Contents

Configuring guard routes· 1

About guard routes· 1

Guard route characteristics· 1

Guard route mechanism·· 1

Restrictions and guidelines: guard route configuration· 2

Configuring a guard route· 2

Display and maintenance commands for guard routes· 2

Configuring guard routes

About guard routes

A guard route directs traffic to the guard device for filtering and cleaning. You can manually configure a guard route on the guard device, or use a script to automatically configure a guard route upon receipt of a notification.

Guard route characteristics

Guard routes use Null 0 as the outgoing interface.

Guard routes are inactive routes and will not be installed into the FIB.

You must configure a routing protocol, such as BGP, OSPF, or OSPFv3, to redistribute and advertise guard routes for directing traffic to the guard device.

Guard route mechanism

Figure 1 Guard route network diagram

‌

As shown in Figure 1, Device B uses port mirroring to mirror traffic destined for the application servers to the detector for monitoring. It uses a routing protocol to redistribute guard routes from the guard device.

When no abnormal traffic is detected, Device B forwards traffic without the participation of the guard device.

When abnormal traffic is detected, the detector performs one of the following tasks:

·     Sends a notification to the guard device. The guard device then automatically generates a guard route.

·     Generates an alarm to notify the network administrator. The administrator then manually configures a guard route on the guard device.

The destination address of the guard route is the address to which the abnormal traffic is destined.

After the guard route is configured, the guard device advertises the route to Device B. Device B directs all traffic destined to the destination address of the guard route to the guard device. The guard device filters and cleans the traffic and then sends the normal traffic back to Device B.

Restrictions and guidelines: guard route configuration

A guard device is typically used for traffic filtering and cleaning. To avoid system consumption, configure a routing policy on the guard device or its connected device to disable receiving and advertising non-guard routes. For more information about routing policies, see "Configuring routing policies."

Configuring a guard route

1.     Enter system view.

system-view

2.     Configure a guard route.

IPv4:

ip route-guard ip-address { mask-length | mask }

By default, no IPv4 guard routes exist.

IPv6:

ipv6 route-guard ipv6-address prefix-length

By default, no IPv6 guard routes exist.

Display and maintenance commands for guard routes

Execute display commands in any view.

‌