{"id":18996,"date":"2024-02-22T08:21:34","date_gmt":"2024-02-22T08:21:34","guid":{"rendered":"https:\/\/made4it.com.br\/blog\/how-to-configure-flowspec-on-juniper-routers\/"},"modified":"2026-07-01T15:10:24","modified_gmt":"2026-07-01T15:10:24","slug":"how-to-configure-flowspec-on-juniper-routers","status":"publish","type":"post","link":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/","title":{"rendered":"How to configure FlowSpec on Juniper Routers"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Overview:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>BGP FlowSpec (Border Gateway Protocol Flow Specification)<\/strong> is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to specify more granular criteria for packet forwarding, including Layer 4 information (TCP\/UDP ports) and even packet patterns.   <\/p>\n\n<p class=\"wp-block-paragraph\">To learn more about <strong>BGP Flowspec<\/strong>, check out our article explaining what BGP Flowspec is by clicking this <a href=\"https:\/\/made4it.com.br\/en\/blog\/what-is-flowspec-how-to-use-flowspec-to-mitigate-ddos-attacks\/\" target=\"_blank\" rel=\"noopener\" title=\"What is FlowSpec? How to use FlowSpec to mitigate DDoS attacks?\">link<\/a>.  <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Operation:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>BGP FlowSpec<\/strong> works by adding new types of attributes to BGP, allowing network administrators to specify detailed filtering rules. These rules can include criteria such as:  <\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>IPv4\/IPv6 source and destination addresses<\/strong> <\/li>\n\n\n\n<li><strong>TCP\/UDP ports<\/strong> <\/li>\n\n\n\n<li><strong>Protocols<\/strong> <\/li>\n\n\n\n<li><strong>Bit masks<\/strong> <\/li>\n\n\n\n<li><strong>Package field values<\/strong> <\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">The following actions can be taken with BGP FlowSpec: <\/p>\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li><strong>deny<\/strong>: Blocks the traffic corresponding to the rule. <\/li>\n\n\n\n<li><strong>rate-limit<\/strong>: Limits the traffic rate corresponding to the rule. <\/li>\n\n\n\n<li><strong>redirect<\/strong>: Redirects the traffic corresponding to the rule. <\/li>\n\n\n\n<li><strong>sample:<\/strong> Collects a sample of the traffic corresponding to the rule. <\/li>\n\n\n\n<li><strong>mark<\/strong>: Marks packages matching the rule with a specific mark. <\/li>\n\n\n\n<li><strong>redirect-to-ip:<\/strong> Redirects the traffic corresponding to the rule to a specific IP address. <\/li>\n\n\n\n<li><strong>traffic-rate<\/strong>: Limits the traffic rate corresponding to the rule to a specific value. <\/li>\n\n\n\n<li><strong>traffic-action<\/strong>: Defines action for the corresponding traffic, such as accept, discard or forward. <\/li>\n\n\n\n<li><strong>redirect-to-blackhole<\/strong>: Silently discards all traffic corresponding to the rule. <\/li>\n<\/ol>\n\n<p class=\"wp-block-paragraph\">When these rules are propagated through the BGP network, routers can use this information to filter or manipulate traffic according to the defined policies. <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Operation &#8211; More Details:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\">In the context of <strong>BGP FlowSpec<\/strong>, the actions are specified as part of the filter rules. Each filter rule contains three main parts:  <\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Matching Fields<\/strong>: These specify the Matching Fields: criteria, such as source and destination IP addresses, TCP\/UDP ports, protocols, bit masks and packet field values. <\/li>\n<\/ul>\n\n<ul class=\"wp-block-list\">\n<li><strong>Action Fields<\/strong>: These specify the actions to be taken for the traffic that corresponds to the rule. <\/li>\n\n\n\n<li><strong>Protocol Fields<\/strong>: Specify the protocol that the filter rule should apply. <\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Actions in <strong>BGP FlowSpec<\/strong> are coded using BGP communities. Each action is mapped to a specific BGP community:  <\/p>\n\n<ul class=\"wp-block-list\">\n<li>The<strong>&#8216;deny<\/strong>&#8216; action can be represented by a specific BGP community, such as &#8216;65535:666&#8217;. <\/li>\n\n\n\n<li>The<strong>&#8216;rate-limit<\/strong>&#8216; action can be represented by another specific BGP community, such as &#8216;65535:777&#8217;. <\/li>\n\n\n\n<li>The<strong>&#8216;redirect<\/strong>&#8216; action can be represented by a different BGP community, such as &#8216;65535:888&#8217;. <\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">When you create a <strong>BGP FlowSpec<\/strong> rule, you specify the matching fields, the desired action and, optionally, protocol fields. This rule is then encoded as a BGP community and included in a BGP update message that is sent to neighboring routers. The routers that receive this rule apply the specified actions to the packets that match the matching criteria.   <\/p>\n\n<p class=\"wp-block-paragraph\">Please note that the specific BGP communities for each action may vary depending on the BGP FlowSpec implementation on your network equipment. I recommend consulting your equipment&#8217;s documentation for detailed information on the BGP communities associated with each action in BGP FlowSpec.  <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Use Cases:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>1. **DDoS attack mitigation:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>BGP FlowSpec<\/strong> can be used to block or redirect malicious traffic during distributed denial of service (DDoS) attacks. Precise rules can be applied to filter out unwanted traffic and keep services online.  <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>2. **QoS (Quality of Service) policies:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\">Network administrators can use BGP FlowSpec to guarantee quality of service by prioritizing certain types of traffic based on specific ports or protocols. <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>3. **Implementing Security Policies**:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>BGP FlowSpec<\/strong> can be used to implement granular security policies, blocking traffic associated with malware or suspicious activity. <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Configuration examples:<\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\">The <strong>BGP FlowSpec<\/strong> configuration may vary depending on the network equipment used. <\/p>\n\n<p class=\"wp-block-paragraph\">This example explores how to design a DDoS mitigation solution in which a service provider allows its customers to advertise BGP FlowSpec routes to it. <\/p>\n\n<p class=\"wp-block-paragraph\">It also discusses some of the best practices that should be considered before implementing this type of solution and, finally, some of the Junos commands available to help you check that your Flow-spec solution is working correctly. <\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Topology scenario for the example:<\/strong> <strong><\/strong> <\/p>\n\n<p class=\"wp-block-paragraph\">Let&#8217;s start by taking a look at how our solution will be configured: <\/p>\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/made4it.com.br\/wp-content\/uploads\/2024\/02\/Imagem1-2.png\" alt=\"\" class=\"wp-image-13525\"\/><\/figure>\n\n<p class=\"wp-block-paragraph\">As we can see in the topology above, there is \u201cBORDA,\u201d a Juniper device that serves as the network\u2019s BGP router, and <strong>\u201cMade4Flow<\/strong>,\u201d the software that will analyze the flows, dynamically generate <strong>BGP FlowSpec<\/strong> rules, and advertise them via BGP to the BGP router called \u201cBORDA.\u201d<\/p>\n\n<p class=\"wp-block-paragraph\">In this scenario, the example attack is a DNS amplification attack. This means that the network is receiving a large volume of UDP port 53 packets that it doesn&#8217;t actually need for the ISP to function normally. <\/p>\n\n<p class=\"wp-block-paragraph\">The attack fills the circuit between the ISP and the operators and effectively renders the network inoperable.<\/p>\n\n<p class=\"wp-block-paragraph\">When the attacker decides to launch the attack, the ISP can use <strong>Made4Flow to <\/strong>generate a BGP FlowSpec route specifically for UDP port 53 packets and announce it to the BGP EDGE router, which can then convert that route into a firewall filter on its interfaces that communicate with the carriers.<\/p>\n\n<p class=\"wp-block-paragraph\">And then this blocks the DNS amplification packets at the edge of the ISP&#8217;s network and also at the carrier (if the carrier supports FlowSpec sessions), but allows legitimate traffic to continue arriving.<\/p>\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<p class=\"wp-block-paragraph\">First, let&#8217;s look at the <strong>BGP FlowSpec<\/strong> session settings on the BORDA BGP router with <strong>Made4Flow<\/strong>, assuming that the router is already configured for normal BGP unicast routing (Normal BGP session for announcing Blackhole or Mitigation\/Scrubbing Center routes).