{"id":2135,"date":"2018-07-30T18:30:48","date_gmt":"2018-07-30T11:30:48","guid":{"rendered":"https:\/\/www.routecloud.net\/blog\/?p=2135"},"modified":"2018-07-30T22:02:41","modified_gmt":"2018-07-30T15:02:41","slug":"konfigurasi-bgp-flowspec-dengan-gobgp","status":"publish","type":"post","link":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/","title":{"rendered":"Konfigurasi BGP Flowspec dengan GoBGP"},"content":{"rendered":"<p>BGP Flowspec merupakan salah satu solusi yang digunakan untuk mitigasi serangan berjenis DDoS (DDoS mitigation solution) yang dispesifikasi pada RFC 5575. Ide dibalik RFC tersebut adalah menggunakan BGP route untuk meng-advertise detail informasi mengenai serangan yang dilancarkan attacker. Informasi Flow Specification di encoding ke dalam Multi-Protocol BGP NLRI.<\/p>\n<p>Ada beberapa matching rules yang bisa dipakai sebagai\u00a0 Flow Specification seperti :<\/p>\n<p><a href=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png\"><img loading=\"lazy\" class=\"wp-image-2138 aligncenter\" src=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png\" alt=\"\" width=\"274\" height=\"217\" srcset=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png 913w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria-300x238.png 300w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria-768x610.png 768w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria-200x159.png 200w\" sizes=\"(max-width: 274px) 100vw, 274px\" \/><\/a><\/p>\n<p>Ketika ada trafik yang identik dengan flowspec NLRI, tahap selanjutnya yaitu memberi\u00a0action terahadap traffic tersebut, beberapa actioan yang dapat dieksekusi antara lain :<!--more--><\/p>\n<p><a href=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/traffic_action.png\"><img loading=\"lazy\" class=\" wp-image-2139 aligncenter\" src=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/traffic_action.png\" alt=\"\" width=\"477\" height=\"146\" srcset=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/traffic_action.png 821w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/traffic_action-300x92.png 300w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/traffic_action-768x235.png 768w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/traffic_action-200x61.png 200w\" sizes=\"(max-width: 477px) 100vw, 477px\" \/><\/a><!--more--><\/p>\n<p>Untuk mendemonstrasikan kegunaan BGP flowspec, kita akan melakukan test LAB dengan menggunakan topologi seperti berikut:<\/p>\n<p><a href=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/topo_flowspec.png\"><img loading=\"lazy\" class=\" wp-image-2145 aligncenter\" src=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/topo_flowspec.png\" alt=\"\" width=\"404\" height=\"433\" srcset=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/topo_flowspec.png 901w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/topo_flowspec-280x300.png 280w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/topo_flowspec-768x823.png 768w, https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/topo_flowspec-187x200.png 187w\" sizes=\"(max-width: 404px) 100vw, 404px\" \/><\/a><\/p>\n<p>Topologi diatas terdiri dari 2 AS Number yaitu AS 64000(attacker ) dan AS 65000(victim).\u00a0Alur dari topologi diatas yaitu attacker melakukan serangan kepada Victim, ketika paket DDoS\u00a0 sampai di router edge 2 paket akan di examine based on matching creteria yang sudah didefinisakan, jika paket match maka traffic akan di redirect ke dirty VPRN 100 menuju Scrubbing Center, dan akan diforward keluar dari scrubbing center menuju router Edge 2 GRT (Global Routing Table), oleh edge 2 paket diteruskan ke victim\/customer.\u00a0Posting ini berfokus pada jenis serangan Network attacker ya bukan pada Application attacker.<\/p>\n<p>Software yang digunakan pada LAB ini antara lain:<\/p>\n<ul>\n<li>GNS3 v2.1.8<\/li>\n<li>GoBGP v1.3.3<\/li>\n<li>Nokia vSR\u00a0TiMOS-B-15.0.R5<\/li>\n<li>Scrubbing center disimulasikan dengan\u00a0vSR router dengan tujuan hanya untuk memforward packet.<\/li>\n<\/ul>\n<p>Basic configuration setiap router bisa bisa dilihat pada listing berikut :<\/p>\n<div class=\"responsive-tabs\">\n<h2 class=\"tabtitle\">Edge1<\/h2>\n<div class=\"tabcontent\">\n\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true\" title=\"Edge1\">A:edge1# admin display-config  \r\n# TiMOS-B-15.0.R5 both\/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia.\r\n# All rights reserved. All use subject to applicable license agreements.