The flow specification (Flowspec) feature allows you to filter and manage illegal traffic in BGP networks, therefore mitigating the effects of DoS and DDoS attacks. Flowspec classifies attack traffic and takes action on classified traffic, such as drop, redirect, or rate limit.

Flowspec device roles

The following Flowspec device roles are involved in a Flowspec network:

· Flowspec router—A BGP router in a BGP network, also called a Flowspec controller. A Flowspec router distributes Flowspec rules (match criteria and actions) to Flowspec edge routers through BGP updates.

· Flowspec edge router—A BGP router in a BGP network, also called a Flowspec client. A Flowspec edge router receives Flowspec rules from a Flowspec router and applies the match criteria and actions to its forwarding plane.

When configuring Flowspec, select one BGP router as the Flowspec router and all other BGP routers as Flowspec edge routers.

How Flowspec works

To support Flowspec, MP-BGP defines the Flowspec IPv4 address family and the Flowspec VPNv4 address family and introduces Flowspec Network Layer Reachability Information (NLRI), called Flowspec routes. Flowspec can distribute Flowspec rules (match criteria and actions) to the public network and VPN instances through the Flowspec IPv4 address family and the Flowspec VPNv4 address family.

As shown in Figure 1, the Flowspec router distributes Flowspec rules to Flowspec edge routers. After receiving Flowspec rules, a Flowspec edge router applies the criteria and actions to its forwarding plane. A Flowspec router can also distribute Flowspec rules to other ASs. This enables you to filter and control attack traffic on the device closest to the attack source.

Figure 1 How Flowspec works

‌

Protocols and standards

· RFC 5575, Dissemination of Flow Specification Rules

· RFC 7674, Clarification of the Flowspec Redirect Extended Community

Restrictions: Hardware compatibility with Flowspec

Hardware	Flowspec compatibility
MSR610	Yes
MSR810, MSR810-W, MSR810-W-DB, MSR810-LM, MSR810-W-LM, MSR810-10-PoE, MSR810-LM-HK, MSR810-W-LM-HK, MSR810-LM-CNDE-SJK, MSR810-CNDE-SJK, MSR810-EI, MSR810-LM-EA, MSR810-LM-EI	Yes
MSR810-LMS, MSR810-LUS	No
MSR810-SI, MSR810-LM-SI	No
MSR810-LMS-EA, MSR810-LME	No
MSR1004S-5G, MSR1004S-5G-CN	Yes
MSR1104S-W, MSR1104S-W-CAT6, MSR1104S-5G-CN, MSR1104S-W-5G-CN	Yes
MSR2600-6-X1, MSR2600-15-X1, MSR2600-15-X1-T	Yes
MSR2600-10-X1	No
MSR 2630	Yes
MSR3600-28, MSR3600-51	Yes
MSR3600-28-SI, MSR3600-51-SI	No
MSR3600-28-X1, MSR3600-28-X1-DP, MSR3600-51-X1, MSR3600-51-X1-DP	Yes
MSR3600-28-G-DP, MSR3600-51-G-DP	Yes
MSR3610-I-DP, MSR3610-IE-DP, MSR3610-IE-ES, MSR3610-IE-EAD, MSR-EAD-AK770, MSR3610-I-IG, MSR3610-IE-IG	Yes
MSR3610-X1, MSR3610-X1-DP, MSR3610-X1-DC, MSR3610-X1-DP-DC, MSR3620-X1, MSR3640-X1	Yes
MSR3610, MSR3620, MSR3620-DP, MSR3640, MSR3660	Yes
MSR3610-G, MSR3620-G	Yes
MSR3640-G	Yes
MSR3640-X1-HI	Yes

Hardware	Flowspec compatibility
MSR810-W-WiNet, MSR810-LM-WiNet	Yes
MSR830-4LM-WiNet	Yes
MSR830-5BEI-WiNet, MSR830-6EI-WiNet, MSR830-10BEI-WiNet	Yes
MSR830-6BHI-WiNet, MSR830-10BHI-WiNet	Yes
MSR2600-6-WiNet	Yes
MSR2600-10-X1-WiNet	No
MSR2630-WiNet	Yes
MSR3600-28-WiNet	Yes
MSR3610-X1-WiNet	Yes
MSR3610-WiNet, MSR3620-10-WiNet, MSR3620-DP-WiNet, MSR3620-WiNet, MSR3660-WiNet	Yes

