Scrubbing Service Example

This example shows one way to provide an automatically triggered scrubbing service to customers outside your network. The Customer router sends flow data for Zone ID 42 (i.e, the prefixes attached to this Zone are the customer's public IPs). When any problems are observed with the customer, a redirect is issued for the containing /24. The actual host under attack is sent to the filter equipment, and the rest of the traffic is returned in a tunnel.

Deployment

TOML Configuration

[[mapping]]
# By default do nothing
group-id-recursive = 0
workflows = []

[[mapping]]
# Override the defaults for this zone-id.
zone-id = 42
workflows = ["Remote"]

[workflows.Remote]
# When this workflow triggers, ALL actions are evaluated
actions = [
   "Redirect-v4",
   "Redirect-v6",
   "Filter-v4",
   "Filter-v6",
]
# Always redirect for at least 5 minutes.
# Gives time to shake things out and de-bounce.
min-action-time = "5 minutes"
# Either of these triggers will start the workflow.
[[workflows.Remote.trigger]]
type = "host-bits-per-second"
limit = "100 M"
[[workflows.Remote.trigger]]
type = "host-tcp-syn-packets-per-second"
limit = "1_000"

[actions.Redirect-v4]
# If we're announcing a single host, announce the containing /24 instead so
# that it can go out to the internet.
type = "bgp-v4"
destination = "detected"
next-hop = "192.0.2.0"
aggregate = 24

[actions.Redirect-v6]
# If we're announcing a single host, announce the containing /48 instead so
# that it can go out to the internet.
type = "bgp-v6"
destination = "detected"
next-hop = "2001:db8::1"
aggregate = 48

[actions.Filter-v4]
type = "bgp-flowspec-v4"
destination = "detected"
rt-redirect-asn = "64512:10"

[actions.Filter-v6]
type = "bgp-flowspec-v6"
destination = "detected"
rt-redirect-asn = "64512:10"