\r\n# Built on Wed Sep 27 14:53:19 PDT 2017 by builder in \/builds\/150B\/R5\/panos\/main\r\n\r\n# Generated TUE JAN 30 01:41:28 2018 UTC\r\n\r\nexit all\r\nconfigure\r\n#--------------------------------------------------\r\necho \"System Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        name \"edge1\"\r\n        time\r\n            sntp\r\n                shutdown\r\n            exit\r\n            zone UTC \r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"System Security Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        security\r\n            per-peer-queuing\r\n            dist-cpu-protection\r\n                policy \"_default-access-policy\" create\r\n                exit\r\n                policy \"_default-network-policy\" create\r\n                exit\r\n            exit\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Log Configuration\"\r\n#--------------------------------------------------\r\n    log \r\n    exit \r\n#--------------------------------------------------\r\necho \"Card Configuration\"\r\n#--------------------------------------------------\r\n    card 1\r\n        card-type iom-xp\r\n        mda 1\r\n            mda-type c5-1gb-xp-sfp    \r\n            no shutdown\r\n        exit\r\n        no shutdown\r\n    exit\r\n#--------------------------------------------------\r\necho \"Port Configuration\"\r\n#--------------------------------------------------\r\n    port 1\/1\/1\r\n        shutdown\r\n        ethernet\r\n        exit\r\n    exit\r\n    port 1\/1\/2\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/3\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/4                        \r\n        shutdown\r\n        ethernet\r\n        exit\r\n    exit\r\n    port 1\/1\/5\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n#--------------------------------------------------\r\necho \"System Sync-If-Timing Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        sync-if-timing\r\n            begin\r\n            commit\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Management Router Configuration\"\r\n#--------------------------------------------------\r\n    router management\r\n    exit                              \r\n\r\n#--------------------------------------------------\r\necho \"Router (Network Side) Configuration\"\r\n#--------------------------------------------------\r\n    router Base\r\n        interface \"system\"\r\n            address 1.1.1.1\/32\r\n            no shutdown\r\n        exit\r\n        interface \"to-edge2\"\r\n            address 114.0.1.1\/30\r\n            port 1\/1\/2\r\n            no shutdown\r\n        exit\r\n        autonomous-system 64000\r\n    exit\r\n\r\n#--------------------------------------------------\r\necho \"Service Configuration\"\r\n#--------------------------------------------------\r\n    service\r\n        customer 1 create\r\n            description \"Default customer\"\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Router (Service Side) Configuration\"\r\n#--------------------------------------------------\r\n    router Base\r\n#--------------------------------------------------\r\necho \"Policy Configuration\"\r\n#--------------------------------------------------\r\n        policy-options\r\n            begin\r\n            prefix-list \"advertise_ip\"\r\n                prefix 1.1.1.1\/32 exact\r\n                prefix 172.16.10.0\/30 exact\r\n            exit\r\n            policy-statement \"adv_ip\"\r\n                entry 10\r\n                    from              \r\n                        prefix-list \"advertise_ip\"\r\n                    exit\r\n                    action accept\r\n                    exit\r\n                exit\r\n            exit\r\n            commit\r\n        exit\r\n#--------------------------------------------------\r\necho \"BGP Configuration\"\r\n#--------------------------------------------------\r\n        bgp\r\n            group \"ebgp\"\r\n                family ipv4\r\n                export \"adv_ip\" \r\n                peer-as 65000\r\n                split-horizon\r\n                neighbor 114.0.1.2\r\n                    local-address 114.0.1.1\r\n                exit\r\n            exit\r\n            no shutdown\r\n        exit                          \r\n    exit\r\n\r\n\r\nexit all\r\n\r\n# Finished TUE JAN 30 01:41:30 2018 UTC\r\nA:edge1#<\/pre>\n\n<\/div><h2 class=\"tabtitle\">Edge2<\/h2>\n<div class=\"tabcontent\">\n\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true \" title=\"Edge2\">A:edge2# This terminal has been idle for 15 minutes\r\nIt will be logged out if it remains idle for another 15 minutes\r\nA:edge2# admin display-config \r\n# TiMOS-B-15.0.R5 both\/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia.\r\n# All rights reserved. All use subject to applicable license agreements.\r\n# Built on Wed Sep 27 14:53:19 PDT 2017 by builder in \/builds\/150B\/R5\/panos\/main\r\n\r\n# Generated TUE JAN 30 01:34:02 2018 UTC\r\n\r\nexit all\r\nconfigure\r\n#--------------------------------------------------\r\necho \"System Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        name \"edge2\"\r\n        time\r\n            sntp\r\n                shutdown\r\n            exit\r\n            zone UTC \r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"System Security Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        security\r\n            per-peer-queuing\r\n            dist-cpu-protection\r\n                policy \"_default-access-policy\" create\r\n                exit\r\n                policy \"_default-network-policy\" create\r\n                exit\r\n            exit\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Log Configuration\"\r\n#--------------------------------------------------\r\n    log \r\n    exit \r\n#--------------------------------------------------\r\necho \"Card Configuration\"\r\n#--------------------------------------------------\r\n    card 1\r\n        card-type iom-xp\r\n        mda 1\r\n            mda-type c5-1gb-xp-sfp    \r\n            no shutdown\r\n        exit\r\n        no shutdown\r\n    exit\r\n#--------------------------------------------------\r\necho \"Port Configuration\"\r\n#--------------------------------------------------\r\n    port 1\/1\/1\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/2\r\n        ethernet\r\n            mode access\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/3\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit                              \r\n    port 1\/1\/4\r\n        ethernet\r\n            mode access\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/5\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n#--------------------------------------------------\r\necho \"System Sync-If-Timing Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        sync-if-timing\r\n            begin\r\n            commit\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Management Router Configuration\"\r\n#--------------------------------------------------\r\n    router management\r\n    exit\r\n\r\n#--------------------------------------------------\r\necho \"Router (Network Side) Configuration\"\r\n#--------------------------------------------------\r\n    router Base\r\n        interface \"system\"\r\n            address 2.2.2.2\/32\r\n            no shutdown\r\n        exit\r\n        interface \"to-clean-interface\"\r\n            address 114.0.2.1\/30      \r\n            port 1\/1\/5\r\n            no shutdown\r\n        exit\r\n        interface \"to-gobgp\"\r\n            address 114.0.6.1\/30\r\n            port 1\/1\/3\r\n            no shutdown\r\n        exit\r\n        interface \"to-pe\"\r\n            address 114.0.4.1\/30\r\n            port 1\/1\/1\r\n            no shutdown\r\n        exit\r\n        autonomous-system 65000\r\n#--------------------------------------------------\r\necho \"OSPFv2 Configuration\"\r\n#--------------------------------------------------\r\n        ospf 0\r\n            area 0.0.0.0\r\n                interface \"system\"\r\n                    no shutdown\r\n                exit\r\n                interface \"to-pe\"     \r\n                    interface-type point-to-point\r\n                    no shutdown\r\n                exit\r\n            exit\r\n            no shutdown\r\n        exit\r\n    exit\r\n\r\n#--------------------------------------------------\r\necho \"Service Configuration\"\r\n#--------------------------------------------------\r\n    service\r\n        customer 1 create\r\n            description \"Default customer\"\r\n        exit\r\n        ies 1 customer 1 create\r\n            interface \"to-edge1\" create\r\n            exit\r\n        exit\r\n        vprn 100 customer 1 create\r\n            interface \"dirty\" create\r\n            exit\r\n        exit                          \r\n        ies 1 customer 1 create\r\n            interface \"to-edge1\" create\r\n                address 114.0.1.2\/30\r\n                sap 1\/1\/2 create\r\n                exit\r\n            exit\r\n            no shutdown\r\n        exit\r\n        vprn 100 customer 1 create\r\n            route-distinguisher 2.2.2.2:100\r\n            vrf-target target:65000:100\r\n            interface \"dirty\" create\r\n                address 192.168.10.1\/30\r\n                sap 1\/1\/4 create\r\n                exit\r\n            exit\r\n            