No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

NE20E-S2 V800R010C10SPC500 Configuration Guide - Security 01

This is NE20E-S2 V800R010C10SPC500 Configuration Guide - Security
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Configuring Static BGP VPNv4 Flow Specification

Configuring Static BGP VPNv4 Flow Specification

Static BGP VPNv4 Flow Specification allows BGP VPNv4 Flow Specification routes to be transmitted and traffic filtering policies to be generated. The policies improve security of devices in VPNs.

Usage Scenario

To deploy static BGP VPNv4 Flow Specification, a BGP VPN Flow Specification route needs to be created manually first. After the BGP-Flow VPNv4 address family is enabled, a BGP VPNv4 Flow Specification route is generated automatically. Then a BGP VPNv4 Flow Specification peer relationship needs be established between the device on which the BGP VPN Flow Specification route is created and the network ingress device to transmit the BGP VPNv4 Flow Specification route.

In an AS with multiple ingresses, a BGP VPNv4 Flow route reflector (Flow RR) can be deployed to reduce the number of BGP VPN Flow Specification peer relationships and save CPU resources.

Pre-configuration Tasks

Before configuring static BGP VPNv4 Flow Specification, complete the following tasks:

  • Configure BGP peer relationships.
  • Enable the BGP-Flow VPN instance IPv4 address family.

Procedure

  1. Generate a BGP VPN Flow Specification route manually.
    1. Run system-view

      The system view is displayed.

    2. Run flow-route flowroute-name vpn-instance vpn-instance-name

      A static BGP VPN Flow Specification route is created, and the Flow-Route VPN instance view is displayed.

      One BGP VPN Flow Specification route can include multiple if-match and apply clauses. The if-match clauses define filtering rules, and the apply clauses specify actions. The relationships between if-match clauses and between apply clauses are as follows:
      • The relationship between if-match clauses of different types is "AND".

      • If you configure the same if-match clause multiple times, the latest configuration overrides the previous ones.

      • The relationship between apply clauses is "AND".

      All traffic matching if-match filtering rules must be filtered with the actions specified by apply clauses.

    3. Based on the characteristics of the traffic to be controlled, choose one or multiple if-match clauses as the filtering rule.

      • To configure a filtering rule based on the destination address, run the if-match destination ipv4-address { mask | mask-length } command.

        NOTE:

        If the BGP VPN Flow Specification route carrying a filtering rule specified by the if-match destination command fails to be authenticated by the remote BGP VPN Flow Specification peer, run the peer validation-disable command to cancel the authentication.

        By default, 0.0.0.0/0 is used as the prefix of each BGP VPN Flow Specification route that matches the export or import policy of a peer. To enable a device to change the prefix of each BGP VPN Flow Specification route that matches the export or import policy of a peer to the destination IP address specified in the if-match destination command, run the route match-destination command.

      • To configure a filtering rule based on the source address, run the if-match source ipv4-address { mask | mask-length } command.

      • To configure a filtering rule based on the port number, run the if-match port operator port command.

      • To configure a filtering rule based on the source port number, run the if-match source-port operator port command.

      • To configure a filtering rule based on the destination port number, run the if-match destination-port operator port command.

        NOTE:

        if-match port and if-match destination-port or if-match source-port are mutually exclusive.

      • To configure a filtering rule based on the protocol that bears the traffic, run the if-match protocol operator protocol command.

      • To configure a filtering rule based on the service type, run the if-match dscp operator dscp command.

      • To configure a filtering rule based on the TCP flag, run the if-match tcp-flags { match | not } tcp-flags command.

        Network attackers may send a large number of invalid TCP packets to attack network devices. To control invalid TCP packets to ensure communication security, configure a filtering rule based on the TCP flag for the BGP VPN Flow Specification route using the if-match tcp-flags command. Traffic matching the TCP flag is filtered or controlled using the actions specified in the apply clauses.

      • To configure a filtering rule based on the fragment type, run the if-match fragment-type { match | not } fragment-type-name command.

      • To configure a filtering rule based on the code of an ICMP packet, run the if-match icmp-code operator icmp-code command.

      • To configure a filtering rule based on the type of an ICMP packet, run the if-match icmp-type { greater-than | less-than | equal } icmp-type command.

      • To configure a filtering rule based on the packet-length, run the if-match packet-length { greater-than | less-than | equal } packet-length-value command.

    4. Run the following command as required to configure actions for apply clauses:

      • To discard the traffic, run the apply deny command.

      • To redirect the traffic, run the apply redirect { vpn-target vpn-target-import | ip redirect-ip-rt } command.

        NOTE:

        After the peer redirect ip command is run, the device can process the redirected next hop configured using the apply redirect ip redirect-ip-rt command run on the peer device.

      • To redefine the service type, run the apply remark-dscp command.

      • To limit the traffic rate, run the apply traffic-rate command.

      NOTE:

      The apply deny and apply traffic-rate commands are mutually exclusive.

      If the configured BGP VPN Flow Specification route attribute does not need to take effect locally, run the routing-table rib-only [ route-policy route-policy-name | route-filter route-filter-name ] command to disable the device from delivering the BGP VPN Flow Specification route to the FES forwarding table.

    5. Run commit

      The configuration is committed.

  2. Establish a BGP VPNv4 Flow Specification peer relationship.
    1. Run system-view

      The system view is displayed.

    2. Run bgp as-number

      The BGP view is displayed.

    3. Run peer ipv4-address as-number as-number

      An IP address and AS number are specified for the peer.

    4. Run ipv4-flow vpnv4

      The BGP-Flow VPNv4 address family is enabled, and its view is displayed.

    5. Run peer ipv4-address enable

      A BGP VPNv4 Flow Specification peer relationship is established.

