > Configuration here is done via console. When configuring remotely > over SSH, remember to keep one IP address (the one used for the SSH > connection)! I.e., set a static IP address first, then perform the > VLAN configuration step. ## Configuration at Start Starting out, we assume a configuration where all ports are network interfaces (possibly with IPv6 enabled). ``` admin@example:/> show interfaces lo ethernet UP 00:00:00:00:00:00 ipv4 127.0.0.1/8 (static) ipv6 ::1/128 (static) e1 ethernet LOWER-DOWN 00:53:00:06:11:01 e2 ethernet LOWER-DOWN 00:53:00:06:11:02 e3 ethernet LOWER-DOWN 00:53:00:06:11:03 e4 ethernet LOWER-DOWN 00:53:00:06:11:04 e5 ethernet LOWER-DOWN 00:53:00:06:11:05 e6 ethernet LOWER-DOWN 00:53:00:06:11:06 e7 ethernet LOWER-DOWN 00:53:00:06:11:07 e8 ethernet LOWER-DOWN 00:53:00:06:11:08 e9 ethernet LOWER-DOWN 00:53:00:06:11:09 e10 ethernet UP 00:53:00:06:11:0a ipv6 fe80::0053:00ff:fe06:110a/64 (link-layer) admin@example:/> ``` ## Creating Bridge and Adding Ports The following example [creates a bridge][8] and adds all Ethernet ports to it. On a device with layer-2 offloading (switch fabric), this sets all ports in the same VLAN. The next section sets up VLAN isolation. ``` admin@example:/> configure admin@example:/config/> edit interface br0 admin@example:/config/interface/br0/> end admin@example:/config/> set interface e1 bridge-port bridge br0 admin@example:/config/> set interface e2 bridge-port bridge br0 admin@example:/config/> set interface e3 bridge-port bridge br0 admin@example:/config/> set interface e4 bridge-port bridge br0 admin@example:/config/> set interface e5 bridge-port bridge br0 admin@example:/config/> set interface e6 bridge-port bridge br0 admin@example:/config/> set interface e7 bridge-port bridge br0 admin@example:/config/> set interface e8 bridge-port bridge br0 admin@example:/config/> set interface e9 bridge-port bridge br0 admin@example:/config/> set interface e10 bridge-port bridge br0 admin@example:/config/> ``` The interface status can be viewed using `show interfaces` after leaving configuration context. When configuring via SSH, first assign an IP address to `br0` *before leaving* configuration context, e.g. ``` admin@example:/config/> set interface br0 ipv6 enabled ``` This enables IPv6 SLAAC, auto-configured address. Or skip `leave` and stay in configuration context until you have completed all the device setup, including [setting IP address](#set-ip-address). ``` admin@example:/config/> leave admin@example:/> admin@example:/> show interfaces INTERFACE PROTOCOL STATE DATA br0 bridge │ ethernet UP 00:53:00:06:11:01 ├ e1 bridge LOWER-DOWN ├ e2 bridge LOWER-DOWN ├ e3 bridge LOWER-DOWN ├ e4 bridge LOWER-DOWN ├ e5 bridge LOWER-DOWN ├ e6 bridge LOWER-DOWN ├ e7 bridge LOWER-DOWN ├ e8 bridge LOWER-DOWN ├ e9 bridge LOWER-DOWN └ e10 bridge FORWARDING lo ethernet UP 00:00:00:00:00:00 ipv4 127.0.0.1/8 (static) ipv6 ::1/128 (static) admin@example:/> ``` ## Assign VLANs to Ports Now, configure VLANs as outlined [previously](#vlan-snake): default VID for ingress (PVID), which is done per port, and egress mode (untagged), which is done at the bridge level. See the [VLAN bridges][9] section for more information. ``` admin@example:/> admin@example:/> configure admin@example:/config/> set interface e1 bridge-port pvid 10 admin@example:/config/> set interface e2 bridge-port pvid 10 admin@example:/config/> set interface e3 bridge-port pvid 20 admin@example:/config/> set interface e4 bridge-port pvid 20 admin@example:/config/> set interface e5 bridge-port pvid 30 admin@example:/config/> set interface e6 bridge-port pvid 30 admin@example:/config/> set interface e7 bridge-port pvid 40 admin@example:/config/> set interface e8 bridge-port pvid 40 admin@example:/config/> set interface e9 bridge-port pvid 50 admin@example:/config/> set interface e10 bridge-port pvid 50 admin@example:/config/> edit interface br0 