Chapter Contents
The Border Gateway Protocol (BGP) flow specification client feature enables a device to perform the role of a BGP flow specification client and receive flow specification rules from a BGP flow specification controller. Flow specification rules contain a set of match criteria and actions (also called flows). The flows are configured on a controller (device), which advertises the flows to the client device, or specific interfaces on the client.
Attention:IOS XE software supports BGP flow specification client function and does not support BGP flow specification controller function.
- Finding Feature Information
- Prerequisites for BGP Flow Specification Client
- Restrictions for BGP Flow Specification Client
- Information About BGP Flow Specification Client
- How to Configure BGP Flow Specification Client
- Configuration Examples for BGP Flow Specification Client
- Additional References for BGP Flow Specification Client
- Feature Information for BGP Flow Specification Client
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for BGP Flow Specification Client
- Identify and configure flow specification rules on the controller.
Note When the flow specification client is enabled, the matching criteria and corresponding actions in the controller’s flows are remotely injected into the client device, and the flows are programmed into the platform hardware of the client device.
Restrictions for BGP Flow Specification Client
- In Cisco IOS 15.5(S) release, BGP flow specification is supported only on a BGP flow specification client and route reflector.
- Mixing of address family matches and actions is not supported in flow specification rules. For example, IPv4 matches cannot be combined with IPv6 actions and vice versa.
Information About BGP Flow Specification Client
BGP Flow Specification Model
The BGP protocol is used for flow specifications due to unique advantages it offers. The three elements that are used to route flow specifications through BGP enabled devices are: controller, client, and route-reflector (which is optional). This document is specific to the client element function.
Though devices with the IOS XE software (such as ASR 1000, and so on) can perform BGP flow specification client role and not the controller role, a brief outline of the BGP flow specification process is given below for better understanding.
The BGP flow specification functionality allows you to rapidly deploy and propagate filtering and policing functionality among a large number of BGP peer devices to mitigate the effects of a distributed denial-of-service (DDoS) attack over your network.
The BGP flow specification model comprises of a client and a controller (route-reflector usage is optional). The controller is responsible for sending or injecting the flow specification NRLI entry. The client (acting as a BGP speaker) receives the NRLI and programs the hardware forwarding to act on the instruction from the controller. An illustration of this model is provided below.
Figure 1. BGP Flow Specification Model
In the above topology, the controller on the left-hand side injects the flow specification NRLI into the client on the right-hand side. The client receives the information, sends it to the flow specification manager component, configures the ePBR (Enhanced Policy Based Routing) infrastructure, which in turn programs the platform hardware of the device. This way, you can create rules to handle DDoS attacks on your network.
Sample Flow Specification Client Configuration
First, associate the device to a BGP autonomous system and enable flow specification policy mapping capability for various address families. Then, identify a neighbor (through its IP address) as a BGP peer and enable the capability to exchange information between the devices through theneighbor activate command. This way, flow specification information can be exchanged between the client, controller, and any other flow specification client device.
! router bgp 100 address-family ipv4 flowspec neighbor 10.1.1.1 activate !
Matching Criteria and Actions
The flow specification NLRI type consists of several optional sub-components. A specific packet is considered to match the flow specification when it matches the intersection (AND) of all the components present in the specification. The following are the supported component types or tuples that you can define:
| BGP Flowspec NLRI Type | QoS Matching Field (IPv6) | QoS Matching Field (IPv4) | Input Value |
|---|---|---|---|
| Type 1 | IPv6 destination address | IPv4 destination address | Prefix length |
| Type 2 | IPv6 source address | IPv4 source address | Prefix length |
| Type 3 | IPv6 next header | IPv4 protocol | Multi-value range |
| Type 4 | IPv6 source or destination port | IPv4 source or destination port | Multi-value range |
| Type 5 | IPv6 destination port | IPv4 destination port | Multi-value range |
| Type 6 | IPv6 source port | IPv4 source port | Multi-value range |
| Type 7 | IPv6 ICMP type | IPv4 ICMP type | Multi-value range |
| Type 8 | IPv6 ICMP code | IPv4 ICMP code | Multi-value range |
| Type 9 | IPv6 TCP flags | IPv4 TCP flags (2 bytes include reserved bits) | Bit mask |
| Type 10 | IPv6 packet length | IPv4 packet length | Multi-value range |
| Type 11 | IPv6 traffic class | IPv4 DSCP | Multi-value range |
| Type 12 | Reserved | IPv4 fragment bits | Bit mask |
How to Configure BGP Flow Specification Client
Configuring a Device As a Flow Specification Client and Establishing a BGP Peer Relationship With Neighbor
The following task explains configuration of a device as a BGP flow specification client. A device interface within a VRF instance can also perform the role of a BGP flow specification client.
