Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Install and configure DDoS edge protection

Updated: June 12, 2026

Want to summarize with AI?

Install the Cisco Secure DDoS Edge Protection application through the DDoS edge protection controller and configure the router with the required UDF, Loopback, ACL, SSH, and TPA settings to enable controller-managed threat detection and mitigation.

Use this procedure to install the DDoS edge protection detector on the router using the DDoS edge protection controller, and to configure all required router settings that enable the controller to monitor traffic and enforce mitigation.

Before you begin

Before you begin:

Configure the management interface to reach the DDoS controller IP address.
Manually configure the base ACL, NetFlow, and SSH configurations.

Also review the restrictions in DDoS edge protection restrictions before proceeding.

Procedure

	1.	Install and download the DDoS edge protection controller software package. Download the controller software package from the Software Download page. After the controller installation is complete, you can access the user interface. Log in to the controller services instance to monitor, manage, and control the device. For more information on installing the DDoS controller, see the Cisco Secure DDoS Edge Protection Installation Guide.
	2.	Configure loopback interfaces on the router. Example: `Router(config)# interface Loopback100 Router(config-if)# ipv4 address 15.1.1.2 255.255.255.255 Router(config-if)# exit Router(config)# interface Loopback101 Router(config-if)# ipv4 address 17.1.1.2 255.255.255.255 Router(config-if)# commit`
	3.	Configure an ACL on the router. Example: `Router(config)# ipv4 access-list myACL Router(config-ipv4-acl)# 1301 permit ipv4 any any Router(config-ipv4-acl)# exit Router(config)# ipv6 access-list myACL Router(config-ipv6-acl)# 1301 permit ipv6 any any Router(config-ipv6-acl)# exit Router(config)# commit` The first 1301 entries are reserved for DDoS mitigation purposes. When a DDoS attack is detected, the controller automatically enforces deny ACL rules to block malicious traffic. The following is a sample configuration that the controller uses to deny attacker traffic: `1 deny udp any eq 19 host 45.0.0.1 eq 0 packet-length eq 128 ttl eq 64 2 deny tcp any host 45.0.0.1 eq www match-all -established -fin -psh +syn -urg packet-length eq 60 ttl eq 64 1301 permit ipv4 any any` For more information on implementing access lists, see Understanding Access-List.
	4.	Configure SSH on the router. Example: `Router(config)# ssh server v2 Router(config)# ssh server netconf Router(config)# netconf agent tty Router(config-netconf-tty)# netconf-yang agent ssh Router(config)# ssh timeout 120 Router(config)# ssh server rate-limit 600 Router(config)# ssh server session-limit 110 Router(config)# ssh server vrf default Router(config)# ssh server netconf vrf default Router(config)# commit`
	5.	Configure TPA on the router. Note TPA configuration is not required for Cisco 8000 routers. This step applies to NCS 5500 platforms only. Reload the router after configuring the `hw-module profile`. Example: `Router(config)# tpa Router(config-tpa)# linux networking Router(config-tpa-vrf)# vrf default Router(config-tpa-vrf)# east-west Loopback101 Router(config-tpa-vrf)# address-family ipv4 Router(config-tpa-vrf-afi)# default-route software-forwarding Router(config-tpa-vrf-afi)# source-hint default-route interface Loopback100`
	6.	Run the ping command to verify router connectivity to the DDoS edge protection controller. Example: Router# ping 10.105.237.54 Thu Jun 1 07:16:43.654 UTC Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.105.237.54 timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/4 ms RP/0/RP0/CPU0:Router# bash [Router:~]$ ping 10.105.237.54 PING 10.105.237.54 (10.105.237.54) 56(84) bytes of data. 64 bytes from 10.105.237.54: icmp_seq=1 ttl=63 time=1.73 ms 64 bytes from 10.105.237.54: icmp_seq=2 ttl=63 time=1.29 ms 64 bytes from 10.105.237.54: icmp_seq=3 ttl=63 time=1.27 ms 4 packets transmitted, 4 received, 0% packet loss, time 3004ms rtt min/avg/max/mdev = 1.270/1.510/1.751/0.230 ms A 100% success rate in the ping output confirms that the router can reach the DDoS controller IP address. If pings fail, check the management interface configuration and routing.
	7.	Enter the device details into the DDoS edge protection controller panel and verify that the Deployment, Container, and Configuration indicators all display green.

After completing this procedure, the controller automatically applies the following NetFlow configuration on the router to enable traffic sampling and export to the detector container:

// Configuring Monitor Map
flow monitor-map DetectPro_Monitor_IPV6
 record ipv6 extended
 exporter DetectPro_GPB
 cache entries 1000000
 cache timeout active 1
 cache timeout inactive 1
 cache timeout rate-limit 1000000
!
flow monitor-map DetectPro_Monitor_IPV4
 record ipv4 extended
 exporter DetectPro_GPB
 cache entries 1000000
 cache timeout active 1
 cache timeout inactive 1
 cache timeout rate-limit 1000000
!
// Configuring Monitor Map MPLS (Release 25.2.1 and later)
flow monitor-map mon_mpls_ipv4_ipv6
 record mpls ipv4-ipv6-fields
 exporter DetectPro_MPLS
 cache entries 1000000
 cache timeout active 1
 cache timeout inactive 1
 cache timeout rate-limit 1000000
!
// Configuring Exporter Map
flow exporter-map DetectPro_GPB
 version protobuf
 transport udp 5005
 source TenGigE0/0/0/16
 destination 15.1.1.2
!
// Configuring Exporter Map MPLS (Release 25.2.1 and later)
flow exporter-map DetectPro_MPLS
 version protobuf
 transport udp 5005
 source loopback101
 destination 15.1.1.2
!
// Configuring Sampler Map
sampler-map DetectPro_NFv9
 random 1 out-of 100
!
// Configuring Interface MPLS (Release 25.2.1 and later)
interface TenGigE0/0/0/8
 ipv4 address 7.7.1.1 255.255.0.0
 flow mpls monitor mon_mpls_ipv4_ipv6 sampler samp_mpls ingress
!

For more information on Cisco Secure DDoS Edge Protection, see the Cisco Secure DDoS Edge Protection Data Sheet.

What to do next

Verify the DDoS edge protection deployment by running the verification procedure. See Verify DDoS edge protection application configuration.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Install and configure DDoS edge protection

Before you begin

Procedure

Example:

Example:

Example:

Example:

Example:

What to do next