admin@example:/config/interface/br0/> edit bridge vlans admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 untagged e1 admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 untagged e2 admin@example:/config/interface/br0/bridge/vlans/> set vlan 20 untagged e3 admin@example:/config/interface/br0/bridge/vlans/> set vlan 20 untagged e4 admin@example:/config/interface/br0/bridge/vlans/> set vlan 30 untagged e5 admin@example:/config/interface/br0/bridge/vlans/> set vlan 30 untagged e6 admin@example:/config/interface/br0/bridge/vlans/> set vlan 40 untagged e7 admin@example:/config/interface/br0/bridge/vlans/> set vlan 40 untagged e8 admin@example:/config/interface/br0/bridge/vlans/> set vlan 50 untagged e9 admin@example:/config/interface/br0/bridge/vlans/> set vlan 50 untagged e10 admin@example:/config/interface/br0/bridge/vlans/> leave admin@example:/> ``` Interface status would now should something like the following ``` admin@example:/> show interfaces INTERFACE PROTOCOL STATE DATA br0 bridge │ ethernet UP 00:53:00:06:11:01 ├ e1 bridge LOWER-DOWN vlan:10u pvid:10 ├ e2 bridge LOWER-DOWN vlan:10u pvid:10 ├ e3 bridge LOWER-DOWN vlan:20u pvid:20 ├ e4 bridge LOWER-DOWN vlan:20u pvid:20 ├ e5 bridge LOWER-DOWN vlan:30u pvid:30 ├ e6 bridge LOWER-DOWN vlan:30u pvid:30 ├ e7 bridge LOWER-DOWN vlan:40u pvid:40 ├ e8 bridge LOWER-DOWN vlan:40u pvid:40 ├ e9 bridge LOWER-DOWN vlan:50u pvid:50 └ e10 bridge FORWARDING vlan:50u pvid:50 lo ethernet UP 00:00:00:00:00:00 ipv4 127.0.0.1/8 (static) ipv6 ::1/128 (static) admin@example:/> ``` ## Connect Cables and Test We can now connect the PC to e1 and e10, while the other ports are patched according to [above](#vlan-snake). We should see link up and *FORWARDING* on all ports in the bridge. ``` admin@example:/> show interfaces INTERFACE PROTOCOL STATE DATA br0 bridge │ ethernet UP 00:53:00:06:11:01 ├ e1 bridge FORWARDING vlan:10u pvid:10 ├ e2 bridge FORWARDING vlan:10u pvid:10 ├ e3 bridge FORWARDING vlan:20u pvid:20 ├ e4 bridge FORWARDING vlan:20u pvid:20 ├ e5 bridge FORWARDING vlan:30u pvid:30 ├ e6 bridge FORWARDING vlan:30u pvid:30 ├ e7 bridge FORWARDING vlan:40u pvid:40 ├ e8 bridge FORWARDING vlan:40u pvid:40 ├ e9 bridge FORWARDING vlan:50u pvid:50 └ e10 bridge FORWARDING vlan:50u pvid:50 lo ethernet UP 00:00:00:00:00:00 ipv4 127.0.0.1/8 (static) ipv6 ::1/128 (static) admin@example:/> ``` Here we use IPv6 ping all hosts (ff02::1) on PC interface eth1 to check reachability to the other interface of the PC. > [!TIP] > We recommend using network namespaces (Linux only) on the PC to ensure > that traffic is actually sent out to the switch, rather than being > looped back internally. Alternatively, use two separate PCs. ``` ~ $ ping -L ff02::1%eth1 PING ff02::1%eth1(ff02::1%eth1) 56 data bytes 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.496 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.514 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.473 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.736 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=5 ttl=64 time=0.563 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=6 ttl=64 time=0.507 ms ^C --- ff02::1%eth1 ping statistics --- 6 packets transmitted, 6 received, 0% packet loss, time 5108ms rtt min/avg/max/mdev = 0.473/0.548/0.736/0.088 ms ~ $ ``` We can verify that traffic goes through the switch by disconnecting one of the patch cables, e.g., between e4 and e5 ``` ~ $ ping -L ff02::1%eth1 PING ff02::1%eth1(ff02::1%eth1) 56 data bytes 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.510 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.448 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.583 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.515 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=5 ttl=64 time=0.521 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=6 ttl=64 time=0.495 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=7 ttl=64 time=0.743 ms ... Disconnecting patch cable, thus losing packets ... and reconnecting again. Connectivity resumes. 