FortiTester 2.1. Handbook

Transcription

1 FortiTester 2.1 Handbook

2 FortiTester v2.1 Handbook Sep, st Edition Copyright 2014 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. Technical Documentation Knowledge Base Forums Customer Service & Support Training License Document Feedback techdocs@fortinet.com

3 Table of Contents Introduction... 4 Connecting to FortiTester... 5 Configuring FortiTester... 5 Start a TCP throughput test... 7 Start a TCP connection test... 8 Start a HTTP CPS test... 9 Start a HTTPS CPS test... 9 Start a HTTP RPS test... 9 Start a HTTPS RPS test Start a CAPWAP throughput test Stop a running test Show test status View test results Load an existing test case Show system status Shutting down & rebooting Restore factory configuration Using the command-line interface Fortinet 3 FortiTester 2.1 Handbook

4 Introduction Welcome, and thank you for selecting Fortinet products for your testing environment. FortiTester appliance is a powerful and easy-to-use tool that tests the performance of your network devices. This document describes how to set up your FortiTester appliance. It also describes how to use the web user interface (web UI) and command line interface (CLI). Benefits FortiTester is a network traffic test tool that is based on Fortinet's specialized hardware and software platform. It provides the following types of tests: TCP throughput test FortiTester can generate a specified volume of one-way TCP traffic flow via specified ports to test the TCP throughput performance of a DUT (Device Under Test). TCP connection test FortiTester can generate a specified volume of two-way TCP traffic flow via specified ports to test a DUT's TCP concurrent connections performance. HTTP/HTTPS CPS test By simulating multiple clients, FortiTester can generate HTTP or HTTPS traffic that tests a DUT's new connections per second (CPS) performance. HTTP/HTTPS RPS test By simulating multiple clients, FortiTester can generate HTTP or HTTPS traffic that tests a DUT's requests per second (RPS) performance. Intrusion test By replaying recorded traffic, FortiTester can simulate multiple clients to attack numerous of network devices, such as Firewall, IPS/IDS, to test how a DUT handle the attack traffic. CAPWAP throughput test By simulating multiple Wi-Fi APs (Access Point), FortiTester can generate CAPWAP traffic to test the CAPWAP throughput performance of a DUT. Fortinet 4 FortiTester 2.1 Handbook

5 Connecting to FortiTester The following figure shows a basic FortiTester device connection topology. Figure 1: Connecting to FortiTester A FortiTester appliance has multiple network ports. In most cases, one port is for management and the others are for testing. The test ports are divided into client ports and server ports that connect to the device under test (DUT). Client ports simulate multiple client devices that access the simulated server devices via server ports. The management port (usually port1) connects to an intranet and allows the user to access the FortiTester appliance via the web UI. Configuring FortiTester The following sections provide instructions for configuring basic settings. Configuring the management port You use the management port for administrator access. Depending on the model, the port is either labeled MGMT or port1. When you perform the initial configuration, the management port should be connected to the same switch as the client PC. To connect to the appliance: 1. Configure your computer to match the appliance s default port1 subnet. For example, on Windows 7: a. Go to Start (Windows logo) > Control Panel > Network and Sharing Center > Local Area Connection. b. Click the Properties button. c. Select Internet Protocol Version 4 (TCP/IPv4), then click its Properties button. d. Change the IP address and submask settings to the following: IP address: Subnet mask: To connect to the web UI, start a web browser and go to 3. Type admin in the Name field, enter the Password, and then click Login. 4. Select any type of test. 5. In the top banner, click (System link). Fortinet 5 FortiTester 2.1 Handbook

6 6. Select a management port, and change its IP address and network mask. The following figure shows a configuration that preserves the defaults. Figure 2: Set management port 7. Click Apply for the management port. 8. Specify the IP address for the Default Gateway, and then click the Apply. 9. Change the IP address of your client PC to the same network segment used by the management port's IP address. 10. To log into the web UI again, enter the new management IP address in a web browser. Configuring system time You can use the System page to change the FortiTester appliance system time. You can either manually specify the time or synchronize the system time with an NTP server. Time Settings page The current system date and time on the FortiTester unit. Enter the values System Time you want to use, and then click Apply. Enter the IP address or domain name of an NTP server. To find an NTP server NTP Server that you can use, see Click the Sync button to use the specified server to automatically set the system date and time. Time Zone Select the time zone where the appliance physically resides. Configuring a user account FortiTester has a default user admin. To change the password: 1. In the top banner, click admin link. 2. Select the Modify Password from the drop down menu. 3. Change the password. Fortinet 6 FortiTester 2.1 Handbook

