FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
martinsd
Staff
Staff
Article Id 263694
Description This article describes how to emulate a WAN link with a Linux machine.
Scope

Everyone that wants to simulate a WAN link in the lab to test their network resiliency.

Solution

Lab Setup:

 
 

WAN_Emulator.png

 

IPv4 WAN Emulator:

Ubuntu 20.04 distro was chosen to create the emulator, but a different Linux distro can be selected too.

 

  1. Enable IP forwarding: 
sudo sysctl -w net.ipv4.ip_forward=1

 

     2. Install iproute2. The iproute2 suite is a collection of utilities for networking and traffic control:

 

sudo apt install iproute2

 

     3. List NICs:

 

ip address

 

     4. Bridge NICs:

 

sudo ip link add name br0 type bridge 
sudo ip link set dev br0 up
sudo ip link set dev ens9 master br0
sudo ip link set dev ens10 master br0

 

     5. Traffic identification:

 

sudo tc qdisc del dev ens9 root
sudo tc qdisc add dev ens9 root handle 1: htb
sudo tc filter add dev ens9 protocol ip parent 1:0 prio 1 u32 match ip dst 0.0.0.0/0 match ip src 0.0.0.0/0 flowid 1:1

sudo tc qdisc del dev ens10 root
sudo tc qdisc add dev ens10 root handle 1: htb
sudo tc filter add dev ens10 protocol ip parent 1:0 prio 1 u32 match ip dst 0.0.0.0/0 match ip src 0.0.0.0/0 flowid 1:1

 

     6. Apply traffic shaping:

 

sudo tc class add dev ens9 parent 1: classid 1:1 htb rate 100mbit
sudo tc class add dev ens10 parent 1: classid 1:1 htb rate 100mbit

 

Note:

Netem adds delay to egress packets only. For bidirectionality, apply netem to the other end interface.

 

     7. Adding 250ms of delay:

 

sudo tc qdisc add dev ens9 root netem delay 250ms
sudo tc qdisc add dev ens10 root netem delay 250ms

 

     8. Adding 100ms of delay and 10ms of Volatility (result in any value between 90 and 110 ms):

 

sudo tc qdisc add dev ens9 root netem delay 100ms 10ms
sudo tc qdisc add dev ens10 root netem delay 100ms 10ms

 

     8. Adding 1% of Packet Loss:

 

sudo tc qdisc add dev ens9 root netem loss 1%
sudo tc qdisc add dev ens10 root netem loss 1%

 

     10. Adding 1% of Duplicated Packets:

 

sudo tc qdisc add dev ens9 root netem duplicate 1%
sudo tc qdisc add dev ens10 root netem duplicate 1%

 

     11. Adding 0.2% of Corrupted Packets:

 

sudo tc qdisc add dev ens9 root netem corrupt 0.2%
sudo tc qdisc add dev ens10 root netem corrupt 0.2%

 

     12. Adding Packet Reordering:

Both interfaces will send 25% of data packets (with 50% relevance) and add 10ms of delay to other packets:

 

sudo tc qdisc add dev ens9 root netem delay 10ms reorder 25% 50%
sudo tc qdisc add dev ens10 root netem delay 10ms reorder 25% 50%

 

     13. View the tc configuration:

 

sudo tc qdisc show dev ens9
sudo tc qdisc show dev ens10
Contributors