mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-22 01:13:00 +02:00
Joachim Wiberg
b341d37267
DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org), so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A www subdomain can carry a CNAME pointing directly to kernelkit.github.io, giving GitHub full control over the mapping and making the redirect work. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
355 lines
14 KiB
Markdown
355 lines
14 KiB
Markdown
# Scripting for Production Tests
|
|
|
|
This document shows how to set up and remotely script devices with a
|
|
focus on production testing.
|
|
|
|
## VLAN Snake
|
|
|
|
As part of production tests, verification of Ethernet ports is usually
|
|
expected. A common way for devices with multiple bridged Ethernet ports
|
|
is to connect a test PC to two ports and send a *ping* traversing all
|
|
ports. This can be achieved by using VLANs, on the switch, as described
|
|
in this section. The resulting configuration file can be applied to the
|
|
running configuration of the produced unit, e.g, use config file restore
|
|
as [described previously][2].
|
|
|
|
In this example we assume a 10 port switch, with ports e1-e10. The
|
|
following VLAN configuration and cable connections will be used:
|
|
|
|
| VLAN & Ports | Connect |
|
|
|:------------------|:----------|
|
|
| VLAN 10: e1 & e2 | e2 <=> e3 |
|
|
| VLAN 20: e3 & e4 | e4 <=> e5 |
|
|
| VLAN 30: e5 & e6 | e6 <=> e7 |
|
|
| VLAN 40: e7 & e8 | e8 <=> e9 |
|
|
| VLAN 50: e9 & e10 | |
|
|
|
|
The test PC is connected to e1 and e10 via different interfaces
|
|
(alternatively, two different PCs are used).
|
|
|
|
> [!TIP]
|
|
> Configuration here is done via console. When configuring remotely
|
|
> over SSH, remember to keep one IP address (the one used for the SSH
|
|
> connection)! I.e., set a static IP address first, then perform the
|
|
> VLAN configuration step.
|
|
|
|
## Configuration at Start
|
|
|
|
Starting out, we assume a configuration where all ports are network
|
|
interfaces (possibly with IPv6 enabled).
|
|
|
|
```
|
|
admin@example:/> show interfaces
|
|
lo ethernet UP 00:00:00:00:00:00
|
|
ipv4 127.0.0.1/8 (static)
|
|
ipv6 ::1/128 (static)
|
|
e1 ethernet LOWER-DOWN 00:53:00:06:11:01
|
|
e2 ethernet LOWER-DOWN 00:53:00:06:11:02
|
|
e3 ethernet LOWER-DOWN 00:53:00:06:11:03
|
|
e4 ethernet LOWER-DOWN 00:53:00:06:11:04
|
|
e5 ethernet LOWER-DOWN 00:53:00:06:11:05
|
|
e6 ethernet LOWER-DOWN 00:53:00:06:11:06
|
|
e7 ethernet LOWER-DOWN 00:53:00:06:11:07
|
|
e8 ethernet LOWER-DOWN 00:53:00:06:11:08
|
|
e9 ethernet LOWER-DOWN 00:53:00:06:11:09
|
|
e10 ethernet UP 00:53:00:06:11:0a
|
|
ipv6 fe80::0053:00ff:fe06:110a/64 (link-layer)
|
|
admin@example:/>
|
|
```
|
|
|
|
## Creating Bridge and Adding Ports
|
|
|
|
The following example [creates a bridge][8] and adds all Ethernet ports
|
|
to it. On a device with layer-2 offloading (switch fabric), this sets
|
|
all ports in the same VLAN. The next section sets up VLAN isolation.
|
|
|
|
```
|
|
admin@example:/> configure
|
|
admin@example:/config/> edit interface br0
|
|
admin@example:/config/interface/br0/> end
|
|
admin@example:/config/> set interface e1 bridge-port bridge br0
|
|
admin@example:/config/> set interface e2 bridge-port bridge br0
|
|
admin@example:/config/> set interface e3 bridge-port bridge br0
|
|
admin@example:/config/> set interface e4 bridge-port bridge br0
|
|
admin@example:/config/> set interface e5 bridge-port bridge br0
|
|
admin@example:/config/> set interface e6 bridge-port bridge br0
|
|
admin@example:/config/> set interface e7 bridge-port bridge br0
|
|
admin@example:/config/> set interface e8 bridge-port bridge br0
|
|
admin@example:/config/> set interface e9 bridge-port bridge br0
|
|
admin@example:/config/> set interface e10 bridge-port bridge br0
|
|
admin@example:/config/>
|
|
```
|
|
|
|
The interface status can be viewed using `show interfaces` after leaving
|
|
configuration context. When configuring via SSH, first assign an IP
|
|
address to `br0` *before leaving* configuration context, e.g.