7 Start a TCP throughput test FortiTester can generate a specified volume of one-way TCP traffic flow via specified ports to test the performance of DUT TCP throughput. To start a TCP throughput test: 1. Log in and select the TcpThroughput test type. The test setup page is displayed. 2. Click (edit button) to enter the name of the case. You can use this name to find the case in the list of test cases that FortiTester creates. 3. Enter a value for the test duration. The default is 10 minutes. The test stops automatically after the duration you specify. 4. Select client and server ports. The page lists all the test ports for the client and server. The client ports simulate the behavior of clients, while the server ports simulate the behavior of servers. FortiTester builds the TCP connections between client ports and server ports, through the DUT. You need to select at least one client port and one server port. After you select a port for client, a (check mark) is displayed on the port icon. The same port on the server side is displayed as not available, which indicates that you cannot select it as a server port. For example: Figure 3: Select client & server ports 5. Configure each client and server port that you select. After you select a port, a tab is displayed. Use the tab to set the IP version and subnet. IP version can be v4 (the default) or v6. Click +Add Subnet to create a subnet, enter the IP and netmask, gateway, and network as the static route. Enter the IP and netmask using the format " /16". For the gateway value, use the format " ". For the network value, use the format " /16". A port can have multiple subnets. FortiTester uses all IP addresses in the specified subnets to create connections and transfer data. Click (Remove link) to delete a subnet. Fortinet 7 FortiTester 2.1 Handbook

8 6. Enter a value for network MTU. MTU is Maximum Transmission Unit for a data packet. FortiTester does not send out data packets larger than this value. Most DUTs have a packet size limitation. The default is 1500, which is the recommended value. 7. Enter the value for bandwidth. You can either limit the bandwidth of TCP data to a specified value or select Max to transfer as much data as FortiTester can generate. The default is Max. 8. Note: In this version of FortiTester, you cannot change the default value. 9. Click Start to run the test. From the popup dialog, select or enter a time interval to report the test result, the default is 5 seconds. FortiTester saves the configuration of this test automatically so you can run it again later. You can also click Save to save this test without running it. Start a TCP connection test FortiTester can generate a specified volume of two-way TCP traffic flow via specified ports to test the performance of DUT TCP concurrent connections. To start a TCP connection test: 1. Log in and select the TcpConnection test type. The test setup page is displayed. 2. Click (edit button) to enter the case name. You can use this name to find the case in the history list that FortiTester creates. 3. Enter a value for the test duration. 4. Select client and server ports. After you select a port, a tab is displayed. Use the tab to specify the IP version and subnet. IP version can be v4 (the default) or v6. Click +Add Subnet to create a subnet, enter the IP and netmask, gateway, and network as the static route. Enter the IP and netmask using the format " /16". For the gateway value, use the format " ". For the network value, use the format " /16". Click (Remove link) to delete a subnet. 5. Enter a value for network MTU. The default is 1500, which is the recommended value. 6. Enter the number of connections. The default is 10000, which is the maximum value. 7. Click Start to start the test. From the popup dialog, select or enter a time interval to report the test result, the default interval is 5 seconds. FortiTester saves the configuration of this test automatically so you can run it again later. You can also click Save to save this test without running it. Fortinet 8 FortiTester 2.1 Handbook

