Skip to main content

Director Demo as a Deployment Example

Director Demo Landing Page​

Some users may have had a chance to interact with the Director Demo. The demo serves as a small example (being all virtual over 1G links) of how to do an offramp deployment. The landing page for the demo displays all of these components in action:

director_demo.png

Connectivity, Mapping, and Workflows​

The right hand side of the image shows the traffic path from the Internet to an edge router (R1) connected to a core router (R2), that then forwards traffic to the rest of the internal network. A RIOS VM is deployed offramped between R1 and R2, and Director is both receiving flow samples from R1 and in a BGP peer relationship with it. In this simple deployment, two workflows are mapped to all Zones in rWeb:

[[mapping]]
group-id-recursive = 0
workflows = [
    "Scrub",
    "Blackhole",
]

# Sends attacks to RIOS to be scrubbed.
[workflows.Scrub]
actions = ["Redirect", "Notify"]
[[workflows.Scrub.trigger]]
type = "host-bits-per-second"
limit = "50 M"
[[workflows.Scrub.trigger]]
type = "host-packets-per-second"
limit = "50 k"

# Drops large attacks as early as possible.
[workflows.Blackhole]
actions = [ "Blackhole", "Notify"]
[[workflows.Blackhole.trigger]]
type = "host-bits-per-second"
limit = "300 M"

Actions​

In the screenshot above, we launched an attack that triggered the "Scrub" workflow, which caused all of the related actions to activate. In this case, it fired the "Redirect" and "Notify" actions for the selected host (as we created host-based workflow triggers):

  • The "Redirect" action is a BGP Flowspec Action that is offramping the detected host to the RIOS device.
  • The "Notify" action is a Custom Command Action that is posting all of the information about the triggering event to the demo web portal (effectively a webhook), which is what is being used to populate the "Director History" panel in the image above.

If traffic to the host under attack exceeded 300 Mb/s (per our "Blackhole" workflow), the "Blackhole" action would fire as well. As a standard BGP Action, this would identify the /24 prefix containing the offending host and announce it using the blackhole community to R1.

[actions.Redirect]
type = "bgp-flowspec-v4"
destination = "detected"
rt-redirect-asn = "64512:1"

[actions.Blackhole]
type = "bgp-v4"
destination = "detected"
next-hop = "0.0.0.0"
aggregate = 24
local-pref = 200
communities = ["BLACKHOLE",]

[actions.Notify]
type = "command-v4"
path = "/usr/local/bin/director-notify.sh"
format = "text"
timeout = "1 minute"