<\/p>\n\n<p class=\"wp-block-paragraph\">To configure a BGP FlowSpec session on Juniper devices, we use the following commands:<\/p>\n\n<pre class=\"wp-block-code\"><code>set routing-options flow term-order standard\nset protocols bgp group MADE4FLOW type internal\nset protocols bgp group MADE4FLOW local-address 10.70.0.67\nset protocols bgp group MADE4FLOW family inet unicast\nset protocols bgp group MADE4FLOW family inet flow no-validate FLOWSPEC_IMPORT\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 description IBGP_MADE4FLOW\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 local-adddress 10.70.0.67\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 import FLOWSPEC_IMPORT\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 family inet flow prefix-limit maximum 1000\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 family inet flow no-validate FLOWSPEC_IMPORT\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 family inet flow legacy-redirect-ip-action receive\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 export DENY-ALL\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 peer-as XXXXXX\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\"><strong>Good practices: <\/strong><strong><\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">There are best practices for protecting this solution. Both the BGP FlowSpec routes and the resulting firewall filters they create are finite resources in the router. <\/p>\n\n<p class=\"wp-block-paragraph\">Therefore, the BGP EDGE router can filter incoming routes to ensure that it does not receive more routes than expected or incorrect routes.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Prefix Limit:<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">So the first thing to do is to set a prefix limit for BGP FlowSpec routes.<\/p>\n\n<p class=\"wp-block-paragraph\">You could simply set a single prefix limit for the <strong><em>inet unicast<\/em><\/strong> and<strong><em> inet flow<\/em><\/strong>routes; however, this example will set a separate limit for the <strong><em>inet flow<\/em><\/strong>routes. To ensure that <strong>Made4Flow<\/strong> can send only ten BGP Flowspec routes at a time, let\u2019s set the prefix limit to 10 (this configuration should be adjusted according to each scenario): <\/p>\n\n<pre class=\"wp-block-code\"><code>set protocols bgp group MADE4FLOW neighbor 10.70.0.68 family inet flow prefix-limit maximum 10<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\"><strong>Route Policy :<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The next thing to do is to apply an inbound route policy. This policy will limit the router to receiving prefixes that are from the ISP itself with prefixes \/24 to \/32, which are those announced by Made4Flow. <\/p>\n\n<p class=\"wp-block-paragraph\">Let&#8217;s also add a Community <strong><em>64496:86<\/em><\/strong> so that it can identify the routes as BGP <strong>FlowSpec<\/strong> routes.<\/p>\n\n<p class=\"wp-block-paragraph\">For all other routes, you can simply filter them based on the client&#8217;s route assignment:<\/p>\n\n<p class=\"wp-block-paragraph\">1. Create the policy definition:<\/p>\n\n<pre class=\"wp-block-code\"><code>set policy-options community COMM-FLOWSPEC members 64496:86\nset policy-options policy-statement FLOWSPEC_IMPORT term 1 from rib inetflow.0\nset policy-options policy-statement FLOWSPEC_IMPORT term 1 from route-filter 203.0.113.0\/24 prefix-length-range \/24-\/32;\nset policy-options policy-statement FLOWSPEC_IMPORT term 1 then community add COMM-FLOWSPEC\nset policy-options policy-statement FLOWSPEC_IMPORT term 1 then accept \nset policy-options policy-statement FLOWSPEC_IMPORT term 999 then reject\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">2. Apply the policy as an import policy in the BGP session with Made4Flow:<\/p>\n\n<pre class=\"wp-block-code\"><code>set protocols bgp group MADE4FLOW family inet flow no-validate FLOWSPEC_IMPORT\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 import FLOWSPEC_IMPORT\nset protocols bgp group MADE4FLOW neighbor 10.70.0.68 family inet flow no-validate FLOWSPEC_IMPORT\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\"><strong>Maximum prefixes:<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The last thing to do is to set a maximum number of BGP FlowSpec prefixes that can be installed in the routing table.<\/p>\n\n<p class=\"wp-block-paragraph\">This example sets a maximum of 10,000 routes, but let&#8217;s also configure the router to notify the administrator via a <strong><em>syslog <\/em><\/strong>message when a 90% threshold is reached. This configuration must be applied to all routers in the ISP\u2019s network in the example: <\/p>\n\n<pre class=\"wp-block-code\"><code>set routing-options rib inetflow.0 maximum-prefixes 10000 threshold 90<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">It may not be very intuitive to understand in the syntax above, but the conf. <strong><em>threshold 90<\/em><\/strong> is what tells the router that you want a <strong><em>syslog <\/em><\/strong>message when the 90% threshold is reached.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Verification:<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The first thing to check is that BGP FlowSpec is configured correctly. Let&#8217;s look at the NLRIs that are activated in the BGP peer. <\/p>\n\n<p class=\"wp-block-paragraph\">Checking the NLRI: From operational mode on the BORDA router, enter the Junos OS command <strong><em>show bgp neighbor 10.70.0.68<\/em><\/strong> and look for the <strong><em>inet-flow<\/em><\/strong> capability in the output:<\/p>\n\n<pre class=\"wp-block-code\"><code>lab@BORDA&gt; show bgp neighbor 10.70.0.68\nPeer: 10.70.0.68+45824 AS 64511 Local: 192.0.2.0+63720 AS 64496\n Type: External State: Established Flags: &lt;Sync&gt;\n Last State: OpenConfirm Last Event: RecvKeepAlive\n Last Error: None\n Import: &#91; CUST-IN ]\n Options: &lt;Preference LocalAddress AddressFamily PeerAS PrefixLimit Refresh&gt;\n Address families configured: inet-unicast inet-flow\n Local Address: 10.70.0.67 Holdtime: 90 Preference: 170\n Number of flaps: 0\n Peer ID: 10.70.0.68 Local ID: 10.70.0.67 Active Holdtime: 90\n Keepalive Interval: 30 Group index: 1 Peer index: 0\n BFD: disabled, down\n Local Interface: ge-0\/0\/3.0\n NLRI for restart configured on peer: inet-unicast inet-flow\n NLRI advertised by peer: inet-unicast inet-flow\n NLRI for this session: inet-unicast inet-flow\n Peer supports Refresh capability (2)\n Stale routes from peer are kept for: 300\n Peer does not support Restarter functionality\n NLRI that restart is negotiated for: inet-unicast inet-flow\n NLRI of received end-of-rib markers: inet-unicast inet-flow\n NLRI of all end-of-rib markers sent: inet-unicast inet-flow\n Peer supports 4 byte AS extension (peer-as 64511)\n Peer does not support Addpath\n Table inetflow.0 Bit: 10000\n RIB State: BGP restart is complete\n Send state: in sync\n Active prefixes: 1\n Received prefixes: 1\n Accepted prefixes: 1\n Suppressed due to damping: 0\n Advertised prefixes: 0\n Table inet.0 Bit: 20000\n RIB State: BGP restart is complete\n Send state: in sync\n Active prefixes: 1\n Received prefixes: 1\n Accepted prefixes: 1\n Suppressed due to damping: 0\n Advertised prefixes: 0\n Last traffic (seconds): Received 13 Sent 28 Checked 4\n Input messages: Total 392 Updates 4 Refreshes 0Octets 7552\n Output messages: Total 386 Updates 0 Refreshes 0Octets 7435\n Output Queue&#91;0]: 0 (inetflow.0, inet-flow)\n Output Queue&#91;1]: 0 (inet.0, inet-unicast)\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\"><strong>Checking Routes:<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The next thing to look at is the flow route that was sent by Made4Flow and received at the BORDA:<\/p>\n\n<pre class=\"wp-block-code\"><code>lab@BORDA&gt; show route receive-protocol bgp 10.70.0.68 extensive table inetflow.0\ninetflow.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">* 203.0.113.1,*,proto=17,dstport=53\/term:1 (1 entry, 1 announced)<\/mark>\n Accepted\n Nexthop: Self\n AS path: 64511 I\n Communities: traffic-rate:0:0\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">And here the route is being received from <strong>Made4Flow<\/strong>. Note that the only community attached to the route is the one that specifies that you should set a rate of 0 for the traffic. <\/p>\n\n<p class=\"wp-block-paragraph\">Now let&#8217;s take a look at the route in the BGP BORDA router&#8217;s routing table:<\/p>\n\n<pre class=\"wp-block-code\"><code>lab@BORDA&gt; show route table inetflow.0 extensive\ninetflow.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">203.0.113.1,*,proto=17,dstport=53\/term:1 (1 entry, 1 announced)\n<\/mark>TSI:\nKRT in dfwd;\nAction(s): discard,count\nPage 0 idx 1, (group ibgp type Internal) Type 1 val 0x966ef08 (adv_entry)\n Advertised metrics:\n Nexthop: Self\n Localpref: 100\n AS path: &#91;64496] 64511 I\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">  Communities: 64496:86 traffic-rate:0:0\n<\/mark>Page 0 idx 2, (group RR-CLIENT-FLOWSPEC type Internal) Type 1 val 0x966f11c (adv_\nentry)\n Advertised metrics:\n Nexthop: Self\n Localpref: 100\n AS path: &#91;64496] 64511 I\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\"> Communities: 64496:86 traffic-rate:0:0\n<\/mark>Path 203.0.113.1,*,proto=17,dstport=53 from 10.70.0.68 Vector len 4. Val: 1 2\n *BGP Preference: 170\/-101\n Next hop type: Fictitious\n Address: 0x9358c04\n Next-hop reference count: 1\n State: &lt;Active Ext&gt;\n Local AS: 64496 Peer AS: 64511\n Age: 3:27:43\n Validation State: unverified\n Task: BGP_64511.10.70.0.68+45824\n Announcement bits (2): 0-Flow 1-BGP_RT_Background\n AS path: 64511 I\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\"> Communities: 64496:86 traffic-rate:0:0\n<\/mark> Accepted\n Validation state: Accept, Originator: 10.70.0.68\n Via: 203.0.113.0\/24, Active\n Localpref: 100\n Router ID: 10.70.0.68\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">The route has been installed in the route table in BORDA and Community <strong><em>64496:86<\/em><\/strong> that was assigned was added to the route.<\/p>\n\n<p class=\"wp-block-paragraph\">Note that the flow was mapped to the unicast route and validated for consistency.<br\/><br\/>With that, we continue&#8230;<\/p>\n\n<p class=\"wp-block-paragraph\">Checking the firewall filters:<\/p>\n\n<p class=\"wp-block-paragraph\">Now that the flow routes have been validated, they are turned into firewall filters.<\/p>\n\n<p class=\"wp-block-paragraph\">Let&#8217;s take a look at the firewall filter:<\/p>\n\n<pre class=\"wp-block-code\"><code>lab@BORDA&gt; show firewall filter __flowspec_default_inet__\nFilter: __flowspec_default_inet__\nCounters:\nName Bytes Packets\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">203.0.113.1,*,proto=17,dstport=53 0 0\n<\/mark><\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">All OK.<\/p>\n\n<p class=\"wp-block-paragraph\">Check the system log:<\/p>\n\n<p class=\"wp-block-paragraph\">EXAMPLE: If you have followed the best practices above and set a prefix limit in the BGP session, you will see a log message when the maximum is reached:<\/p>\n\n<pre class=\"wp-block-code\"><code>lab@BORDA&gt; show log messages | match BGP_PREFIX\nSep 5 17:51:04 pe3 rpd&#91;2812]: BGP_PREFIX_LIMIT_\nEXCEEDED: 10.70.0.68 (External AS 64511): Configured maximum prefixlimit(1) exceeded for inet-flow nlri: 2 (instance master)\n<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Final summary of the example:<\/p>\n\n<p class=\"wp-block-paragraph\">As we can see, configuring a BGP FlowSpec solution is simple.<\/p>\n\n<p class=\"wp-block-paragraph\">Between ISPs it can become a little more complicated, as it requires coordination between the client and the service provider. Unfortunately, not all operators provide FlowSpec sessions. <\/p>\n\n<p class=\"wp-block-paragraph\">Check with your service provider to see if this is possible, as it is essential to have this set up in advance of a DDoS attack.<\/p>\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n<p class=\"wp-block-paragraph\">Find out more about how to optimize traffic forwarding with BGP FlowSpec and simplify network security management! Explore <strong>Made4Flow<\/strong>, our <strong>netflow analysis<\/strong> tool, and take your network infrastructure to the next level.  <\/p>\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-vivid-cyan-blue-background-color has-background wp-element-button\" href=\"https:\/\/made4flow.com.br\/\" target=\"_blank\" rel=\"noreferrer noopener\">Get to know Made4Flow<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to specify more granular criteria for packet forwarding, including Layer 4 information (TCP\/UDP ports) and even packet patterns. To learn more about BGP Flowspec, check out our article explaining what BGP Flowspec is by clicking this link. Operation: BGP FlowSpec works by adding new types of attributes to BGP, allowing network administrators to specify detailed filtering rules. These rules can include criteria such as: The following actions can be taken with BGP FlowSpec: When these rules are propagated through the BGP network, routers can use this information to filter or manipulate traffic according to the defined policies. Operation &#8211; More Details: In the context of BGP FlowSpec, the actions are specified as part of the filter rules. Each filter rule contains three main parts: Actions in BGP FlowSpec are coded using BGP communities. Each action is mapped to a specific BGP community: When you create a BGP FlowSpec rule, you specify the matching fields, the desired action and, optionally, protocol fields. This rule is then encoded as a BGP community and included in a BGP update message that is sent to neighboring routers. The routers that receive this rule apply the specified actions to the packets that match the matching criteria. Please note that the specific BGP communities for each action may vary depending on the BGP FlowSpec implementation on your network equipment. I recommend consulting your equipment&#8217;s documentation for detailed information on the BGP communities associated with each action in BGP FlowSpec. Use Cases: 1. **DDoS attack mitigation: BGP FlowSpec can be used to block or redirect malicious traffic during distributed denial of service (DDoS) attacks. Precise rules can be applied to filter out unwanted traffic and keep services online. 2. **QoS (Quality of Service) policies: Network administrators can use BGP FlowSpec to guarantee quality of service by prioritizing certain types of traffic based on specific ports or protocols. 3. **Implementing Security Policies**: BGP FlowSpec can be used to implement granular security policies, blocking traffic associated with malware or suspicious activity. Configuration examples: The BGP FlowSpec configuration may vary depending on the network equipment used. This example explores how to design a DDoS mitigation solution in which a service provider allows its customers to advertise BGP FlowSpec routes to it. It also discusses some of the best practices that should be considered before implementing this type of solution and, finally, some of the Junos commands available to help you check that your Flow-spec solution is working correctly. Topology scenario for the example: Let&#8217;s start by taking a look at how our solution will be configured: As we can see in the topology above, there is \u201cBORDA,\u201d a Juniper device that serves as the network\u2019s BGP router, and \u201cMade4Flow,\u201d the software that will analyze the flows, dynamically generate BGP FlowSpec rules, and advertise them via BGP to the BGP router called \u201cBORDA.\u201d In this scenario, the example attack is a DNS amplification attack. This means that the network is receiving a large volume of UDP port 53 packets that it doesn&#8217;t actually need for the ISP to function normally. The attack fills the circuit between the ISP and the operators and effectively renders the network inoperable. When the attacker decides to launch the attack, the ISP can use Made4Flow to generate a BGP FlowSpec route specifically for UDP port 53 packets and announce it to the BGP EDGE router, which can then convert that route into a firewall filter on its interfaces that communicate with the carriers. And then this blocks the DNS amplification packets at the edge of the ISP&#8217;s network and also at the carrier (if the carrier supports FlowSpec sessions), but allows legitimate traffic to continue arriving. First, let&#8217;s look at the BGP FlowSpec session settings on the BORDA BGP router with Made4Flow, assuming that the router is already configured for normal BGP unicast routing (Normal BGP session for announcing Blackhole or Mitigation\/Scrubbing Center routes). To configure a BGP FlowSpec session on Juniper devices, we use the following commands: Good practices: There are best practices for protecting this solution. Both the BGP FlowSpec routes and the resulting firewall filters they create are finite resources in the router. Therefore, the BGP EDGE router can filter incoming routes to ensure that it does not receive more routes than expected or incorrect routes. Prefix Limit: So the first thing to do is to set a prefix limit for BGP FlowSpec routes. You could simply set a single prefix limit for the inet unicast and inet flowroutes; however, this example will set a separate limit for the inet flowroutes. To ensure that Made4Flow can send only ten BGP Flowspec routes at a time, let\u2019s set the prefix limit to 10 (this configuration should be adjusted according to each scenario): Route Policy : The next thing to do is to apply an inbound route policy. This policy will limit the router to receiving prefixes that are from the ISP itself with prefixes \/24 to \/32, which are those announced by Made4Flow. Let&#8217;s also add a Community 64496:86 so that it can identify the routes as BGP FlowSpec routes. For all other routes, you can simply filter them based on the client&#8217;s route assignment: 1. Create the policy definition: 2. Apply the policy as an import policy in the BGP session with Made4Flow: Maximum prefixes: The last thing to do is to set a maximum number of BGP FlowSpec prefixes that can be installed in the routing table. This example sets a maximum of 10,000 routes, but let&#8217;s also configure the router to notify the administrator via a syslog message when a 90% threshold is reached. This configuration must be applied to all routers in the ISP\u2019s network<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-18996","post","type-post","status-publish","format-standard","hentry","category-nao-categorizado"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.9 - aioseo.com -->\n\t<meta name=\"description\" content=\"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Made4it\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.9\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Made4it -\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"How to configure FlowSpec on Juniper Routers - Made4it\" \/>\n\t\t<meta property=\"og:description\" content=\"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"87\" \/>\n\t\t<meta property=\"og:image:height\" content=\"27\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-22T08:21:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-01T15:10:24+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"How to configure FlowSpec on Juniper Routers - Made4it\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#blogposting\",\"name\":\"How to configure FlowSpec on Juniper Routers - Made4it\",\"headline\":\"How to configure FlowSpec on Juniper Routers\",\"author\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/author\\\/made4it\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/made4it.com.br\\\/wp-content\\\/uploads\\\/2024\\\/02\\\/Imagem1-2.png\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#articleImage\"},\"datePublished\":\"2024-02-22T08:21:34+00:00\",\"dateModified\":\"2026-07-01T15:10:24+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#webpage\"},\"articleSection\":\"N\\u00e3o categorizado\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/category\\\/nao-categorizado\\\/#listItem\",\"name\":\"N\\u00e3o categorizado\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/category\\\/nao-categorizado\\\/#listItem\",\"position\":2,\"name\":\"N\\u00e3o categorizado\",\"item\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/category\\\/nao-categorizado\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#listItem\",\"name\":\"How to configure FlowSpec on Juniper Routers\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#listItem\",\"position\":3,\"name\":\"How to configure FlowSpec on Juniper Routers\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/category\\\/nao-categorizado\\\/#listItem\",\"name\":\"N\\u00e3o categorizado\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#organization\",\"name\":\"Made4it\",\"url\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/made4it.com.br\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/logomade4it.png\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#organizationLogo\",\"width\":87,\"height\":27},\"image\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/author\\\/made4it\\\/#author\",\"url\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/author\\\/made4it\\\/\",\"name\":\"Made4it\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e851ee58f38006902829c03b2dc8e42c8a735a5561b807ca366ed66bd41f2ca?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Made4it\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#webpage\",\"url\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/\",\"name\":\"How to configure FlowSpec on Juniper Routers - Made4it\",\"description\":\"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\\\/IPv6 and prefix information, BGP FlowSpec allows network administrators to\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/how-to-configure-flowspec-on-juniper-routers\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/author\\\/made4it\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/blog\\\/author\\\/made4it\\\/#author\"},\"datePublished\":\"2024-02-22T08:21:34+00:00\",\"dateModified\":\"2026-07-01T15:10:24+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/\",\"name\":\"Made4it\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/made4it.com.br\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"How to configure FlowSpec on Juniper Routers - Made4it","description":"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to","canonical_url":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#blogposting","name":"How to configure FlowSpec on Juniper Routers - Made4it","headline":"How to configure FlowSpec on Juniper Routers","author":{"@id":"https:\/\/made4it.com.br\/en\/blog\/author\/made4it\/#author"},"publisher":{"@id":"https:\/\/made4it.com.br\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/made4it.com.br\/wp-content\/uploads\/2024\/02\/Imagem1-2.png","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#articleImage"},"datePublished":"2024-02-22T08:21:34+00:00","dateModified":"2026-07-01T15:10:24+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#webpage"},"isPartOf":{"@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#webpage"},"articleSection":"N\u00e3o categorizado"},{"@type":"BreadcrumbList","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/made4it.com.br\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/blog\/category\/nao-categorizado\/#listItem","name":"N\u00e3o categorizado"}},{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/blog\/category\/nao-categorizado\/#listItem","position":2,"name":"N\u00e3o