static-route-entry 0.0.0.0\/0\r\n                next-hop 192.168.10.2\r\n                    no shutdown\r\n                exit                  \r\n            exit\r\n            no shutdown\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Router (Service Side) Configuration\"\r\n#--------------------------------------------------\r\n    router Base\r\n#--------------------------------------------------\r\necho \"OSPFv2 Configuration\"\r\n#--------------------------------------------------\r\n        ospf 0\r\n            no shutdown\r\n        exit\r\n#--------------------------------------------------\r\necho \"Policy Configuration\"\r\n#--------------------------------------------------\r\n        policy-options\r\n            begin\r\n            prefix-list \"advertise-ip\"\r\n                prefix 2.2.2.2\/32 exact\r\n            exit\r\n            policy-statement \"adv-ip\"\r\n                entry 10\r\n                    from\r\n                        prefix-list \"advertise-ip\"\r\n                    exit\r\n                    action accept\r\n                    exit\r\n                exit\r\n            exit\r\n            commit\r\n        exit\r\n#--------------------------------------------------\r\necho \"BGP Configuration\"\r\n#--------------------------------------------------\r\n        bgp\r\n            group \"ebgp\"              \r\n                family ipv4\r\n                peer-as 64000\r\n                split-horizon\r\n                neighbor 114.0.1.1\r\n                    local-address 114.0.1.2\r\n                exit\r\n            exit\r\n            group \"ibgp\"\r\n                family ipv4 vpn-ipv4\r\n                type internal\r\n                neighbor 5.5.5.5\r\n                    next-hop-self\r\n                exit\r\n            exit\r\n            group \"flowspec\"\r\n                family flow-ipv4\r\n                type internal\r\n                neighbor 114.0.6.2\r\n                exit\r\n            exit\r\n            no shutdown\r\n        exit\r\n    exit                              \r\n\r\n\r\nexit all\r\n\r\n# Finished TUE JAN 30 01:34:06 2018 UTC\r\nA:edge2#<\/pre>\n\n<\/div><h2 class=\"tabtitle\">PE<\/h2>\n<div class=\"tabcontent\">\n\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true \" title=\"PE\">A:pe# This terminal has been idle for 15 minutes\r\nIt will be logged out if it remains idle for another 15 minutes\r\nA:pe# \r\nA:pe# admin display-config \r\n# TiMOS-B-15.0.R5 both\/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia.\r\n# All rights reserved. All use subject to applicable license agreements.\r\n# Built on Wed Sep 27 14:53:19 PDT 2017 by builder in \/builds\/150B\/R5\/panos\/main\r\n\r\n# Generated TUE JAN 30 01:36:34 2018 UTC\r\n\r\nexit all\r\nconfigure\r\n#--------------------------------------------------\r\necho \"System Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        name \"pe\"\r\n        time\r\n            sntp\r\n                shutdown\r\n            exit\r\n            zone UTC \r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"System Security Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        security\r\n            per-peer-queuing\r\n            dist-cpu-protection\r\n                policy \"_default-access-policy\" create\r\n                exit\r\n                policy \"_default-network-policy\" create\r\n                exit\r\n            exit\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Log Configuration\"\r\n#--------------------------------------------------\r\n    log \r\n    exit \r\n#--------------------------------------------------\r\necho \"Card Configuration\"\r\n#--------------------------------------------------\r\n    card 1\r\n        card-type iom-xp\r\n        mda 1\r\n            mda-type c5-1gb-xp-sfp    \r\n            no shutdown\r\n        exit\r\n        no shutdown\r\n    exit\r\n#--------------------------------------------------\r\necho \"Port Configuration\"\r\n#--------------------------------------------------\r\n    port 1\/1\/1\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/2\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/3\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n    port 1\/1\/4                        \r\n        shutdown\r\n        ethernet\r\n        exit\r\n    exit\r\n    port 1\/1\/5\r\n        ethernet\r\n        exit\r\n        no shutdown\r\n    exit\r\n#--------------------------------------------------\r\necho \"System Sync-If-Timing Configuration\"\r\n#--------------------------------------------------\r\n    system\r\n        