|
|
|
|
```
|
|
admin@example:/config/> set interface br0 ipv6 enabled
|
|
```
|
|
|
|
This enables IPv6 SLAAC, auto-configured address. Or skip `leave` and
|
|
stay in configuration context until you have completed all the device
|
|
setup, including [setting IP address](#set-ip-address).
|
|
|
|
```
|
|
admin@example:/config/> leave
|
|
admin@example:/>
|
|
admin@example:/> show interfaces
|
|
INTERFACE PROTOCOL STATE DATA
|
|
br0 bridge
|
|
│ ethernet UP 00:53:00:06:11:01
|
|
├ e1 bridge LOWER-DOWN
|
|
├ e2 bridge LOWER-DOWN
|
|
├ e3 bridge LOWER-DOWN
|
|
├ e4 bridge LOWER-DOWN
|
|
├ e5 bridge LOWER-DOWN
|
|
├ e6 bridge LOWER-DOWN
|
|
├ e7 bridge LOWER-DOWN
|
|
├ e8 bridge LOWER-DOWN
|
|
├ e9 bridge LOWER-DOWN
|
|
└ e10 bridge FORWARDING
|
|
lo ethernet UP 00:00:00:00:00:00
|
|
ipv4 127.0.0.1/8 (static)
|
|
ipv6 ::1/128 (static)
|
|
admin@example:/>
|
|
```
|
|
|
|
## Assign VLANs to Ports
|
|
|
|
Now, configure VLANs as outlined [previously](#vlan-snake): default VID
|
|
for ingress (PVID), which is done per port, and egress mode (untagged),
|
|
which is done at the bridge level. See the [VLAN bridges][9] section for
|
|
more information.
|
|
|
|
```
|
|
admin@example:/>
|
|
admin@example:/> configure
|
|
admin@example:/config/> set interface e1 bridge-port pvid 10
|
|
admin@example:/config/> set interface e2 bridge-port pvid 10
|
|
admin@example:/config/> set interface e3 bridge-port pvid 20
|
|
admin@example:/config/> set interface e4 bridge-port pvid 20
|
|
admin@example:/config/> set interface e5 bridge-port pvid 30
|
|
admin@example:/config/> set interface e6 bridge-port pvid 30
|
|
admin@example:/config/> set interface e7 bridge-port pvid 40
|
|
admin@example:/config/> set interface e8 bridge-port pvid 40
|
|
admin@example:/config/> set interface e9 bridge-port pvid 50
|
|
admin@example:/config/> set interface e10 bridge-port pvid 50
|
|
admin@example:/config/> edit interface br0
|
|
admin@example:/config/interface/br0/> edit bridge vlans
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 untagged e1
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 untagged e2
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 20 untagged e3
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 20 untagged e4
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 30 untagged e5
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 30 untagged e6
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 40 untagged e7
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 40 untagged e8
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 50 untagged e9
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 50 untagged e10
|
|
admin@example:/config/interface/br0/bridge/vlans/> leave
|
|
admin@example:/>
|
|
```
|
|
|
|
Interface status would now should something like the following
|
|
|
|
```
|
|
admin@example:/> show interfaces
|
|
INTERFACE PROTOCOL STATE DATA
|
|
br0 bridge
|
|
│ ethernet UP 00:53:00:06:11:01
|
|
├ e1 bridge LOWER-DOWN vlan:10u pvid:10
|
|
├ e2 bridge LOWER-DOWN vlan:10u pvid:10
|
|
├ e3 bridge LOWER-DOWN vlan:20u pvid:20
|
|
├ e4 bridge LOWER-DOWN vlan:20u pvid:20
|
|
├ e5 bridge LOWER-DOWN vlan:30u pvid:30
|
|
├ e6 bridge LOWER-DOWN vlan:30u pvid:30
|
|
├ e7 bridge LOWER-DOWN vlan:40u pvid:40
|
|
├ e8 bridge LOWER-DOWN vlan:40u pvid:40
|
|
├ e9 bridge LOWER-DOWN vlan:50u pvid:50
|
|
└ e10 bridge FORWARDING vlan:50u pvid:50
|
|
lo ethernet UP 00:00:00:00:00:00
|
|
ipv4 127.0.0.1/8 (static)
|
|
ipv6 ::1/128 (static)
|
|
admin@example:/>
|
|
```
|
|
|
|
## Connect Cables and Test
|
|
|
|
We can now connect the PC to e1 and e10, while the other ports are
|
|
patched according to [above](#vlan-snake). We should see link up and
|
|
*FORWARDING* on all ports in the bridge.
