Device tested: NE8000-F1A, VRP Version V800R012C10SPC300
Config
BGP Config
bgp 100
peer 10.10.10.2 as-number 65001
peer 10.10.10.2 description "BGP session to BGP FLOWSPEC Controller"
peer 10.10.10.2 ebgp-max-hop 1
peer 10.10.10.2 password PWD
peer 10.10.10.2 local-graceful-restart enable
#
ipv4-family unicast
undo peer 10.10.10.2 enable
#
ipv4-family flow
peer 10.10.10.2 enable
peer 10.10.10.2 route-policy FLOWSPEC-IN import
peer 10.10.10.2 route-policy FLOWSPEC-OUT export
peer 10.10.10.2 route-limit 100
peer 10.10.10.2 advertise-community
peer 10.10.10.2 advertise-large-community
peer 10.10.10.2 validation-disable
#
Important Note: Route-policies won’t work on flow routes. They will filter any route per default. See the next step.
Filtering the FlowSpec networks/subnets in NLRIs
The “destination” field of received Flowspec routes need to be filtered. This is a first important step in granting some level of security of a per node basis.
If you can’t filter or don’t, you will overtrust your controller node which may harm your networks reachability at some point, because even if your Controller is secure, things just happen: while testing this Setup with a GoBGP server, I accidentally used an erronous command line to filter ICMPv4 with a dst/src combo but it filtered ICMP any/any instead, which is something you can avoid by requiring the dst field to be set to a specific IP range or even to one single /32 or /128 host address to avoid wiping out whole networks.
2 Ways to do it
From here there are two possible techniques. The first works on most VRP versions with FS support, while the second will only work with version V800R022C10SPC500, V800R023C00 or later (well, it may work with some earlier versions but Huawei support did recommend me these for stability reasons).
Note that the first technique can only filter the “destination” field of a FS announcement.
Technique 1
Use a prefix-filter + route-map combo, like you would on any other ipv4/v6 unicast peering session:
ip ip-prefix MYPREFIXES index 1 permit 172.16.0.0 16 greater-equal 32 less-equal 32route-policy FLOWSPEC-IN permit node 10
if-match ip-prefix MYPREFIXES
apply community 100:666 additive
#Now add this magical little piece of ducktape:
ipv4-family flow
route match-destination
#Technique 2
Only with the newer VRP versions, there are new Flowspec specific “if-match” parameters to match on in route-policies. Check this link for more info: Huawei Flowspec route-policy
There are 4 available in total:
- if-match flowspec source ip-prefix
- if-match flowspec source ipv6 prefix-list
- if-match flowspec destination ip-prefix
- if-match flowspec destination ipv6 prefix-list
So to achieve the same as above in Technique 1, you would have to only set this route-policy, without:
ip ip-prefix MYPREFIXES index 1 permit 172.16.0.0 16 greater-equal 32 less-equal 32route-policy FLOWSPEC-IN permit node 10
if-match flowspec destination ip-prefix MYPREFIXES
apply community 100:666 additive
#Check
GoBGP
This is the controller side:
$ sudo gobgp global rib -a ipv4-flowspec add community 65001:666 match protocol '==tcp' destination-port '==80' destination 172.16.0.1/32 then discard
$ gobgp global rib -a ipv4-flowspec
Network Next Hop AS_PATH Age Attrs
*> [destination: 172.16.0.1/32][protocol: ==tcp][destination-port: ==80] fictitious 29d 07:19:41 [{Origin: ?} {Communities: 65001:666} {Extcomms: [discard]}]Huawei CLI
Every route has an index, you can see details for a Flowspec rule after checking the routing-table:
>disp bgp flow peer
BGP local router ID : 10.10.10.1
Local AS number : 100
Total number of peers : 1 Peers in established state : 1
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv
10.10.10.2 4 65001 107404 125552 0 0894h54m Established 3
>disp bgp flow routing
BGP Local router ID is 10.10.10.1
Status codes: * - valid, > - best, d - damped, x - best external, a - add path,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V - valid, I - invalid, N - not-found
Total Number of Routes: 1
* > ReIndex : 188419
Dissemination Rules:
Destination IP : 172.16.0.1/32
Protocol : eq 6
Dest. Port : eq 80
MED : PrefVal : 0
LocalPref:
Path/Ogn : 65001>disp bgp flow routing-table 188419
BGP local router ID : 10.10.10.1
Local AS number : 100
ReIndex : 188419
Dissemination Rules :
Destination IP : 172.16.0.1/32
Protocol : eq 6
Dest. Port : eq 80
BGP flow-ipv4 routing table entry information of 188419:
Match action :
apply deny
From: 10.10.10.1 (10.10.10.1)
Route Duration: 29d07h12m03s
Community: <100:666>, <65001:666>
AS-path 65001, origin incomplete, pref-val 0, valid, external, best, pre 255
Not advertised to any peer yet
Easy IPv6 deployments & others 