sync-if-timing\r\n            begin\r\n            commit\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Management Router Configuration\"\r\n#--------------------------------------------------\r\n    router management\r\n    exit                              \r\n\r\n#--------------------------------------------------\r\necho \"Router (Network Side) Configuration\"\r\n#--------------------------------------------------\r\n    router Base\r\n        interface \"system\"\r\n            address 5.5.5.5\/32\r\n            no shutdown\r\n        exit\r\n        interface \"to-client\"\r\n            address 192.168.70.1\/30\r\n            port 1\/1\/5\r\n            no shutdown\r\n        exit\r\n        interface \"to-edge2\"\r\n            address 114.0.4.2\/30\r\n            port 1\/1\/1\r\n            no shutdown\r\n        exit\r\n        autonomous-system 65000\r\n#--------------------------------------------------\r\necho \"OSPFv2 Configuration\"\r\n#--------------------------------------------------\r\n        ospf 0\r\n            area 0.0.0.0\r\n                interface \"system\"\r\n                    no shutdown\r\n                exit\r\n                interface \"to-edge2\"\r\n                    interface-type point-to-point\r\n                    no shutdown\r\n                exit\r\n            exit\r\n            no shutdown\r\n        exit\r\n    exit\r\n\r\n#--------------------------------------------------\r\necho \"Service Configuration\"\r\n#--------------------------------------------------\r\n    service\r\n        customer 1 create\r\n            description \"Default customer\"\r\n        exit\r\n    exit\r\n#--------------------------------------------------\r\necho \"Router (Service Side) Configuration\"\r\n#--------------------------------------------------\r\n    router Base\r\n#--------------------------------------------------\r\necho \"OSPFv2 Configuration\"\r\n#--------------------------------------------------\r\n        ospf 0\r\n            no shutdown\r\n        exit\r\n#--------------------------------------------------\r\necho \"Policy Configuration\"\r\n#--------------------------------------------------\r\n        policy-options\r\n            begin\r\n            prefix-list \"advertise_ip\"\r\n                prefix 5.5.5.5\/32 exact\r\n                prefix 192.168.70.0\/30 exact\r\n            exit\r\n            policy-statement \"adv-ip\"\r\n                entry 10\r\n                    from\r\n                        prefix-list \"advertise_ip\"\r\n                    exit              \r\n                    action accept\r\n                    exit\r\n                exit\r\n            exit\r\n            commit\r\n        exit\r\n#--------------------------------------------------\r\necho \"BGP Configuration\"\r\n#--------------------------------------------------\r\n        bgp\r\n            group \"iBGP\"\r\n                family ipv4 vpn-ipv4\r\n                type internal\r\n                export \"adv-ip\" \r\n                neighbor 2.2.2.2\r\n                exit\r\n            exit\r\n            no shutdown\r\n        exit\r\n    exit\r\n\r\n\r\nexit all                              \r\n\r\n# Finished TUE JAN 30 01:36:36 2018 UTC<\/pre>\n<\/div><\/div>\n<p><strong>Konfigurasi GoBGP<\/strong><\/p>\n<p>GoBGP adalah aplikasi open source yang dapat digunakan untuk mengerate macam-macam route bgp seperti Flowspec, EVPN, BMP, dll. GoBGP berjalan diatas linux OS dan dapat diinstall dengan mengunduh paket binary release dari <a href=\"https:\/\/github.com\/osrg\/gobgp\/releases\/\">Github<\/a>. Ketika paket sudah di extract, terdapat dua file didalamnya yaitu <strong>gobgpd<\/strong> dan <strong>gobgp<\/strong>. Selanjutnya buat file konfigurasi dasar yang berisi informasi neighbor, AS number, tipe route, dan router-id dengan perintah <em>vi nama_file_konfigurasi.conf.<\/em><\/p>\n<p><em>\u00a0<\/em><\/p>\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true\" title=\"GoBGP in CentOS\">[root@gobgp ~]# cat flowspec.conf\r\n[global.config]\r\n  as = 65000\r\n  router-id = \"114.0.6.2\"\r\n\r\n[[neighbors]]\r\n[neighbors.config]\r\n  neighbor-address = \"114.0.6.1\"\r\n  peer-as = 65000\r\n[[neighbors.afi-safis]]\r\n  [neighbors.afi-safis.config]\r\n  afi-safi-name = \"ipv4-flowspec\"\r\n\r\n[root@gobgp ~]#<\/pre>\n<p>Selanjutnya eksekusi file konfigurasi dengan perintah:<\/p>\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true \" title=\"Gobgp\">[root@gobgp ~]# .