Basic Offramp Scrubbing Example

Here is a TOML config for a basic scrubbing scenario. This example shows a two-tiered scrubbing scenario. All zones get the same configuration. When an attack is detected, traffic to that destination is redirected to a dedicated VRF. If a very large attack is detected, the impacted zone is blocked upstream to preserve the rest of the network.

Deployment

TOML Configuration

[[mapping]]
group-id-recursive = 0 # Matches every zone
workflows = [
   "Scrub",
   "Emergency",
]

[workflows.Scrub]
actions = ["Filter-v4", "Filter-v6"]
[[workflows.Scrub.trigger]]
type = "host-bits-per-second"
limit = "100 M"

# Generates IPv4 FlowSpec if IPv4 host over 100 Mbps
[actions.Filter-v4]
type = "bgp-flowspec-v4"
destination = "detected"
rt-redirect-asn = "64512:10"

# Generates IPv6 FlowSpec if IPv6 host over 100 Mbps
[actions.Filter-v6]
type = "bgp-flowspec-v6" # Generates IPv6 FlowSpec
destination = "detected"
rt-redirect-asn = "64512:10"

[workflows.Emergency]
actions = ["Blackhole-v4", "Blackhole-v6"]
[[workflows.Emergency.trigger]]
type = "host-bits-per-second"
limit = "100 G"
# Once traffic is blackholed upstream we won't have samples, so we
# want our blackhole actions to stay in effect for a set duration
min-action-time = "10 minutes"

# Does a blackhole announcement for the detected IPv4 addresses's /24
[actions.Blackhole-v4]
type = "bgp-v4"
destination = "detected"
aggregate = 24
next-hop = "192.0.2.0"
communities = [
   "BLACKHOLE", # 65535:666
]

# Does a blackhole announcement for the detected IPv6 addresses's /48
[actions.Blackhole-v6]
type = "bgp-v6"
destination = "detected"
aggregate = 48
next-hop = "100::1"
communities = [
   "BLACKHOLE", # 65535:666
]