Before configuring a device as a flow specification client, it is a good practice to identify and configure the flow specification controller device (and a route reflector, if required). When flow specification rules are configured on the controller, the rules are remotely injected into the client and the matching criteria and corresponding actions are programmed into the platform hardware of the client.
SUMMARY STEPS
1. enable
2. configure terminal
3. router bgp as-number
4. address-family {ipv4 | ipv6} flowspec
5. neighbor ip-address activate
6. exit
7. address-family {ipv4 | ipv6} flowspec vrf vrf-name
8. neighbor ip-address remote-as as-number
9. neighbor ip-address activate
10. exit
DETAILED STEPS
Configuring a Flow Specification Policy On All Interfaces Of a Device
The following configuration task explains flow specification policy configuration on all interfaces of a device for the IPv4 and IPv6 address families, and on interfaces within a VRF instance.
SUMMARY STEPS
1. enable
2. configure terminal
3. flowspec
4. address-family ipv4
5. local-install interface-all
6. exit
7. address-family ipv6
8. local-install interface-all
9. exit
10. vrf vrf-name
11. address-family ipv4
12. local-install interface-all
13. exit
14. address-family ipv6
15. local-install interface-all
16. exit
DETAILED STEPS
Verifying BGP Flow Specification Client
These commands display flow specification configuration details:
SUMMARY STEPS
1. show flowspec summary
2. show bgp ipv4 flowspec
3. show flowspec vrf vrf-name afi-all
DETAILED STEPS
Configuration Examples for BGP Flow Specification Client
Example: Configuring a Device As a Flow Specification Client and Establishing a BGP Peer Relationship With Neighbor
Device> enable Device# configure terminal Device (config)# router bgp 100 Device (config-bgp)# address-family ipv4 flowspec Device (config-bgp-af)# neighbor 10.1.1.1 activate Device (config-bgp-af)# exit Device (config-bgp)# address-family ipv4 flowspec vrf vrf1 Device (config-bgp-af)# neighbor 2001:DB8:1::1 remote as 100 Device (config-bgp-af)# neighbor 2001:DB8:1::1 activate Device (config-bgp-af)# exit
Example: Configuring a Flow Specification Policy On All Interfaces Of a Device
Device> enable Device# configure terminal Device(config)# flowspec Device(config-flowspec)# address-family ipv4 Device(config-flowspec-af)# local-install interface-all Device(config-flowspec-af)# exit Device(config-flowspec)# address-family ipv6 Device(config-flowspec-af)# local-install interface-all Device(config-flowspec-af)# exit Device(config-flowspec)# vrf vrf10 Device(config-flowspec-vrf)# address-family ipv4 Device(config-flowspec-vrf-af)# local-install interface-all Device(config-flowspec-vrf-af)# exit Device(config-flowspec-vrf)# address-family ipv6 Device(config-flowspec-vrf-af)# local-install interface-all Device(config-flowspec-vrf-af)# exit
Additional References for BGP Flow Specification Client
Related Documents
| Related Topic | Document Title |
|---|---|
| Cisco IOS commands | |
| BGP commands | |
| BGP Flow Specification Route-reflector Support | IP Routing: BGP Configuration Guide |
Standards and RFCs
| Standard/RFC | Title |
|---|---|
| RFC 5575 | Dissemination of Flow Specification Rules |
MIBs
| MIB | MIBs Link |
|---|---|
| To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Technical Assistance
| Description | Link |
|---|---|
| The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature Information for BGP Flow Specification Client
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
| Feature Name | Releases | Feature Information |
|---|---|---|
| BGP Flow Specification Client | Cisco IOS XE 3.15S | The BGP flow specification client feature enables a device to perform the role of a BGP flow specification client and receive flow specification rules from a BGP flow specification controller. The following command was introduced or modified: flowspec, local-install interface-all. |
扫一扫
715
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