\/gobgpd -f flowspec.conf \r\n{\"level\":\"info\",\"msg\":\"gobgpd started\",\"time\":\"2018-07-30T02:36:45-04:00\"}\r\n{\"Topic\":\"Config\",\"level\":\"info\",\"msg\":\"Finished reading the config file\",\"time\":\"2018-07-30T02:36:45-04:00\"}\r\n{\"level\":\"info\",\"msg\":\"Peer 114.0.6.1 is added\",\"time\":\"2018-07-30T02:36:45-04:00\"}\r\n{\"Topic\":\"Peer\",\"level\":\"info\",\"msg\":\"Add a peer configuration for:114.0.6.1\",\"time\":\"2018-07-30T02:36:45-04:00\"}<\/pre>\n<p>Hasilnya router edge 2 dan gobgp akan membuat session bgp family flowspec-ipv4 seperti berikut :<\/p>\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true \" title=\"Edge 2\">A:edge2#\r\n---&lt;output-omitted&gt;---\r\n===============================================================================\r\nBGP Summary\r\n===============================================================================\r\nLegend : D - Dynamic Neighbor\r\n===============================================================================\r\nNeighbor\r\nDescription                           \r\n                   AS PktRcvd InQ  Up\/Down   State|Rcv\/Act\/Sent (Addr Family)\r\n                      PktSent OutQ\r\n-------------------------------------------------------------------------------\r\n5.5.5.5\r\n               65000      385    0 03h10m58s 2\/1\/3 (IPv4)\r\n                          387    0           0\/0\/2 (VpnIPv4)\r\n114.0.1.1\r\n               64000      388    0 03h11m56s 3\/3\/1 (IPv4)\r\n                          389    0           \r\n114.0.6.2\r\n               65000        5    0 00h00m01s 0\/0\/0 (FlowIPv4)\r\n                            6    0           \r\n-------------------------------------------------------------------------------\r\nA:edge2#<\/pre>\n<p><strong>Adding Flowspec Route<\/strong><\/p>\n<p>Route criteria yang akan dibuat disini adalah matching destination ip victim (192.168.70.2\/30) dengan action Redirect ke dirty VPRN dan akan diteruskan ke scrubbing center.<\/p>\n<p>Perintah yang akan digunakan untuk add route pada GoBGP adalah sebagai berikut :<\/p>\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true\" title=\"GoBGP\">[root@gobgp ~]#.\/gobgp global rib -a ipv4-flowspec add match destination 192.168.70.2\/32 then redirect 65000:100\r\n<\/pre>\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true \" title=\"edge 2\">A:edge2&gt;config&gt;service&gt;vprn# show router bgp routes flow-ipv4 \r\n===============================================================================\r\n BGP Router ID:2.2.2.2          AS:65000       Local AS:65000      \r\n===============================================================================\r\n Legend -\r\n Status codes  : u - used, s - suppressed, h - history, d - decayed, * - valid\r\n                 l - leaked, x - stale, &gt; - best, b - backup, p - purge\r\n Origin codes  : i - IGP, e - EGP, ? - incomplete\r\n\r\n===============================================================================\r\nBGP FLOW IPV4 Routes\r\n===============================================================================\r\nFlag  Network             Nexthop                 LocalPref       MED\r\n      As-Path                                                     \r\n-------------------------------------------------------------------------------\r\nu*&gt;?  --                  0.0.0.0                 100             None\r\n      No As-Path\r\n                                                                  \r\n      Community Action:  redirect-to-vrf:65000:100\r\n      NLRI Subcomponents:                                         \r\n      Dest Pref : 192.168.70.2\/32\r\n-------------------------------------------------------------------------------\r\nRoutes : 1\r\n===============================================================================\r\nA:edge2&gt;<\/pre>\n<p>Flow specification tersebut akan diimplementasikan di interface IES yang terkoneksi dengan edge1, pada router nokia implementasi flowspec dilakukan pada ip-filter, disini akan dibuat ip-filter dengan id 100 seperti dibawah ini :<\/p>\n<pre class=\"theme:github font:consolas height-set:true toolbar:1 lang:default decode:true \" title=\"edge 2\">A:edge2# configure filter ip-filter 100 create \r\nA:edge2&gt;config&gt;filter&gt;ip-filter# info \r\n----------------------------------------------\r\n            default-action forward\r\n            embed-filter flowspec router \"Base\"\r\n----------------------------------------------\r\nA:edge2&gt;config&gt;filter&gt;ip-filter#<\/pre>\n<p>default-action yang digunakan adalah forward, artinya jika ada traffic yang tidak matching dengan flow-spec maka akan diallow, command <em>embed-filter flowspec router &#8220;Base&#8221;\u00a0<\/em>artinya menerapkan flow specification pada router Base (Global Routing Table).