The flow specification (Flowspec) feature allows you to filter and manage illegal traffic in BGP networks, therefore mitigating the effects of DoS and DDoS attacks. Flowspec classifies attack traffic and takes action on classified traffic, such as drop, redirect, or rate limit.

Flowspec device roles

The following Flowspec device roles are involved in a Flowspec network:

· Flowspec router—A BGP router in a BGP network, also called a Flowspec controller. A Flowspec router distributes Flowspec rules (match criteria and actions) to Flowspec edge routers through BGP updates.

· Flowspec edge router—A BGP router in a BGP network, also called a Flowspec client. A Flowspec edge router receives Flowspec rules from a Flowspec router and applies the match criteria and actions to its forwarding plane.

When configuring Flowspec, select one BGP router as the Flowspec router and all other BGP routers as Flowspec edge routers.

Protocols and standards

RFC 5575: Dissemination of Flow Specification Rules

RFC 7674: Clarification of the Flowspec Redirect Extended Community

How Flowspec works

To support Flowspec, MP-BGP defines the Flowspec IPv4 address family and the Flowspec VPNv4 address family and introduces Flowspec Network Layer Reachability Information (NLRI), called Flowspec routes. Flowspec can distribute Flowspec rules (match criteria and actions) to the public network and VPN instances through the Flowspec IPv4 address family and the Flowspec VPNv4 address family.

As shown in Figure 1, the Flowspec router distributes Flowspec rules to Flowspec edge routers. After receiving Flowspec rules, a Flowspec edge router applies the criteria and actions to its forwarding plane. A Flowspec router can also distribute Flowspec rules to other ASs. This enables you to filter and control attack traffic on the device closest to the attack source.

Figure 1 How Flowspec works

Flowspec tasks at a glance

To configure Flowspec, perform the following tasks:

1. Creating and activating a Flowspec rule

Perform this task only on the Flowspec router.

2. Applying a Flowspec rule

¡ Applying a Flowspec rule to the public network

¡ Applying a Flowspec rule to a VPN instance

Perform this task only on the Flowspec router.

3. Enabling BGP to distribute Flowspec rules

¡ Enabling BGP to distribute public network IPv4 Flowspec rules

¡ Enabling BGP to distribute private network Flowspec rules

¡ Enabling BGP to distribute VPNv4 Flowspec rules

Perform this task on both the Flowspec router and Flowspec edge routers.

4. (Optional.) Configuring BGP Flowspec route reflection

Perform this task only on the Flowspec router.

Prerequisites for Flowspec configuration

Before you configure Flowspec, you must configure basic BGP functions on the Flowspec router and Flowspec edge routers. For information about configuring basic BGP functions, see Layer 3—IP Routing Configuration Guide.

Creating and activating a Flowspec rule

1. Enter system view.

system-view

2. Create a Flowspec rule and enter Flowspec rule view.

flow-route flowroute-name

3. Configure a match criterion.

if-match match-criteria

By default, no match criterion is configured.

4. Apply an action.

apply action

5. (Optional.) Display the match criteria and actions that are not committed.

check flow-route-configuration

6. Commit match criteria and actions.

commit

By default, match criteria and actions are not committed.

Applying a Flowspec rule

Applying a Flowspec rule to the public network

1. Enter system view.

system-view

2. Enter Flowspec view.

flowspec

3. Create a Flowspec IPv4 address family for the public network and enter its view.

address-family ipv4

4. Apply a Flowspec rule to the public network.

flow-route flowroute-name

By default, no Flowspec rule is applied to the public network.

Applying a Flowspec rule to a VPN instance

1. Enter system view.

system-view

2. Configure a VPN instance.

a. Create a VPN instance and enter VPN instance view.

ip vpn-instance vpn-instance-name

b. Configure an RD for the VPN instance.

route-distinguisher route-distinguisher

By default, no RD is configured for a VPN instance.

c. Configure route targets for the VPN instance.

vpn-target { vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ] }

By default, no route targets are configured.

For more information about the ip vpn-instance, route-distinguisher, and vpn-target commands, see MPLS L3VPN commands in MPLS Command Reference.

3. Enter the IPv4 Flowspec address family view of the VPN instance.

address-family ipv4 flowspec

4. Configure route targets for the IPv4 Flowspec address family.

vpn-target vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ]

By default, no route targets are configured for the IPv4 Flowspec address family.

The route targets configured must be the same as the route targets configured previously for the VPN instance.

5. Execute the quit command twice to return to system view.

6. Enter Flowspec view.

flowspec

7. Create a Flowspec IPv4 address family and associate the address family with the VPN instance.

address-family ipv4 vpn-instance vpn-instance-name

8. Apply a Flowspec rule to the Flowspec IPv4 VPN instance address family.

flow-route flowroute-name

By default, no Flowspec rule is applied to a Flowspec IPv4 VPN instance address family.

Enabling BGP to distribute Flowspec rules

About BGP Flowspec rule distribution

By default, the device validates received Flowspec rules and their redirection next hops (if present).

A Flowspec rule is valid if the following conditions exist:

· The Flowspec rule contains a destination address match criterion.

· The device that receives the rule has routes with the destination address for matching as their destination address.

For the device to take the action on matching traffic without validation, disable validation of Flowspec rules.

A redirection next hop is valid if the following conditions exist:

· A route exists on the device with the redirection next hop as the route's next hop.

· The next hop IP address and the device are in the same AS.

For the device to take the action of redirecting traffic to a next hop without validation, disable validation of the redirection next hops.

The BGP Flowspec rule distribution feature not only distributes Flowspec rules in BGP routes to Flowspec edge routers but also makes those Flowspec rules take effect on the Flowspec router itself.

Restrictions and guidelines for enabling BGP to distribute Flowspec rules

For more information about the bgp and peer enable commands, see Layer 3—IP Routing Command Reference.

Enabling BGP to distribute public network IPv4 Flowspec rules

1. Enter system view.

system-view

2. Execute the following commands in sequence to enter BGP IPv4 Flowspec address family view:

bgp as-number [ instance instance-name ]

address-family ipv4 flowspec

3. Enable BGP Flowspec peers to exchange routing information.

peer { group-name | ipv4-address [ mask-length ] } enable

By default, BGP Flowspec peers cannot exchange routing information.

4. (Optional.) Disable validation of Flowspec rules from BGP Flowspec peers.

peer { group-name | ip-address [ mask-length ] } validation-disable

By default, Flowspec rules from BGP Flowspec peers are validated.

5. (Optional.) Disable validation of the redirection next hops in Flowspec rules from BGP Flowspec peers.

peer { group-name | ip-address [ mask-length ] } validation-redirect-disable

By default, the redirection next hops in Flowspec rules from BGP Flowspec peers are validated.

6. (Optional.) Configure the device to not change the next hop of routes advertised to EBGP peers.

peer { group-name | ip-address [ mask-length ] } next-hop-invariable

By default, the device uses its own IP address as the next hop of routes advertised to EBGP peers.

Enabling BGP to distribute private network Flowspec rules

1. Enter system view.

system-view

2. Execute the following commands in sequence to enter BGP-VPN IPv4 Flowspec address family view: