How to configure FlowSpec on Juniper Routers

Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4/IPv6 and prefix information, BGP FlowSpec allows network administrators to specify more granular criteria for packet forwarding, including Layer 4 information (TCP/UDP ports) and even packet patterns. To learn more about BGP Flowspec, check out our article explaining what BGP Flowspec is by clicking this link. Operation: BGP FlowSpec works by adding new types of attributes to BGP, allowing network administrators to specify detailed filtering rules. These rules can include criteria such as: The following actions can be taken with BGP FlowSpec: When these rules are propagated through the BGP network, routers can use this information to filter or manipulate traffic according to the defined policies. Operation – More Details: In the context of BGP FlowSpec, the actions are specified as part of the filter rules. Each filter rule contains three main parts: Actions in BGP FlowSpec are coded using BGP communities. Each action is mapped to a specific BGP community: When you create a BGP FlowSpec rule, you specify the matching fields, the desired action and, optionally, protocol fields. This rule is then encoded as a BGP community and included in a BGP update message that is sent to neighboring routers. The routers that receive this rule apply the specified actions to the packets that match the matching criteria. Please note that the specific BGP communities for each action may vary depending on the BGP FlowSpec implementation on your network equipment. I recommend consulting your equipment’s documentation for detailed information on the BGP communities associated with each action in BGP FlowSpec. Use Cases: 1. **DDoS attack mitigation: BGP FlowSpec can be used to block or redirect malicious traffic during distributed denial of service (DDoS) attacks. Precise rules can be applied to filter out unwanted traffic and keep services online. 2. **QoS (Quality of Service) policies: Network administrators can use BGP FlowSpec to guarantee quality of service by prioritizing certain types of traffic based on specific ports or protocols. 3. **Implementing Security Policies**: BGP FlowSpec can be used to implement granular security policies, blocking traffic associated with malware or suspicious activity. Configuration examples: The BGP FlowSpec configuration may vary depending on the network equipment used. This example explores how to design a DDoS mitigation solution in which a service provider allows its customers to advertise BGP FlowSpec routes to it. It also discusses some of the best practices that should be considered before implementing this type of solution and, finally, some of the Junos commands available to help you check that your Flow-spec solution is working correctly. Topology scenario for the example: Let’s start by taking a look at how our solution will be configured: As we can see in the topology above, there is “BORDA,” a Juniper device that serves as the network’s BGP router, and “Made4Flow,” the software that will analyze the flows, dynamically generate BGP FlowSpec rules, and advertise them via BGP to the BGP router called “BORDA.” In this scenario, the example attack is a DNS amplification attack. This means that the network is receiving a large volume of UDP port 53 packets that it doesn’t actually need for the ISP to function normally. The attack fills the circuit between the ISP and the operators and effectively renders the network inoperable. When the attacker decides to launch the attack, the ISP can use Made4Flow to generate a BGP FlowSpec route specifically for UDP port 53 packets and announce it to the BGP EDGE router, which can then convert that route into a firewall filter on its interfaces that communicate with the carriers. And then this blocks the DNS amplification packets at the edge of the ISP’s network and also at the carrier (if the carrier supports FlowSpec sessions), but allows legitimate traffic to continue arriving. First, let’s look at the BGP FlowSpec session settings on the BORDA BGP router with Made4Flow, assuming that the router is already configured for normal BGP unicast routing (Normal BGP session for announcing Blackhole or Mitigation/Scrubbing Center routes). To configure a BGP FlowSpec session on Juniper devices, we use the following commands: Good practices: There are best practices for protecting this solution. Both the BGP FlowSpec routes and the resulting firewall filters they create are finite resources in the router. Therefore, the BGP EDGE router can filter incoming routes to ensure that it does not receive more routes than expected or incorrect routes. Prefix Limit: So the first thing to do is to set a prefix limit for BGP FlowSpec routes. You could simply set a single prefix limit for the inet unicast and inet flowroutes; however, this example will set a separate limit for the inet flowroutes. To ensure that Made4Flow can send only ten BGP Flowspec routes at a time, let’s set the prefix limit to 10 (this configuration should be adjusted according to each scenario): Route Policy : The next thing to do is to apply an inbound route policy. This policy will limit the router to receiving prefixes that are from the ISP itself with prefixes /24 to /32, which are those announced by Made4Flow. Let’s also add a Community 64496:86 so that it can identify the routes as BGP FlowSpec routes. For all other routes, you can simply filter them based on the client’s route assignment: 1. Create the policy definition: 2. Apply the policy as an import policy in the BGP session with Made4Flow: Maximum prefixes: The last thing to do is to set a maximum number of BGP FlowSpec prefixes that can be installed in the routing table. This example sets a maximum of 10,000 routes, but let’s also configure the router to notify the administrator via a syslog message when a 90% threshold is reached. This configuration must be applied to all routers in the ISP’s network

