Hawkeye Scenarios for Endpoints

When a firewall is involved in a test, the following possible testing scenarios appear, with respect to the Hawkeye server, source and destination endpoint localization in private/enterprise networks or public networks/Cloud. Each of these scenarios is detailed in a separate topic below.

For these scenarios, the source and destination endpoints are determined by the direction of the traffic. When using a reversed traffic direction, the source and destination endpoints for the scenarios are in reversed order as compared to how they appear in the user interface.

While adding the source (from) and destination (to) endpoints to the test in the test execution configuration, check that they are in the relevant network for the use case being tested. If it is not located in the correct network for that particular use case, you can change that in the endpoint management dialog:

  1. Select probe management (endpoint management).
  2. Select the relevant automatic endpoint.
  3. Edit and change the public/private to ensure it is correctly configured.
Assumptions

Unless otherwise specified, the following assumptions are made for firewall testing:

  • The Hawkeye server (Hawkeye server and the registration server) are accessible to all endpoints in a test.
  • The virtual image that hosts the Hawkeye server comes with a pre-installed Registration Server. Although virtually any endpoint can act as Registration Server, we recommend to use the pre-installed one. The Hawkeye server and Hawkeye registration server may have different IP addresses.
  • When multiple system components are located in a private/enterprise network, we assume that they are in the same network, with full network connectivity between them.
  • When exiting the enterprise network, a device may be encountered, acting as a firewall, performing address translation and, for the most part of the testing scenarios, port translation.
  • When entering the cloud, a device may be encountered, performing only 1:1 Network Address Translation (NAT), without any port translation. If a firewall is also present, the ports specified in each of the test scenarios are opened.
  • The Registration Server is usually able to detect if an endpoint is located behind a firewall in an enterprise or in the public space/cloud.
Operational Concepts

For the purpose of running tests involving firewall, we consider the following working concepts:

  • Hawkeye server: is the main server for Hawkeye, that includes Hawkeye test engine server and Registration server.
  • Hawkeye Server (C): Central point of test execution. It is delivered as a virtual image.
  • Registration Server (RS): A service that handles endpoints management and acts as a mediator between the Hawkeye Server and endpoints at runtime.
  • (Source and Destination) Endpoints: Performance Endpoints that are installed and run on the clients' device(s).
  • Private/Enterprise: A private, usually enterprise network, located behind a firewall, whose address is not Internet-routable and thus, needs Network Address Translation (NAT).
  • Public: A public (and fully routable IP address) network.
  • Cloud: A network with a private/non-routable address, yet exposed as a public IP by way of a 1:1 TCP/UDP IP-mapping (NAT) rule.
Hawkeye Server, Source and Destination Endpoints in Private/Enterprise

In this case, all types of traffic are supported.

Given that all Hawkeye components are located in the same private/enterprise network (and, as such, there is no firewall or NATing between them), no special settings must be configured. The endpoint should appear as public and/or be configured as such.

The following image illustrates the use case referencing the underlying components from Hawkeye control engine that are involved and which ports are used.

For Hawkeye, both Hawkeye Srv and Registration server are located on Hawkeye server.

Source and Destination Endpoints in Private/Enterprise and Hawkeye Server in Public

In this case, all types of traffic are supported.

We assume that both endpoints are in the same private network and that no device is present that can alter the traffic or IPs.

Make sure that the private/enterprise firewall allows for outbound connections to the public ports shown in the figure below.

The endpoints need to be set to private mode for this use case.

The following image illustrates the use case referencing the underlying components from Hawkeye control engine that are involved and which ports are used.

For Hawkeye, both Hawkeye Srv and Registration server are located on Hawkeye server.

Source Endpoint in Private/Enterprise and Destination Endpoint, Hawkeye Server in Public

In this case, all types of traffic are supported.

Make sure that the private/enterprise firewall allows for outbound connections to the public ports shown in the figure below

The endpoint in private (enterprise) must be configured as private, the endpoint in public must be configured as public.

Destination Endpoint in Private/Enterprise and Source Endpoint, Hawkeye Server in Public

Make sure that the private/enterprise firewall allows for outbound connections to the public ports shown in the figure below.

Hawkeye Server, Source and Destination Endpoints in Public

No special requirements in this case.

Source and Destination Endpoints in Private and Hawkeye Server in Cloud

In this case, all types of traffic are supported.

For the firewall at the entry point into the cloud, make sure to open the following ports:

  • TCP management ports (for the Registration Server): 10117
  • TCP reporting ports (for the Hawkeye Server): 25025-25050
  • TCP licensing ports (for the Hawkeye Server, only if an external license server is used): 27000-27009

Make sure that the private/enterprise firewall allows for outbound connections to the Cloud ports shown in the figure below.

Source Endpoint in Private/Enterprise and Destination Endpoint, HawkeyeServer in Cloud

In this case, all types of traffic are supported, except for non-streaming flows over UDP.

For the firewall at the entry point into the cloud, make sure to open the following ports:

  • TCP management ports:
    • 10115 (for the destination endpoint)
    • 10116 (for the destination endpoint)
    • 10117 (for the Hawkeye Server)
  • TCP reporting ports (for the Hawkeye Server): 25025-25050
  • TCP licensing ports (for the Hawkeye Server, only if an external license server is used): 27000-27009
  • UDP port: 10115
  • Open into the Cloud firewall the TCP/UDP ports that you plan to use for test traffic, then go to User Preferences and configure the same range there in the port management in preferences section.

Make sure that the private/enterprise firewall allows for outbound connections to the Cloud ports shown in the figure below.

Destination Endpoint in Private/Enterprise and Source Endpoint, Hawkeye Server in Cloud

In this case, non-streaming flows over UDP and AppMix traffic are supported only if the actions mentioned in the Limitations section are performed.

For the firewall at the entry point into the cloud, make sure to open the following ports:

  • TCP management ports:
    • 10115 (for the source endpoint)
    • 10116 (for the source endpoint)
    • 10117 (for the Registration Server)
  • TCP reporting ports (for the Hawkeye Server): 25025-25050
  • TCP licensing ports (for the Hawkeye Server, only if an external license server is used): 27000-27009
  • UDP port: 10115
  • Open into the Cloud firewall the TCP/UDP ports that you plan to use for test traffic, then go to User Preferences and configure the same range there in the Ports opened for the test traffic into the public / cloud firewall section.

Make sure that the private/enterprise firewall allows for outbound connections to the Cloud ports shown in the figure below.

Limitations

By default, when the destination endpoint is behind a firewall (enterprise or Cloud), application mixes traffic fails at test run unless the following actions are performed:

  • In the firewall, make sure to open the ports corresponding to the applications that you want to emulate. The table below lists the corresponding TCP ports set by default for the test traffic as defined in the port management preferences.
  • If the NAT is activated, an entry must be added in the NAT table to make sure that the traffic is routed to the private IP of the destination endpoint(s). This is for test traffic only.