<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>BGP Flowspec merupakan salah satu solusi yang digunakan untuk mitigasi serangan berjenis DDoS (DDoS mitigation solution) yang dispesifikasi pada RFC 5575. Ide dibalik RFC tersebut adalah menggunakan BGP route untuk meng-advertise detail informasi mengenai serangan yang dilancarkan attacker. Informasi Flow Specification di encoding ke dalam Multi-Protocol BGP NLRI. Ada beberapa matching rules yang bisa dipakai [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[18],"tags":[110,186,187],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v18.5.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Konfigurasi BGP Flowspec dengan GoBGP - Routecloud Indonesia - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Konfigurasi BGP Flowspec dengan GoBGP - Routecloud Indonesia - Blog\" \/>\n<meta property=\"og:description\" content=\"BGP Flowspec merupakan salah satu solusi yang digunakan untuk mitigasi serangan berjenis DDoS (DDoS mitigation solution) yang dispesifikasi pada RFC 5575. Ide dibalik RFC tersebut adalah menggunakan BGP route untuk meng-advertise detail informasi mengenai serangan yang dilancarkan attacker. Informasi Flow Specification di encoding ke dalam Multi-Protocol BGP NLRI. Ada beberapa matching rules yang bisa dipakai [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/\" \/>\n<meta property=\"og:site_name\" content=\"Routecloud Indonesia - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2018-07-30T11:30:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-07-30T15:02:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png\" \/>\n<meta name=\"twitter:card\" content=\"summary\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Khoirul Firdaus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/#organization\",\"name\":\"Routecloud Indonesia\",\"url\":\"https:\/\/www.routecloud.net\/blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2017\/03\/logo_routecloud_horz_2x_b.png\",\"contentUrl\":\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2017\/03\/logo_routecloud_horz_2x_b.png\",\"width\":400,\"height\":80,\"caption\":\"Routecloud Indonesia\"},\"image\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/#website\",\"url\":\"https:\/\/www.routecloud.net\/blog\/\",\"name\":\"Routecloud Indonesia - Blog\",\"description\":\"Share Your Knowledge\",\"publisher\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.routecloud.net\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png\",\"contentUrl\":\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png\",\"width\":913,\"height\":725},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#webpage\",\"url\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/\",\"name\":\"Konfigurasi BGP Flowspec dengan GoBGP - Routecloud Indonesia - Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#primaryimage\"},\"datePublished\":\"2018-07-30T11:30:48+00:00\",\"dateModified\":\"2018-07-30T15:02:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.routecloud.net\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Konfigurasi BGP Flowspec dengan GoBGP\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/#\/schema\/person\/65c2305ace9e3d312c02a2b9c73e8fc1\"},\"headline\":\"Konfigurasi BGP Flowspec dengan GoBGP\",\"datePublished\":\"2018-07-30T11:30:48+00:00\",\"dateModified\":\"2018-07-30T15:02:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#webpage\"},\"wordCount\":426,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png\",\"keywords\":[\"BGP\",\"flowspec\",\"gobgp\"],\"articleSection\":[\"Network and Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/#\/schema\/person\/65c2305ace9e3d312c02a2b9c73e8fc1\",\"name\":\"Khoirul Firdaus\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.routecloud.net\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/57c39ad9e93a4c2694e7e4f645bc26f4?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/57c39ad9e93a4c2694e7e4f645bc26f4?s=96&d=mm&r=g\",\"caption\":\"Khoirul Firdaus\"},\"description\":\"Network Telco Engineer - SDN\/NFV Enthusiast\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/khoirulf\/\"],\"url\":\"https:\/\/www.routecloud.net\/blog\/author\/irul\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Konfigurasi BGP Flowspec dengan GoBGP - Routecloud Indonesia - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/","og_locale":"en_US","og_type":"article","og_title":"Konfigurasi BGP Flowspec dengan GoBGP - Routecloud Indonesia - Blog","og_description":"BGP Flowspec merupakan salah satu solusi yang digunakan untuk mitigasi serangan berjenis DDoS (DDoS mitigation solution) yang dispesifikasi pada RFC 5575. Ide dibalik RFC tersebut adalah menggunakan BGP route untuk meng-advertise detail informasi mengenai serangan yang dilancarkan attacker. Informasi Flow Specification di encoding ke dalam Multi-Protocol BGP NLRI. Ada beberapa matching rules yang bisa dipakai [&hellip;]","og_url":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/","og_site_name":"Routecloud Indonesia - Blog","article_published_time":"2018-07-30T11:30:48+00:00","article_modified_time":"2018-07-30T15:02:41+00:00","og_image":[{"url":"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png"}],"twitter_card":"summary","twitter_misc":{"Written by":"Khoirul Firdaus","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.routecloud.net\/blog\/#organization","name":"Routecloud Indonesia","url":"https:\/\/www.routecloud.net\/blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.routecloud.net\/blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2017\/03\/logo_routecloud_horz_2x_b.png","contentUrl":"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2017\/03\/logo_routecloud_horz_2x_b.png","width":400,"height":80,"caption":"Routecloud Indonesia"},"image":{"@id":"https:\/\/www.routecloud.net\/blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.routecloud.net\/blog\/#website","url":"https:\/\/www.routecloud.net\/blog\/","name":"Routecloud Indonesia - Blog","description":"Share Your Knowledge","publisher":{"@id":"https:\/\/www.routecloud.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.routecloud.net\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#primaryimage","inLanguage":"en-US","url":"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png","contentUrl":"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png","width":913,"height":725},{"@type":"WebPage","@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#webpage","url":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/","name":"Konfigurasi BGP Flowspec dengan GoBGP - Routecloud Indonesia - Blog","isPartOf":{"@id":"https:\/\/www.routecloud.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#primaryimage"},"datePublished":"2018-07-30T11:30:48+00:00","dateModified":"2018-07-30T15:02:41+00:00","breadcrumb":{"@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.routecloud.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Konfigurasi BGP Flowspec dengan GoBGP"}]},{"@type":"Article","@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#article","isPartOf":{"@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#webpage"},"author":{"@id":"https:\/\/www.routecloud.net\/blog\/#\/schema\/person\/65c2305ace9e3d312c02a2b9c73e8fc1"},"headline":"Konfigurasi BGP Flowspec dengan GoBGP","datePublished":"2018-07-30T11:30:48+00:00","dateModified":"2018-07-30T15:02:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#webpage"},"wordCount":426,"commentCount":0,"publisher":{"@id":"https:\/\/www.routecloud.net\/blog\/#organization"},"image":{"@id":"https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#primaryimage"},"thumbnailUrl":"https:\/\/www.routecloud.net\/blog\/wp-content\/uploads\/2018\/07\/matching_criteria.png","keywords":["BGP","flowspec","gobgp"],"articleSection":["Network and Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.routecloud.net\/blog\/konfigurasi-bgp-flowspec-dengan-gobgp\/#respond"]}]},{"@type":"Person","@id":"https:\/\/www.routecloud.net\/blog\/#\/schema\/person\/65c2305ace9e3d312c02a2b9c73e8fc1","name":"Khoirul Firdaus","image":{"@type":"ImageObject","@id":"https:\/\/www.routecloud.net\/blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/57c39ad9e93a4c2694e7e4f645bc26f4?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/57c39ad9e93a4c2694e7e4f645bc26f4?s=96&d=mm&r=g","caption":"Khoirul Firdaus"},"description":"Network Telco Engineer - SDN\/NFV Enthusiast","sameAs":["https:\/\/www.linkedin.com\/in\/khoirulf\/"],"url":"https:\/\/www.routecloud.net\/blog\/author\/irul\/"}]}},"_links":{"self":[{"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/posts\/2135"}],"collection":[{"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/comments?post=2135"}],"version-history":[{"count":17,"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/posts\/2135\/revisions"}],"predecessor-version":[{"id":2161,"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/posts\/2135\/revisions\/2161"}],"wp:attachment":[{"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/media?parent=2135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/categories?post=2135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.routecloud.net\/blog\/wp-json\/wp\/v2\/tags?post=2135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}