    6. Run commit

      The configuration is committed.

  3. (Optional) Configure a Flow RR.
    1. Run system-view

      The system view is displayed.

    2. Run bgp as-number

      The BGP view is displayed.

    3. Run ipv4-flow vpnv4

      The BGP-Flow VPNv4 address family is enabled, and its view is displayed.

    4. Run peer ipv4-address reflect-client

      A Flow RR and its client are configured.

      The router on which the peer reflect-client command is run functions as the Flow RR, and its peers function as clients.

    5. (Optional) Run undo reflect between-clients

      By default, route reflection among clients through the RR is enabled.

      If the clients of a Flow RR have established full-mesh connections with each other, run the undo reflect between-clients command to disable route reflection between these clients through the RR. This can reduce the link cost.

    6. (Optional) Run reflector cluster-id cluster-id

      A cluster ID is configured for the Flow RR.

      If there are multiple Flow RRs in a cluster, use this command to set the same cluster ID for these Flow RRs.

      The reflector cluster-id command is applicable only to Flow RRs.

    7. Run commit

      The configuration is committed.

  4. (Optional) Set the redirection next-hop attribute ID for BGP VPNv4 Flow Specification routes.

    The redirection next-hop attribute ID can be 0x010C (ID defined in a relevant RFC) or 0x0800 (ID defined in a relevant draft). If a Huawei device needs to communicate with a non-Huawei device that does not support the redirection next-hop attribute ID of 0x010C or 0x0800, set the redirection next-hop attribute ID of BGP VPNv4 Flow Specification routes as required.

    • Set the redirection next-hop attribute ID to 0x010C (ID defined in a relevant RFC) for BGP VPNv4 Flow Specification routes.

      1. Run system-view

        The system view is displayed.

      2. Run bgp as-number

        The BGP view is displayed.

      3. Run ipv4-flow vpnv4

        The BGP-Flow VPNv4 address family is enabled, and its view is displayed.

      4. Run peer ipv4-address redirect ip rfc-compatible

        The redirection next-hop attribute ID is set to 0x010C (ID defined in a relevant RFC) for BGP VPNv4 Flow Specification routes.

      5. Run commit

        The configuration is committed.

    • Set the redirection next-hop attribute ID to 0x0800 (ID defined in a relevant draft) for BGP VPNv4 Flow Specification routes.

      1. Run system-view

        The system view is displayed.

      2. Run bgp as-number

        The BGP view is displayed.

      3. Run ipv4-flow vpnv4

        The BGP-Flow VPNv4 address family is enabled, and its view is displayed.

      4. Run peer ipv4-address redirect ip draft-compatible

        The redirection next-hop attribute ID is set to 0x0800 (ID defined in a relevant draft) for BGP VPNv4 Flow Specification routes.

      5. Run commit

        The configuration is committed.

Checking the Configurations

When the preceding configuration is complete, you can run the following commands to verify the configurations.

  • Run the display bgp flow vpnv4 all peer [ [ ipv4-address ] verbose ] command to check information about all BGP VPN Flow Specification peers and BGP VPNv4 Flow Specification peers.

  • Run the display bgp flow vpnv4 { all | route-distinguisher route-distinguisher } routing-table [ reindex ] command to check information about all BGP VPN Flow Specification routes and BGP VPNv4 Flow Specification routes or the BGP VPN Flow Specification routes and BGP VPNv4 Flow Specification routes with a specified RD.

  • Run the display bgp flow vpnv4 { all | route-distinguisher route-distinguisher } routing-table statistics command to check statistics about all BGP VPN Flow Specification routes and BGP VPNv4 Flow Specification routes or the BGP VPN Flow Specification routes and BGP VPNv4 Flow Specification routes with a specified RD.

# Run the display bgp flow vpnv4 all peer [ [ ipv4-address ] verbose ] command to view whether BGP VPNv4 Flow Specification peer relationships are established.

<HUAWEI> display bgp flow vpnv4 all peer
 
 BGP local router ID : 10.2.1.2
 Local AS number : 200
 Total number of peers : 1                 Peers in established state : 1

  Peer            V          AS  MsgRcvd  MsgSent  OutQ  Up/Down       State  PrefRcv
  10.2.1.1        4         200     1042     1051     0 15:07:49 Established        0

# Run the display bgp flow vpnv4 { all | route-distinguisher route-distinguisher } routing-table [ reindex ] command to view information about BGP VPNv4 Flow Specification routes.

<HUAWEI> display bgp flow vpnv4 all routing-table 536870913
 
 BGP local router ID : 10.2.1.2
 Local AS number : 200
 ReIndex : 536870913
 Order   : 0
 Dissemination Rules :
   Src. Port      : eq 159
 
 BGP flow-vpnv4 routing table entry information of 536870913:
 Route Distinguisher: 200:1
 Match action :
   apply deny
 From: 0.0.0.0 (0.0.0.0) 
 Route Duration: 0d00h02m53s
 Ext-Community: RT <111 : 1>
 AS-path Nil, origin igp, MED 0, pref-val 0, valid, local, best, pre 255
 Advertised to such 1 peers:
    10.2.1.1

# Run the display bgp flow vpnv4 { all | route-distinguisher route-distinguisher } routing-table statistics command on the network ingress to view statistics about the BGP VPNv4 Flow Specification routes received from a specified BGP VPNv4 Flow Specification peer.

<HUAWEI> display bgp flow vpnv4 route-distinguisher 200:1 routing-table statistics
 Route Distinguisher: 200:1
 
 Total Number of Routes: 1
Translation
Download
Updated: 2019-01-02

Document ID: EDOC1100055397

Views: 19675

Downloads: 39

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next