Hardware	Flowspec compatibility
MSR860-6EI-XS	Yes
MSR860-6HI-XS	Yes
MSR2630-XS	Yes
MSR3600-28-XS	Yes
MSR3610-XS	Yes
MSR3620-XS	Yes
MSR3610-I-XS	Yes
MSR3610-IE-XS	Yes
MSR3620-X1-XS	Yes
MSR3640-XS	Yes
MSR3660-XS	Yes

Hardware	Flowspec compatibility
MSR810-LM-GL	Yes
MSR810-W-LM-GL	Yes
MSR830-6EI-GL	Yes
MSR830-10EI-GL	Yes
MSR830-6HI-GL	Yes
MSR830-10HI-GL	Yes
MSR1004S-5G-GL	Yes
MSR2600-6-X1-GL	Yes
MSR3600-28-SI-GL	No

Prerequisites for Flowspec configuration

Before you configure Flowspec, you must configure basic BGP functions on the Flowspec router and Flowspec edge routers. For information about configuring basic BGP functions, see Layer 3—IP Routing Configuration Guide.

Configure IPv4 Flowspec

IPv4 Flowspec tasks at a glance

To configure IPv4 Flowspec, perform the following tasks:

1. Creating and activating an IPv4 Flowspec rule

Perform this task only on the Flowspec router.

2. Applying an IPv4 Flowspec rule

¡ Applying an IPv4 Flowspec rule to the public network

¡ Applying an IPv4 Flowspec rule to a VPN instance

Perform this task only on the Flowspec router.

3. Enabling BGP to distribute IPv4 Flowspec rules

¡ Enabling BGP to distribute public network IPv4 Flowspec rules

¡ Enabling BGP to distribute private network IPv4 Flowspec rules

¡ Enabling BGP to distribute VPNv4 Flowspec rules

Perform this task on both the Flowspec router and Flowspec edge routers.

4. (Optional.) Configuring BGP Flowspec route reflection

Perform this task only on the Flowspec router.

5. (Optional.) Disabling the actions in IPv4 Flowspec rules

Perform this task on Flowspec edge routers.

Creating and activating an IPv4 Flowspec rule

1. Enter system view.

system-view

2. Create an IPv4 Flowspec rule and enter Flowspec rule view.

flow-route flowroute-name

3. Configure a match criterion.

if-match match-criteria

By default, no match criterion is configured.

4. Configure an action. Choose one option as needed:

¡ Drop packets.

apply action

¡ Redirect packets to a next hop.

apply redirect next-hop { ipv4-address [ copy-mode ] | ipv6-address }

¡ Redirect packets to an SRv6 TE policy.

apply redirect next-hop ipv6-address color color [ sid sid-value ]

¡ Redirect packets to a route target.

apply redirect vpn-target import-vpn-target

¡ Mark packets with a DSCP value.

apply remark-dscp dscp-value

¡ Rate limit packets.

apply traffic-rate rate

By default, no action is configured.

5. (Optional.) Display the match criteria and actions that are not committed.

check flow-route-configuration

6. Commit match criteria and actions.

commit

By default, match criteria and actions are not committed.

Applying an IPv4 Flowspec rule

Applying an IPv4 Flowspec rule to the public network

1. Enter system view.

system-view

2. Enter Flowspec view.

flowspec

3. Create a Flowspec IPv4 address family for the public network and enter its view.

address-family ipv4

4. Apply an IPv4 Flowspec rule to the public network.

flow-route flowroute-name

By default, no Flowspec rule is applied to the public network.

Applying an IPv4 Flowspec rule to a VPN instance

1. Enter system view.

system-view

2. Configure a VPN instance.

a. Create a VPN instance and enter VPN instance view.

ip vpn-instance vpn-instance-name

b. Configure an RD for the VPN instance.

route-distinguisher route-distinguisher

By default, no RD is configured for a VPN instance.

c. Configure route targets for the VPN instance.

vpn-target vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ]

By default, no route targets are configured.

For more information about the ip vpn-instance, route-distinguisher, and vpn-target commands, see MPLS L3VPN commands in MPLS Command Reference.