|
|
|
|
```
|
|
admin@example:/> show interfaces
|
|
INTERFACE PROTOCOL STATE DATA
|
|
br0 bridge
|
|
│ ethernet UP 00:53:00:06:11:01
|
|
├ e1 bridge FORWARDING vlan:10u pvid:10
|
|
├ e2 bridge FORWARDING vlan:10u pvid:10
|
|
├ e3 bridge FORWARDING vlan:20u pvid:20
|
|
├ e4 bridge FORWARDING vlan:20u pvid:20
|
|
├ e5 bridge FORWARDING vlan:30u pvid:30
|
|
├ e6 bridge FORWARDING vlan:30u pvid:30
|
|
├ e7 bridge FORWARDING vlan:40u pvid:40
|
|
├ e8 bridge FORWARDING vlan:40u pvid:40
|
|
├ e9 bridge FORWARDING vlan:50u pvid:50
|
|
└ e10 bridge FORWARDING vlan:50u pvid:50
|
|
lo ethernet UP 00:00:00:00:00:00
|
|
ipv4 127.0.0.1/8 (static)
|
|
ipv6 ::1/128 (static)
|
|
admin@example:/>
|
|
```
|
|
|
|
Here we use IPv6 ping all hosts (ff02::1) on PC interface eth1 to
|
|
check reachability to the other interface of the PC.
|
|
|
|
> [!TIP]
|
|
> We recommend using network namespaces (Linux only) on the PC to ensure
|
|
> that traffic is actually sent out to the switch, rather than being
|
|
> looped back internally. Alternatively, use two separate PCs.
|
|
|
|
```
|
|
~ $ ping -L ff02::1%eth1
|
|
PING ff02::1%eth1(ff02::1%eth1) 56 data bytes
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.496 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.514 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.473 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.736 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=5 ttl=64 time=0.563 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=6 ttl=64 time=0.507 ms
|
|
^C
|
|
--- ff02::1%eth1 ping statistics ---
|
|
6 packets transmitted, 6 received, 0% packet loss, time 5108ms
|
|
rtt min/avg/max/mdev = 0.473/0.548/0.736/0.088 ms
|
|
~ $
|
|
```
|
|
|
|
We can verify that traffic goes through the switch by disconnecting
|
|
one of the patch cables, e.g., between e4 and e5
|
|
|
|
```
|
|
~ $ ping -L ff02::1%eth1
|
|
PING ff02::1%eth1(ff02::1%eth1) 56 data bytes
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.510 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.448 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.583 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.515 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=5 ttl=64 time=0.521 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=6 ttl=64 time=0.495 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=7 ttl=64 time=0.743 ms
|
|
... Disconnecting patch cable, thus losing packets
|
|
... and reconnecting again. Connectivity resumes.
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=16 ttl=64 time=0.961 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=17 ttl=64 time=0.513 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=18 ttl=64 time=0.794 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=19 ttl=64 time=0.755 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=20 ttl=64 time=0.779 ms
|
|
^C
|
|
--- ff02::1%eth1 ping statistics ---
|
|
20 packets transmitted, 12 received, 40% packet loss, time 19432ms
|
|
rtt min/avg/max/mdev = 0.448/0.634/0.961/0.156 ms
|
|
~ $
|
|
```
|
|
|
|
## Set IP Address
|
|
|
|
The configuration so far does not provide a means to connect to the
|
|
switch management via SSH or NETCONF, as the switch has no IP address.
|
|
The example below shows how to add the switch to VLAN 10 (as used for
|
|
ports e1 and e2) and enables IPv6.