categorizado","item":"https:\/\/made4it.com.br\/en\/blog\/category\/nao-categorizado\/","nextItem":{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#listItem","name":"How to configure FlowSpec on Juniper Routers"},"previousItem":{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#listItem","position":3,"name":"How to configure FlowSpec on Juniper Routers","previousItem":{"@type":"ListItem","@id":"https:\/\/made4it.com.br\/en\/blog\/category\/nao-categorizado\/#listItem","name":"N\u00e3o categorizado"}}]},{"@type":"Organization","@id":"https:\/\/made4it.com.br\/en\/#organization","name":"Made4it","url":"https:\/\/made4it.com.br\/en\/","logo":{"@type":"ImageObject","url":"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#organizationLogo","width":87,"height":27},"image":{"@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/made4it.com.br\/en\/blog\/author\/made4it\/#author","url":"https:\/\/made4it.com.br\/en\/blog\/author\/made4it\/","name":"Made4it","image":{"@type":"ImageObject","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/9e851ee58f38006902829c03b2dc8e42c8a735a5561b807ca366ed66bd41f2ca?s=96&d=mm&r=g","width":96,"height":96,"caption":"Made4it"}},{"@type":"WebPage","@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#webpage","url":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/","name":"How to configure FlowSpec on Juniper Routers - Made4it","description":"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/made4it.com.br\/en\/#website"},"breadcrumb":{"@id":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/#breadcrumblist"},"author":{"@id":"https:\/\/made4it.com.br\/en\/blog\/author\/made4it\/#author"},"creator":{"@id":"https:\/\/made4it.com.br\/en\/blog\/author\/made4it\/#author"},"datePublished":"2024-02-22T08:21:34+00:00","dateModified":"2026-07-01T15:10:24+00:00"},{"@type":"WebSite","@id":"https:\/\/made4it.com.br\/en\/#website","url":"https:\/\/made4it.com.br\/en\/","name":"Made4it","inLanguage":"en-US","publisher":{"@id":"https:\/\/made4it.com.br\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Made4it -","og:type":"article","og:title":"How to configure FlowSpec on Juniper Routers - Made4it","og:description":"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to","og:url":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/","og:image":"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png","og:image:secure_url":"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png","og:image:width":87,"og:image:height":27,"article:published_time":"2024-02-22T08:21:34+00:00","article:modified_time":"2026-07-01T15:10:24+00:00","twitter:card":"summary_large_image","twitter:title":"How to configure FlowSpec on Juniper Routers - Made4it","twitter:description":"Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers; in simpler terms, it can generate firewall rules on routers based on a BGP announcement. Unlike conventional BGP, which routes based on IPv4\/IPv6 and prefix information, BGP FlowSpec allows network administrators to","twitter:image":"https:\/\/made4it.com.br\/wp-content\/uploads\/2025\/09\/logomade4it.png"},"aioseo_meta_data":{"post_id":"18996","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":null,"twitter_description":null,"schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null,"created":"2026-07-01 15:10:04","updated":"2026-07-01 17:08:52"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/made4it.com.br\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/made4it.com.br\/en\/blog\/category\/nao-categorizado\/\" title=\"N\u00e3o categorizado\">N\u00e3o categorizado<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tHow to configure FlowSpec on Juniper Routers\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/made4it.com.br\/en\/"},{"label":"N\u00e3o categorizado","link":"https:\/\/made4it.com.br\/en\/blog\/category\/nao-categorizado\/"},{"label":"How to configure FlowSpec on Juniper Routers","link":"https:\/\/made4it.com.br\/en\/blog\/how-to-configure-flowspec-on-juniper-routers\/"}],"_links":{"self":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts\/18996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/comments?post=18996"}],"version-history":[{"count":1,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts\/18996\/revisions"}],"predecessor-version":[{"id":18997,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts\/18996\/revisions\/18997"}],"wp:attachment":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/media?parent=18996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/categories?post=18996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/tags?post=18996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}