3. Enter the IPv4 Flowspec address family view of the VPN instance.

address-family ipv4 flowspec

4. Configure route targets for the IPv4 Flowspec address family.

vpn-target vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ]

By default, no route targets are configured for the IPv4 Flowspec address family.

The route targets configured must be the same as the route targets configured previously for the VPN instance.

5. Execute the quit command twice to return to system view.

6. Enter Flowspec view.

flowspec

7. Create a Flowspec IPv4 address family and associate the address family with the VPN instance.

address-family ipv4 vpn-instance vpn-instance-name

8. Apply an IPv4 Flowspec rule to the Flowspec IPv4 VPN instance address family.

flow-route flowroute-name

By default, no IPv4 Flowspec rule is applied to a Flowspec IPv4 VPN instance address family.

Enabling BGP to distribute IPv4 Flowspec rules

About BGP IPv4 Flowspec rule distribution

By default, the device validates received IPv4 Flowspec rules and their redirection next hops (if present).

An IPv4 Flowspec rule is valid if the following conditions exist:

· The Flowspec rule contains a destination address match criterion.

· The device that receives the rule has routes with the destination address for matching as their destination address.

For the device to take the action on matching traffic without validation, disable validation of IPv4 Flowspec rules.

A redirection next hop is valid if the following conditions exist:

· A route exists on the device with the redirection next hop as the route's next hop.

· The next hop IP address and the device are in the same AS.

For the device to take the action of redirecting traffic to a next hop without validation, disable validation of the redirection next hops.

The BGP Flowspec rule distribution feature not only distributes IPv4 Flowspec rules in BGP routes to Flowspec edge routers but also makes those IPv4 Flowspec rules take effect on the Flowspec router itself.

Restrictions and guidelines

For more information about the bgp and peer enable commands, see Layer 3—IP Routing Command Reference.

Enabling BGP to distribute public network IPv4 Flowspec rules

1. Enter system view.

system-view

2. Execute the following commands in sequence to enter BGP IPv4 Flowspec address family view:

bgp as-number [ instance instance-name ]

address-family ipv4 flowspec

3. Enable BGP Flowspec peers to exchange routing information.

peer { group-name | ipv4-address [ mask-length ] | ipv6-address [ prefix-length ] } enable

By default, BGP Flowspec peers cannot exchange routing information.

4. (Optional.) Disable validation of IPv4 Flowspec rules from BGP Flowspec peers.

peer { group-name | ip-address [ mask-length ] | ipv6-address [ prefix-length ] } validation-disable

By default, IPv4 Flowspec rules from BGP Flowspec peers are validated.

5. (Optional.) Disable validation of the redirection next hops in IPv4 Flowspec rules from BGP Flowspec peers.

peer { group-name | ip-address [ mask-length ] | ipv6-address [ prefix-length ] } validation-redirect-disable

By default, the redirection next hops in IPv4 Flowspec rules from BGP Flowspec peers are validated.

6. (Optional.) Configure the device to not change the next hop of IPv4 routes advertised to EBGP peers.

peer { group-name | ipv4-address [ mask-length ] | ipv6-address [ prefix-length ] } next-hop-invariable

By default, the device uses its own IP address as the next hop of IPv4 routes advertised to EBGP peers.

7. (Optional.) Enable recursion to tunnels for IPv4 Flowspec rules with an action of redirecting to a next hop.

redirect ip recursive-lookup tunnel [ tunnel-selector tunnel-selector-name ]

By default, recursion to tunnels is disabled for IPv4 Flowspec rules with an action of redirecting to a next hop.

8. (Optional.) Configure the attribute ID for the redirection next hop in IPv4 Flowspec rules as the RFC-specified 0x010C.

peer { group-name | ipv4-address [ mask-length ] | ipv6-address [ prefix-length ] } redirect ip rfc-compatible

By default, the attribute ID for the redirection next hop in static IPv4 Flowspec rules is 0x0800, and the attribute ID for the redirection next hop in dynamic IPv4 Flowspec rules is received from the peer.

Enabling BGP to distribute private network IPv4 Flowspec rules

1. Enter system view.

system-view

2. Execute the following commands in sequence to enter BGP-VPN IPv4 Flowspec address family view: