Abstract

Flowspec is an extension to BGP that allows for the dissemination of traffic flow specification rules. This has many possible applications but the primary one for many network operators is the distribution of traffic filtering actions for DDoS mitigation. The flow-spec standard RFC5575 [2] defines a redirect-to-VRF action for policy-based forwarding but this mechanism is not always sufficient, particularly if the redirected traffic needs to be steered into an engineered path or into a service plane. This document defines a new extended community known as redirect-to- indirection-id (32-bit) flowspec action to provide advanced redirection capabilities on flowspec clients. When activated, the flowspec extended community is used by a flowspec client to find the correct next-hop entry within a localised indirection-id mapping table. The functionality present in this draft allows a network controller to decouple flowspec functionality from the creation and maintainance of the network's service plane itself including the setup of tunnels and other service constructs that could be managed by other network devices.

Authors

Gunter Van de Velde (gunter.van_de_velde@nokia.com)
Wim Henderickx (wim.henderickx@nokia.com)
Keyur Patel (keyupate@cisco.com)
Arjun Sreekantiah (asreekan@cisco.com)
Zhenbin Li (lizhenbin@huawei.com)
Shunwan Zhuang (zhuangshunwan@huawei.com)
Nan Wu (eric.wu@huawei.com)

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)