Basic Offramp Scrubbing Deployment

Introduction

With RioRey Director, you can perform out-of-band detection and redirection of traffic. In the example configuration below, the RIOS filter device no longer sits between the edge and the Internet as it was in the inline example, but is moved inside the network. Director is configured to receive flow samples from the edge router and send it BGP messages. Director processes incoming flow samples (mapping them to the Groups and Zones configured in rWeb) and now indirectly serves the role of detector (previously performed by the inline RIOS device).

Basic Design

Components

rWeb

An rWeb appliance is deployed as the main interface for on-premise configuration, reporting, and coordination. rWeb manages both the RIOS and Director components. Network prefixes are defined centrally in rWeb, and then used for traffic configuration, reporting, and limiting of Director actions.

RIOS

RIOS can be deployed in its offramp location either as a VM or as a Hardware appliance.

Edge Router

As the device first in path to observe traffic from the Internet, the Edge Router should be configured to generate flow data on observed traffic and send it to Director. Any router should be supported as long as it can generate sFlow, Netflow, or IPFIX sample data for Director to consume.

Director

Director consumes flow sample data from the Edge Router and issues BGP or BGP FlowSpec announcements to steer traffic when appropriate.

Workflows are used to monitor traffic and take action based on traffic entering the Edge Router. Each workflow should be configured to trigger at the point where incoming traffic reaches an abnormal level with an appropriate matching action. In this setup, smaller levels of attack traffic are sent to RIOS for filtering, whereas larger traffic volumes are blackholed outright.

Once traffic redirection becomes necessary, Director automatically detects the minimal set of destinations that are under attack. If the attacker pivots to new destinations, those are automatically redirected as well.

Example Configuration

Director

When traffic to a given host exceeds 100M, a BGP FlowSpec announcement is made to redirect traffic for that host through a VRF that is cleaned by a RIOS filter device. If traffic to a Zone is detected as exceeding 100G, Director will instead make a Black Hole announcement for all relevant prefixes associated with that Zone, preventing huge amounts of attack traffic from clogging your upstream transit.

This is only one such example, but the flexible configuration of Director allows you to specify this and many other detection and redirection behaviors, tailored to your network. Some example scenarios and their accompanying configuration are available here.

[[mapping]]
group-id-recursive = 0 # Matches every zone
workflows = [
   "Scrub",
   "Emergency",
]

[workflows.Scrub]
actions = ["Filter-v4", "Filter-v6"]
[[workflows.Scrub.trigger]]
type = "host-bits-per-second"
limit = "100 M"

# Generates IPv4 FlowSpec if IPv4 host over 100 Mbps
[actions.Filter-v4]
type = "bgp-flowspec-v4"
destination = "detected"
rt-redirect-asn = "64512:10"

# Generates IPv6 FlowSpec if IPv6 host over 100 Mbps
[actions.Filter-v6]
type = "bgp-flowspec-v6" # Generates IPv6 FlowSpec
destination = "detected"
rt-redirect-asn = "64512:10"


[workflows.Emergency]
actions = ["Blackhole-v4", "Blackhole-v6"]
# Once traffic is blackholed upstream we won't have samples, so we
# want our blackhole actions to stay in effect for a set duration
min-action-time = "10 minutes"

[[workflows.Emergency.trigger]]
type = "zone-bits-per-second"
limit = "100 G"

# The following actions blackhole the entire zone as we've set a 
# zone-based trigger for our 'Emergency' workflow

# Does a blackhole announcement for the detected IPv4 addresses's /24
[actions.Blackhole-v4]
type = "bgp-v4"
destination = "detected"
aggregate = 24
next-hop = "192.0.2.0"
communities = [
   "BLACKHOLE", # 65535:666
]

# Does a blackhole announcement for the detected IPv6 addresses's /48
[actions.Blackhole-v6]
type = "bgp-v6"
destination = "detected"
aggregate = 48
next-hop = "100::1"
communities = [
   "BLACKHOLE", # 65535:666
]