BGP FlowSpec Configuration for DDoS Filtering

BGP FlowSpec (RFC 8955 for IPv6, originally RFC 5575) turns BGP into a distribution channel for firewall rules. Instead of blackholing an entire IP, a detection system can push a rule that matches a specific attack vector — UDP from source port 53 with a payload larger than 512 bytes, for example — and have every router in the network drop or rate-limit it in the hardware fast path. The result is mitigation in seconds, without collateral damage to legitimate traffic. This guide covers the FlowSpec NLRI components, the actions available, and working configuration for Cisco IOS XR and ExaBGP.

How FlowSpec Differs from RTBH

RTBH is binary: the whole destination stops receiving traffic. FlowSpec carries a match-and-action rule that is compiled into a class-map/policy-map style construct on the receiving routers, so you can filter an attack while the service stays online. FlowSpec also carries an implicit deny-plus-accept semantic: normal BGP route dissemination is unaffected because FlowSpec rules travel as a separate NLRI, and a validation mechanism ensures a FlowSpec rule is only accepted from the peer that is also authorised to announce the matching unicast prefix.

Match Components (NLRI)

• Destination prefix — required, defines what the rule protects.
• Source prefix — match attack origin, or drop spoofed bogon sources.
• IP protocol / next header — TCP, UDP, ICMP, ICMPv6.
• Source and destination ports — single value, range or list; supports numeric operators such as =53, >1024.
• Packet length — the classic amplification filter, for example packet-length >512.
• ICMP type/code, TCP flags, DSCP, fragment bit — all optional match fields.

The action is carried as extended communities: traffic-rate, traffic-action (terminal/sample), redirect to VRF, traffic-marking (DSCP), and traffic-remark for 802.1p. Discard is the default when no action community is present.

Injecting Rules with ExaBGP

neighbor 10.0.0.1 {
    router-id 10.255.0.9;
    local-address 10.255.0.9;
    local-as 65001;
    peer-as 65001;
    family {
        ipv4 flow;
        ipv6 flow;
    }
}

echo "announce flow route { match { destination 203.0.113.10/32;
  source-port =53; protocol udp; packet-length >512; }
  then { discard; } }" | socat - /var/run/exabgp.sock

The withdraw is identical with the leading keyword changed to withdraw flow route. Because ExaBGP exposes a local socket, any detection tool with a few lines of Python can automate the pipeline: detect the vector, build the NLRI, inject, and withdraw when the attack stops.

Receiving FlowSpec on Cisco IOS XR

class-map type traffic match-all FS-DNS-AMP
 match destination-address ipv4 203.0.113.10/32
 match source-port 53
 match protocol udp
 match packet length gt 512
 end-class-map
!
policy-map type pbr FS-POLICY
 class type traffic FS-DNS-AMP
  drop
 !
 class type traffic class-default
 !
 end-policy-map
!
router bgp 65001
 address-family ipv4 flowspec
 !
 neighbor 10.0.0.9
  address-family ipv4 flowspec
   route-policy FLOWSPEC-IN in
  !
 !
!
interface GigabitEthernet0/0/0/1
 service-policy type pbr input FS-POLICY

On IOS XR, FlowSpec requires the PBR service policy to be attached where the filter must run; the rules themselves are generated from the received NLRI and bound to the policy through the flowspec service-policy configuration.

Verification

show bgp ipv4 flowspec
show bgp ipv4 flowspec detail
show flowspec clients
show pbr policy-map FS-POLICY
show policy-map interface GigabitEthernet0/0/0/1 input

Counters on the attached service policy are the ground truth: if the counter does not increment while the attack continues, the rule matched the wrong field (a common error is matching the wrong port direction — a DNS amplification attack matches source port 53, not destination port 53). Always test a new rule against a lab flow before trusting it in production, and keep a per-rule expiry so stale filters cannot silently break a service weeks later.

Related reading: BGP route flap damping explained and IOS XR QoS class-map and policy-map shaping.

原文链接：https://github.com/exa-networks/exabgp/wiki/FlowSpec-Overview