How to configure FlowSpec on Huawei Routers

Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers. Unlike conventional BGP, which routes based on IPv4/IPv6 and prefix information, BGP FlowSpec allows network administrators to specify more granular criteria for packet forwarding, including layer 4 information (TCP/UDP ports) and even packet patterns. Simply put, Flowspec allows network administrators to dynamically create firewall rules through BGP announcements, using Layer 4 criteria such as protocol and application ports, and to apply actions that may include dropping traffic or simply applying bandwidth control. If you want to know more about how FlowSpec works, check out this article explaining whatFlowspec is . Operation: BGP FlowSpec works by adding new types of attributes to BGP, allowing network administrators to specify detailed filtering (or dynamic firewall) rules. These rules can include criteria such as: The following actions can be taken with BGP FlowSpec: When these rules are propagated through the BGP network, routers can use this information to filter or manipulate traffic in accordance with the defined policies. Operation – More Details: In the context of BGP FlowSpec, the actions are specified as part of the filter rules. Each filter rule contains three main parts: Actions in BGP FlowSpec are coded using BGP communities. Each action is mapped to a specific BGP community: When you create a BGP FlowSpec rule, you specify the matching fields, the desired action and, optionally, protocol fields. This rule is then encoded as a BGP community and included in a BGP update message that is sent to neighboring routers. The routers that receive this rule apply the specified actions to the packets that match the matching criteria. Please note that the specific BGP communities for each action may vary depending on the BGP FlowSpec implementation on your router. I recommend consulting your equipment’s documentation for detailed information on the BGP communities associated with each action in BGP FlowSpec. Use Cases: BGP FlowSpec can be used to block or redirect malicious traffic during distributed denial of service (DDoS) attacks. Precise rules can be applied to filter out unwanted traffic and keep services online. Network administrators can use BGP FlowSpec to guarantee quality of service by prioritizing certain types of traffic based on specific ports or protocols. BGP FlowSpec can be used to implement granular security policies, blocking traffic associated with malware or suspicious activity. Configuration examples: Now that you know what FlowSpec is and what it can do, we’re going to show you how to configure FlowSpec on Huawei routers. This configuration applies to Huawei NE20, Huawei NE40, Huawei NE8000-M4, Huawei NE8000-M8, Huawei NE8000-M12, Huawei NE8000-F1A or any Huawei that uses Huawei’s VRP operating system. Example configuration of the dynamic BGP flow specification: If the characteristics of DoS or DDoS attack traffic are unknown, a traffic analysis server, such as Made4Flow with Anti-DDoS, can help implement the BGP flow specification to ensure network security. #Network requirements: As shown in the Topology below, Device A belongs to AS 100, while Device B, Device C and the Server belong to AS 200. Device B is an input of the AS 200. AS 200 communicates with AS 100 via Device B. The source of the attack in AS 100 can flow to AS 200 via Device B, posing a threat to AS 200. In this situation, configure dynamic BGP flow specification to ensure network security. The operating process is as follows: Note: Interfaces 1 to 3 in this example represent GE 1/0/0, GE 2/0/0 and GE 3/0/0 respectively. The configuration script goes as follows: Data preparation: To complete the configuration, you need the following data: Procedure: Let’s go over the commands used. In our lab, we are using a simulator such as PNETLAB/EVE-NG. #Configuredevice B: #Checkthe peer connection status of the FlowSpec session on device B, if the session has the status “Established” the session is correct and functional. #Checkthe routes received via BGP Flowspec by device B: #Check the traffic policy (dynamic firewall rule) for each BGP Flowspec route based on the ReIndex shown in the previous output: Complete scenario configuration files: Device configuration file A: Device configuration file B: Below is another basic example of a BGP FlowSpec rule to block traffic from a particular port: Validate BGP Flowspec routes received: Validate details of the route received: To check whether the BGP Flowspec routes are effective, you can use the commands below: Validate route statistics: More commands for validations: Example of a Flowspec route with rate-limit: RFCs: For detailed information on BGP FlowSpec, see the following RFCs: Be sure to consult these RFCs for detailed information on BGP FlowSpec and its extensions. Did you know that Made4Flow now includes automated BGP Flowspec in its configurations, and that you can protect your network and your customers using this technology? You can automate BGP FlowSpec announcements for discard, rate limit, and flexible rules.

What is FlowSpec? How to use FlowSpec to mitigate DDoS attacks?

Essentially, Flowspec is an extension of the BGP protocol that allows routers to apply rules—such as dynamic ACLs or dynamic firewall rules—to specific types of traffic. These rules can be based on a variety of criteria, including source, destination, protocol, port, and so on.