bgp nlri flowspec

Pre-Alpha. This page describes behavior that may change.

BGP FlowSpec (RFC 8955) for IPv4 and IPv6, plus the VPN variants. Carries traffic filtering rules instead of routing information.

Category

Address families.

Configuration

plugin {
    internal nlri-flowspec { use bgp-nlri-flowspec }
}

bgp {
    peer upstream-flowspec {
        family {
            ipv4/flow     { prefix { maximum 1000; } }
            ipv6/flow     { prefix { maximum 1000; } }
            ipv4/flow-vpn { prefix { maximum 1000; } }
            ipv6/flow-vpn { prefix { maximum 1000; } }
        }
    }
}

Behaviour

The plugin encodes and decodes all four FlowSpec families: IPv4 (AFI 1 / SAFI 133), IPv6 (AFI 2 / SAFI 133), and the two VPN variants (SAFI 134). Rules carry a set of match conditions (source prefix, destination prefix, protocol, port ranges, TCP flags, ICMP types) and traffic actions (drop, rate-limit, redirect to VRF).

FlowSpec rules are what you advertise to upstream providers for remote-triggered blackholing and traffic scrubbing. The FlowSpec injection blueprint has a worked example.

Interactions

• Supports both encode and decode for all four families.
• Interacts with the BGP Role plugin for per-peer FlowSpec trust boundaries.

Source

main/internal/component/bgp/plugins/nlri/flowspec/