Describes traffic filtering actions available with BGP flowspec, outlining methods and considerations for controlling, classifying, and managing network traffic using advanced flow specifications.
You use traffic filtering actions to control how IP traffic matching specific flow rules is handled. This topic explains how to specify actions like dropping or policing traffic using BGP flowspec extended communities. Understanding these actions helps you manage network traffic effectively and maintain performance and security.
The default action accepts IP traffic that matches a flow specification rule.
You can change this behavior by applying extended community values that specify different actions.
| Type |
Extended Community | PBR Action | Description |
|---|---|---|---|
| 0x8006 |
traffic-rate 0 traffic-rate <rate> |
Drop Police |
The traffic-rate extended community is a non-transitive extended community across the autonomous-system boundary and uses following extended community encoding: The first two octets carry the 2-octet id, which can be assigned from a 2-byte AS number. When a 4-byte AS number is locally present, the 2 least significant bytes of such an AS number can be used. This value is informational. The remaining 4 octets carry the rate information in IEEE floating point [IEEE.754.1985] format, bytes per second. A traffic-rate of 0 should result on all traffic for the particular flow to be discarded. Command syntax police rate < > | drop |
| 0x8009 |
traffic-marking |
Set DSCP | The traffic marking extended community instructs a system to modify the differentiated service code point (DSCP) bits of a transiting IP packet to the corresponding value. This extended community is encoded as a sequence of 5 zero bytes followed by the DSCP value encoded in the 6 least significant bits of 6th byte. Command syntax set dscp <6 bit value> |
| 0x0800 |
Redirect IP NH |
Redirect IPv4 Nexthop | Announces the reachability of one or more flowspec NLRI. When a BGP speaker receives an UPDATE message with the redirect-to- IP extended community it is expected to create a traffic filtering rule for every flow-spec NLRI in the message that has this path as its best path. The filter entry matches the IP packets described in the NLRI field and redirects them or copies them towards the IPv4 address specified in the Network Address of Next-Hop field of the associated MP_REACH_NLRI.
Command syntax redirect {ipv4 | ipv6} next-hop {ipv4-address | ipv6-address} |
You cannot use the BGP flowspec actions rate limit and redirecttogether.
The redirect action works only with nexthop IPv4 and IPv6 addresses, not with nexthop VRF IPv4 or IPv6.