What is FlowSpec? How to use FlowSpec to mitigate DDoS attacks?
Essentially, Flowspec is an extension of the BGP protocol that allows routers to apply rules—such as dynamic ACLs or dynamic firewall rules—to specific types of traffic. These rules can be based on a variety of criteria, including source, destination, protocol, port, and so on.
Netflow Configuration on Cisco Routers
Learn how to configure Netflow on your Cisco ASR9k or Cisco 100x Line (1002,1004 or 1008) router
Netflow Configuration on Juniper Routers
Hello Today we’ll show you how to configure your Juniper router to export NetFlow (jFlow). At the end of the article, you’ll find the configuration using IPFIX (NetFlow v10). Here we have the Network topology and the Netflow Server information These are the steps needed to configure a Juniper Router to export Netflow v5 Let’s go to the step-by-step configuration 1. Configure the NTP Server It is important to configure an NTP Server because the Flows data uses timestamp according to the router’s time. If the router has a different time than the server, the data will not agree with the time, generating a mismatch of information. It is important that you configure at least 2 NTP servers and also your router’s timezone. 2. Configure Forwarding Options with the Sampling Rate The sampling rate is used to prevent CPU overload in your Routing Engine; it creates a sample of the traffic and exports it, allowing the NetFlow system to receive the data and apply a multiplication factor so that the data reflects actual numbers. To configure this, use the commands. The ideal rate value depends on how much traffic you use; a good tip is to use values above 200 and monitor your router’s CPU usage. 3. Configure the Host that will receive the Flows coming from the Router To configure your router to export NetFlow, you must specify the IP address of the server that will receive the flows and the UDP port on which it will receive this traffic. To do this, use the following commands: 4. Configure the interface to enable Netflow on the interface After configuring the sampling rate and the flow server, you still need to enable NetFlow on the interfaces from which it will generate data. Keep in mind that you must configure this command within each unit.To do this, configure the interfaces within each unit using the following command: ### Aplicar o comando sampling input set interfaces ge-0/0/1 unit 0 family inet sampling input The complete configuration looks like this: To make things even easier, we have a video demonstrating how to configure each command covered in this tutorial As a bonus, we’ll post the IPFIX configurations for a few types of routers Juniper MX204 For routers such as the MX204, you can use IPFIX (NetFlow v10). To configure this on the MX204, use the commands and modify the Flow-server and source address IPs. Juniper MX104 To configure the Juniper MX104 use the commands below. Remember that MX104 only supports exporting to 1 Netflow Server with IPFIX. If you have a router that isn’t listed here, please send an email to comercial@made4it.com.br, and we’ll send you the settings.I hope this helped, and see you next time.Best regards.
Netflow Configuration on Mikrotik RouterOS Routers
Netflow Configuration on Mikrotik Routers
