ddos:flowspec
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
ddos:flowspec [2019/07/25 11:43] rb |
ddos:flowspec [2020/07/30 10:12] (current) rb ↷ Page moved and renamed from ddos-flowspec to ddos:flowspec |
||
|---|---|---|---|
| Line 5: | Line 5: | ||
| Правила для фильтрации: | Правила для фильтрации: | ||
| - | * destination | + | * Destination |
| - | * source | + | * Source |
| - | * IP protocols | + | * IP protocols |
| - | * TCP/UDP ports (список исходящих портов или портов на которые защищать) | + | * Source or Destination port |
| + | * Destination port | ||
| + | * Source port | ||
| * ICMP Type | * ICMP Type | ||
| * ICMP Code | * ICMP Code | ||
| * TCP Flags | * TCP Flags | ||
| * Packet Length | * Packet Length | ||
| - | * Diffserv Codepoint | + | * DSCP |
| - | * Fragmentation | + | * Fragment encoding |
| Действия которые можем применять: | Действия которые можем применять: | ||
| - | * Rate Limit | + | * traffic-rate (0 for drop) |
| - | * Traffic-Action | + | * Traffic-Action |
| - | * Redirect | + | * Redirect |
| - | * Traffic-Marking | + | * Traffic-Marking |
| ==== Пример настройки на Juniper ==== | ==== Пример настройки на Juniper ==== | ||
| Line 39: | Line 42: | ||
| < | < | ||
| firewall-install-disable | firewall-install-disable | ||
| + | </ | ||
| + | |||
| + | Создаем policy-option для принятия нужного правила | ||
| + | |||
| + | < | ||
| + | set policy-options policy-statement p1 term a from rib inetflow.0 | ||
| + | set policy-options policy-statement p1 term a from route-filter 10.13.0.0/ | ||
| + | set policy-options policy-statement p1 term a then accept | ||
| + | set policy-options policy-statement p1 term b then reject | ||
| </ | </ | ||
| Line 46: | Line 58: | ||
| set protocol bgp group TestFlowBgp neighbor 111.222.333.444 family inet unicast | set protocol bgp group TestFlowBgp neighbor 111.222.333.444 family inet unicast | ||
| set protocol bgp group TestFlowBgp neighbor 111.222.333.444 family inet flow | set protocol bgp group TestFlowBgp neighbor 111.222.333.444 family inet flow | ||
| + | set protocol bgp group TestFlowBgp neighbor 111.222.333.444 export p1 | ||
| </ | </ | ||
| Line 59: | Line 72: | ||
| show system resource-monitor fpc | show system resource-monitor fpc | ||
| </ | </ | ||
| + | |||
| + | |||
| ==== Пример автоматизации с PyEZ ==== | ==== Пример автоматизации с PyEZ ==== | ||
| Line 244: | Line 259: | ||
| === Advanced community === | === Advanced community === | ||
| - | 9002:666 - традиционный blackhole для префикса, | + | 9002:666 - традиционный blackhole для префикса, |
| + | 9002:667 для фильтрации всего udp трафика\\ | ||
| + | 9002:668 фильтрафия известных амплифаеров (source-port 19, | ||
| === Flowspec === | === Flowspec === | ||
| Line 251: | Line 268: | ||
| * лимит 10 правил | * лимит 10 правил | ||
| + | * destination обязательно, | ||
| * best path до этого адреса/ | * best path до этого адреса/ | ||
| * в правилах может быть только discard | * в правилах может быть только discard | ||
| + | |||
| ===== Fiord ===== | ===== Fiord ===== | ||
ddos/flowspec.1564044191.txt.gz · Last modified: 2020/07/08 18:20 (external edit)
Page Tools