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=16 ttl=64 time=0.961 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=17 ttl=64 time=0.513 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=18 ttl=64 time=0.794 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=19 ttl=64 time=0.755 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=20 ttl=64 time=0.779 ms ^C --- ff02::1%eth1 ping statistics --- 20 packets transmitted, 12 received, 40% packet loss, time 19432ms rtt min/avg/max/mdev = 0.448/0.634/0.961/0.156 ms ~ $ ``` ## Set IP Address The configuration so far does not provide a means to connect to the switch management via SSH or NETCONF, as the switch has no IP address. The example below shows how to add the switch to VLAN 10 (as used for ports e1 and e2) and enables IPv6. ``` admin@example:/config/> edit interface vlan10 admin@example:/config/interface/vlan10/> set vlan lower-layer-if br0 admin@example:/config/interface/vlan10/> set ipv6 enabled admin@example:/config/interface/vlan10/> show type vlan; ipv6 { enabled true; } vlan { tag-type c-vlan; id 10; lower-layer-if br0; } admin@example:/config/interface/vlan10/> admin@example:/config/interface/vlan10/> end admin@example:/config/> edit interface br0 bridge vlans admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 tagged br0 admin@example:/config/interface/br0/bridge/vlans/> leave admin@example:/> ``` Interface *vlan10* with an auto-configured IPv6 address should appear. ``` admin@example:/> show interfaces INTERFACE PROTOCOL STATE DATA br0 bridge vlan:10t │ ethernet UP 00:53:00:06:11:01 ├ e1 bridge FORWARDING vlan:10u pvid:10 ├ e2 bridge FORWARDING vlan:10u pvid:10 ├ e3 bridge FORWARDING vlan:20u pvid:20 ├ e4 bridge FORWARDING vlan:20u pvid:20 ├ e5 bridge FORWARDING vlan:30u pvid:30 ├ e6 bridge FORWARDING vlan:30u pvid:30 ├ e7 bridge FORWARDING vlan:40u pvid:40 ├ e8 bridge FORWARDING vlan:40u pvid:40 ├ e9 bridge FORWARDING vlan:50u pvid:50 └ e10 bridge FORWARDING vlan:50u pvid:50 lo ethernet UP 00:00:00:00:00:00 ipv4 127.0.0.1/8 (static) ipv6 ::1/128 (static) vlan10 ethernet UP 00:53:00:06:11:01 │ ipv6 fe80::0053:00ff:fe06:1101/64 (link-layer) └ br0 ethernet UP 00:53:00:06:11:01 admin@example:/> ``` When pinging "IPv6 all hosts" from the PC, there should be two responses for every ping, one from the switch and one from the PC attached to e10. ``` ~ $ ping -L ff02::1%eth1 PING ff02::1%eth1(ff02::1%eth1) 56 data bytes 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.508 ms 64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=1 ttl=64 time=0.968 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.866 ms 64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=2 ttl=64 time=0.867 ms 64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=3 ttl=64 time=0.467 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.469 ms 64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.452 ms 64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=4 ttl=64 time=0.453 ms ^C --- ff02::1%eth1 ping statistics --- 4 packets transmitted, 4 received, +4 duplicates, 0% packet loss, time 3031ms rtt min/avg/max/mdev = 0.452/0.631/0.968/0.211 ms ~ $ ``` It should now be possible to access the switch from the PC via SSH (or NETCONF). ``` ~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1 admin@fe80::0053:00ff:fe06:1101%eth1's password: .-------. | . . | Infix OS — Immutable.Friendly.Secure |-. v .-| https://www.kernelkit.org '-'---'-' Run the command 'cli' for interactive OAM admin@example:~$ exit ~ $ ``` See previous sections on [backup][1] and [restore][2] of the created configuration. [1]: scripting-sysrepocfg.md#backup-configuration [2]: scripting-sysrepocfg.md#restore-configuration [8]: bridging.md [9]: bridging.md#vlan-filtering-bridge