BGP Flowspec Indirection-ID Redirect

Transcript

1. - -
2. G F PB B B C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 2 https://www.janog.gr.jp/meeting/janog35/program/bgpfs/ Traffic Filtering Rule (NLRI) Traffic Filtering Action (Extended Community) Traffic Filtering Rule Traffic Filtering Action https://tools.ietf.org/html/rfc5575
3. C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 3 AS GAS GAS DDoS D DDoS DDoS Source IP x.x.x.x Destination IP y.y.y.y Drop Destination IP z.z.z.z FB aaa Drop BGP Flowspec BGP Flowspec
4. - - F c R P F B 
     
   B F - - C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 4 Traffic Filtering Rule (NLRI) Traffic Filtering Action (Extended Community) https://datatracker.ietf.org/doc/draft-ietf-idr-flowspec-path-redirect/
   MPLS
   SRv6 G I
5. - - C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 5 AS AS AS Controller IP IP Source IP x.x.x.x Destination IP y.y.y.y Tunnel 1 Destination IP z.z.z.z B aaa Tunnel 2 BGP Flowspec BGP Flowspec y.y.y.y z.z.z.z Tunnel1 Tunnel2
6. ) ) r uq C uq D I d S bp l o d ( ( - ug 11 n DE me ts ci • f C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 6 FlowSpec Redirect to indirection-id Extended Community Flags
   Type/Sub-Type IANA R
7. P - C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 7 FlowSpec Redirect to indirection-id Extended Community ID-Types
   Type/Sub-Type IANA E ID-Type ID
    0 Localised ID Localised indirection-id table ID 1 Node ID with SID/index in MPLS-based Segment Routing 2 Node ID with SID/label in MPLS-based Segment Routing 3 Binding Segment ID with SID/index in MPLS-based Segment 4 Binding Segment ID with SID/label in MPLS-based Segment 5 Tunnel ID I D Tunnel ID Node-SID Binding-SID
8. - - C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 8 Controller Source IP x.x.x.x Destination IP y.y.y.y BGP Flowspec User User x.x.x.x y.y.y.y 1 2 3 4 5 6 7 8 9 10 Rule Redirect-to-indirection-id ID-Type:3 (Binding-SID Index) Indirection-ID:110 Action Binding-SID:110 SR-TE tunnel
9. - - C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 9 Controller User User x.x.x.x y.y.y.y 1 2 3 4 5 6 7 8 9 10 Destination IP x.x.x.x Destination Port abc BGP Flowspec Rule Redirect-to-indirection-id ID-Type:1 (Node-SID Index) Indirection-ID:6 (S-ID:0) Action Redirect-to-indirection-id ID-Type:3 (Binding-SID Index) Indirection-ID:61 (S-ID:1) (1) Node-SID:6 ECMP (2) Binding-SID:61 SR-TE tunnel
   S-ID
10. ( ( )(( C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 10 Controller BGP Flowspec Server (App#1) x.x.x.0/24 y.y.y.0/24 1 2 3 4 5 6 7 8 Source IP x.x.x.1 Destination IP y.y.y.1 Rule Redirect-to-indirection-id ID-Type:3 (Binding-SID Index) Indirection-ID:181 Action Server (App#2) Server (App#1) Server (App#2) Source IP x.x.x.2 Destination IP y.y.y.2 Rule Redirect-to-indirection-id ID-Type:3 (Binding-SID Index) Indirection-ID:182 Action # 2 2 # 2 2 1 A B-SID:181 B-SID:182
11. ( ( ) ( ( ( C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 11 Controller BGP Flowspec UPF (Slice1) x.x.x.0/24 y.y.y.0/24 1 2 3 4 5 6 7 8 Source IP x.x.x.1 Destination IP y.y.y.1 Rule Redirect-to-indirection-id ID-Type:3 (Binding-SID Index) Indirection-ID:181 Action UPF (Slice2) UPF (Slice1) UPF (Slice2) Source IP x.x.x.2 Destination IP y.y.y.2 Rule Redirect-to-indirection-id ID-Type:3 (Binding-SID Index) Indirection-ID:182 Action # # 12 B-SID:181 B-SID:182
12. - p -0 mLewpS p t Tc c • C 6 E8C : 6E A e v • A 2 86 18 C86E EA C86E A IE8 8 A F E E 68 E8Cb/A 8 kLgfLge S sr S il h 21 /0.2 o S Mc x S 21 ewpTc a Rd Mc • - 8 S 21 2- e vS - e E S Mc P y n u M • EE D E EC 6 8C 8E AC: A6 C E 8E C DC A D 86 E C8 C86E C o p y r i g h t © 2 0 1 9 K D D I C o r p o r a t i o n . A l l R i g h t s R e s e r v e d 12