9 Start a HTTP CPS test FortiTester can simulate multiple clients to generate HTTP traffic that tests the DUT performance for new connections per second (CPS). The traffic of every connection includes the TCP three-way handshake, HTTP request & response (complete HTTP transaction), and the TCP connection close (FIN, ACK, FIN, ACK). Each TCP packet has one HTTP GET request. The traffic is HTTP1.0 without HTTP persistent connections (HTTP keep-alive). To start a HTTP CPS test: 1. Log in and select the HttpCps test type. The test setup page is displayed. 2. Click (edit button) to enter the case name. You can use this name to find the case in the history list that FortiTester creates. 3. Enter a value for the test duration. The default is 10 minutes. The test stops automatically after the duration you specify. 4. Select client and server ports. 5. Configure the IP version and subnets for the selected ports. 6. Enter a value for network MTU. The default is 1500, which is the recommended value. 7. For concurrent client, enter the number of clients that FortiTester simulates for this case. The default is 8. The valid range is 8 to For get page, enter the name of the page that the simulated clients access on the server side. The default is index.html. Note: In this version of FortiTester, you cannot change the default value. 9. Click Start to run the test. From the popup dialog, select or enter a time interval to report the test result, the default interval is 5 seconds. FortiTester saves the configuration of this test automatically so you can run it again later. You can also click Save to save this test without running it. Start a HTTPS CPS test The HTTPS CPS test is the same as the HTTP CPS test except it uses HTTPS traffic. Start a HTTP RPS test FortiTester can simulate multiple clients to generate HTTP traffic that tests the DUT performance for requests per second (RPS). All requests include a TCP three-way handshake, one HTTP request and response, and a TCP connection close (FIN, ACK, FIN, ACK). There are 10 HTTP GET requests per TCP and 100 HTTP GET requests per TCP for Layer4/HTTPS testing. To start a HTTP RPS test: 1. Log in to the web UI and select the HttpRps test type. The test setup page is displayed. 2. Click (edit button) to enter the name of the case. You can use this name to find the case in the history list that FortiTester creates. 3. Enter a value for the test duration. The default is 10 minutes. The test stops automatically after the duration you specify. Fortinet 9 FortiTester 2.1 Handbook

10 4. Select client and server ports. 5. Configure the selected ports. After you select a port, a tab is displayed. Use the tab to specify the IP version and subnet. IP version can be v4 (the default) or v6. Click +Add Subnet to create a subnet, enter the Min and Max IP address and netmask, gateway, and network as the static route. The Min and Max IP address is the IP address range for the client side. For the netmask, enter a number between 1 and Enter a value for network MTU. The default is 1500, which is the recommended value. 7. For simulated user, enter the number of HTTP clients that FortiTester simulates. The default is 400. The valid range is 10 to For get page, enter the page the simulated clients access on the server side. The default is index.html. Note: In this version of FortiTester, you cannot change the default value. 9. Click Start run the test. From the popup dialog, select or enter a time interval to report the test result, the default interval is 5 seconds. FortiTester saves the test configuration automatically so you can run it again later. You can also click Save to save this test without running it. Start a HTTPS RPS test The HTTPS RPS test is the same as the HTTP RPS test except it uses HTTPS traffic. Start a CAPWAP throughput test By simulating multiple clients, FortiTester can generate CAPWAP traffic to test the CAPWAP throughput performance of a DUT. In the test, FortiTester will simulate multiple WiFi APs (also call WTP (Wireless Terminator Point) in RFC 5415) and multiple WiFi stations for every AP. The DUT should have AC (Access Controller) module to establish the connections with APs simulated by FortiTester. FortiTester will generate the CAPWAP traffic and transfer it between its test ports through the DUT. To start a CAPWAP throughput test: 1. Log in to the web UI and select the CAPWAP test type. The test setup page is displayed. 2. Click (edit button) to enter the name of the case. You can use this name to find the case in the history list that FortiTester creates. 3. Enter a value for the test duration. The default value is 10 minutes. The test stops automatically after the duration you specify. 4. Select traffic transfer ports. 5. Configure the selected ports. After you select a port, a tab is displayed. Use the tab to set the port IP/net mask and its connected DUT port IP. Note the IP addresses should be in the same network segment. Fortinet 10 FortiTester 2.1 Handbook

11 6. Enter a value for WTP pair count. The default is 4, which is the recommended value. The value 4 means FortiTester will simulate 8 WTP/APs. CAPWAP traffic will be transferred in every WTP pair via selected ports. 7. Enter the SSID and Password that AC published/configured. 8. Enter a value for PacketSize. The default is 512 byte. 9. Enter a value for PacketQuantity. FortiTester will send such number of packets in every interval. The default is Enter a value for XmitInterval. FortiTester will send packets at this interval. The default is 5 seconds. 11. Enter a value for StartInterval. FortiTester will launch up simulated WTP one by one with such an interval. Some DUT has low performance to establish connection to simulated WTP, it needs some time to connect all WTPs. The default is 5 seconds. 12. Click Start run the test. From the popup dialog, select or enter a time interval to report the test result, the default interval is 5 seconds. FortiTester saves the test configuration automatically so you can run it again later. You can also click Save to save this test without running it. Stop a running test There are two ways to stop a running test: In the test configuration, specify an automatic stop after a specified duration. Click the Stop button on the status page of a test that is in progress. Show test status The top banner displays the status of the current test case: running, stopped, or failed. Click (Running link) to view details. The following figure shows the TCP throughput test. Figure 4: Show test status A few seconds after you start a case, the page automatically changes to test status detail and displays the status. Fortinet 11 FortiTester 2.1 Handbook