|
|
|
|
```
|
|
admin@example:/config/> edit interface vlan10
|
|
admin@example:/config/interface/vlan10/> set vlan lower-layer-if br0
|
|
admin@example:/config/interface/vlan10/> set ipv6 enabled
|
|
admin@example:/config/interface/vlan10/> show
|
|
type vlan;
|
|
ipv6 {
|
|
enabled true;
|
|
}
|
|
vlan {
|
|
tag-type c-vlan;
|
|
id 10;
|
|
lower-layer-if br0;
|
|
}
|
|
admin@example:/config/interface/vlan10/>
|
|
admin@example:/config/interface/vlan10/> end
|
|
admin@example:/config/> edit interface br0 bridge vlans
|
|
admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 tagged br0
|
|
admin@example:/config/interface/br0/bridge/vlans/> leave
|
|
admin@example:/>
|
|
```
|
|
|
|
Interface *vlan10* with an auto-configured IPv6 address should appear.
|
|
|
|
```
|
|
admin@example:/> show interfaces
|
|
INTERFACE PROTOCOL STATE DATA
|
|
br0 bridge vlan:10t
|
|
│ ethernet UP 00:53:00:06:11:01
|
|
├ e1 bridge FORWARDING vlan:10u pvid:10
|
|
├ e2 bridge FORWARDING vlan:10u pvid:10
|
|
├ e3 bridge FORWARDING vlan:20u pvid:20
|
|
├ e4 bridge FORWARDING vlan:20u pvid:20
|
|
├ e5 bridge FORWARDING vlan:30u pvid:30
|
|
├ e6 bridge FORWARDING vlan:30u pvid:30
|
|
├ e7 bridge FORWARDING vlan:40u pvid:40
|
|
├ e8 bridge FORWARDING vlan:40u pvid:40
|
|
├ e9 bridge FORWARDING vlan:50u pvid:50
|
|
└ e10 bridge FORWARDING vlan:50u pvid:50
|
|
lo ethernet UP 00:00:00:00:00:00
|
|
ipv4 127.0.0.1/8 (static)
|
|
ipv6 ::1/128 (static)
|
|
vlan10 ethernet UP 00:53:00:06:11:01
|
|
│ ipv6 fe80::0053:00ff:fe06:1101/64 (link-layer)
|
|
└ br0 ethernet UP 00:53:00:06:11:01
|
|
admin@example:/>
|
|
```
|
|
|
|
When pinging "IPv6 all hosts" from the PC, there should be two
|
|
responses for every ping, one from the switch and one from the PC
|
|
attached to e10.
|
|
|
|
```
|
|
~ $ ping -L ff02::1%eth1
|
|
PING ff02::1%eth1(ff02::1%eth1) 56 data bytes
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.508 ms
|
|
64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=1 ttl=64 time=0.968 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.866 ms
|
|
64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=2 ttl=64 time=0.867 ms
|
|
64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=3 ttl=64 time=0.467 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.469 ms
|
|
64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.452 ms
|
|
64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=4 ttl=64 time=0.453 ms
|
|
^C
|
|
--- ff02::1%eth1 ping statistics ---
|
|
4 packets transmitted, 4 received, +4 duplicates, 0% packet loss, time 3031ms
|
|
rtt min/avg/max/mdev = 0.452/0.631/0.968/0.211 ms
|
|
~ $
|
|
```
|
|
|
|
It should now be possible to access the switch from the PC via SSH (or NETCONF).
|
|
|
|
```
|
|
~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
|
|
admin@fe80::0053:00ff:fe06:1101%eth1's password:
|
|
.-------.
|
|
| . . | Infix OS — Immutable.Friendly.Secure
|
|
|-. v .-| https://www.kernelkit.org
|
|
'-'---'-'
|
|
|
|
Run the command 'cli' for interactive OAM
|
|
|
|
admin@example:~$ exit
|
|
~ $
|
|
```
|
|
|
|
See previous sections on [backup][1] and [restore][2] of
|
|
the created configuration.
|
|
|
|
[1]: scripting-sysrepocfg.md#backup-configuration
|
|
[2]: scripting-sysrepocfg.md#restore-configuration
|
|
[8]: bridging.md
|
|
[9]: bridging.md#vlan-filtering-bridge
|