Wanguard 6.2 User Guide
Appendix 4 – Network Integration Guideline for Wanguard Filter
Appendix 4 – Network Integration Guideline for Wanguard Filter
This appendix describes how to configure the network for traffic scrubbing by
Wanguard Filter,
starting from
a couple of common deployment scenarios of the filtering server.
Wanguard Filter, hereby referred simply as
Filter
, can be deployed following two scenarios:
●
In-line filtering
.
This deployment scenario can have two possible implementations, depending on the
role of the filtering server on the forwarding path:
◦
Routing mode
◦
Bridging mode
●
Out-of-line filtering
.
Due to the complexity of the
Out-of-line filtering
solution, this appendix will
further focus on this setup.
When the
Out-of-line filtering
solution is deployed, then the following two major operations have to be
considered, operations that have to be performed from network point of view:
1.
Traffic diversion
– how the traffic for a certain destination (
IP-Victim
) is diverted from network to the
filtering server
2.
Traffic forwarding
or
Re-injection
– how the cleaned traffic is put back on network to be routed /
forwarded towards its destination (
IP-Victim
)
The information provided here regarding router configurations is for informational purposes only. Please
refer to the appropriate router user guides for more detailed and up-to-date information.
Understanding the Traffic Diversion Method
The method relies on a basic routing principle implemented on all routers according to which a router
selects the path with the longest prefix match present on routing table (also known as the “most specific” entry from
routing table).
BGP has been chosen as routing protocol to inject/advertise the most specific redirect-prefix (e.g. a /32 for
IPv4, a /128 for IPv6) towards
Internet Border Router (IBR).
The IBR is the router which assures routing between ISP
and the internal network (customer network).
To simplify, we will consider an
IPv4-Victim
. In this case,
Filter
sends a BGP routing update towards IBR for
IPv4-Victim
/32 with a next-hop to itself forcing in this way the IBR to choose the path to
IPv4-Victim
via
Filter
. The
main condition for this to work is to have the redirect announcement to be the best from BGP election process and
from
Routing-Table Manager (RTM).
If on the routing-table there is already a /32 present, then additional configuration have to be made in order
to assure that redirect-announcement will be inserted into the routing table and used to deciding the forwarding
path.
Please refer to the following logical diagram which describes the high-level process of detection-diversion-
cleaning and re-injection.
- 112 -
Summary of Contents for wanguard 6.2
Page 1: ......