12 View test results In the top banner, click (History link) to display a list of all the test cases on the left side of the page. These cases are all stopped (either normally or abnormally) and are ordered by test start time. Click a test case to view its result. The following figure shows the results for a TCP throughput test. Figure 5: Show test result Load an existing test case FortiTester automatically saves the test configuration as a case automatically after you click Start or Save. In the top banner, click (Cases) to view the list of saved cases on the left side of the page. Cases are categorized by the Test Type you selected. You can edit or make a copy of a case before you run it. Show system status The System page displays the system version and serial number of the appliance. Figure 6: System information Fortinet 12 FortiTester 2.1 Handbook

13 Shutting down & rebooting Always properly shut down the FortiTester appliance operating system before turning off the power switch or unplugging the appliance. The shut down process allows the operating system to finish writing buffered data, and to slow and park the hard disks. Do not unplug or switch off the FortiTester appliance before halting the operating system. Failure to shut down correctly could cause data loss and hardware problems. To power off the appliance via the web UI: 1. Go to the System page. 2. Click the Shutdown button. Note: Listen for the appliance to become quieter when it has stopped its hardware and operating system. The quietness indicates that it is ready for power to be disconnected. 3. Disconnect the power cable from the power supply. To power off the appliance via the CLI: 1. Connect to the CLI using a terminal emulator. 2. Enter the following command: execute shutdown Note: Listen for the appliance to become quieter when it has stopped its hardware and operating system. The quietness indicates that it is ready for power to be disconnected. 3. Disconnect the power cable from the power supply. To reboot, do one of the following: On the System page, click the Reboot button. Enter the execute reboot command via the CLI. Restore factory configuration To restore the appliance to its initial state, go to the System page and click Config reset. Warning: This operation clears all the data you entered/updated, and cannot be canceled, so use it carefully. Fortinet 13 FortiTester 2.1 Handbook

14 Using the command-line interface You can configure some FortiTester settings through a connection to the command line interface (CLI). The CLI requires a terminal server or emulator such as PuTTY or TeraTerm. To connect to the CLI via serial console: 1. Using the console cable, connect the appliance console port to your terminal server or computer. 2. On your computer or terminal server, start the terminal emulator. Use these settings: Baud rate: 9600 Data bits: 8 Parity: None Stop bits: 1 Flow control: None 3. Press Enter on your keyboard to connect to the CLI. Get help for using the CLI You can enter the help command or? to display CLI command and setting information. The following figure shows example CLI commands. The second part of the example is a sample generated using the network config command. help Help.? Help. get system status System status. show system interface How to configure interfaces. config system interface Configure interfaces. show system route Show default route. config system route Configure route. execute reboot Reboot FortiTester. execute shutdown Shut down FortiTester. execute date <yyyy-mm-dd> Set date. execute time <hh:mm:ss> Set time. exit Exit the CLI. network config usage: config system interface edit mgmt set ip next end Figure 7: CLI commands Fortinet 14 FortiTester 2.1 Handbook

15 Command descriptions The following table describes the CLI commands: Command help Description Shows help information.? Shows help information. get system status show system interface Shows system version, serial number, and time. Shows help information about how to configure interfaces. For example: config system interface edit port1 set ip next edit port2 set ip next end config system interface Configures interfaces. The help information shows how to configure them. show system route config system route execute shutdown execute reboot execute date execute time exit Show the gateway address for management port(s). For example: Default gateway: Configures the gateway address for management port(s). For example: config system route set gateway end Shuts down the FortiTester appliance. Reboots the FortiTester appliance. Set the system date. The date format is yyyy-mm-dd. Sets the system time. The time format is hh:mm:ss. Exits the current session. Fortinet 15 FortiTester 2.1 Handbook