Wanguard 6.2 User Guide
Configuration » Components » Quagga / ExaBGP Connector
Configuration » Components » Quagga / ExaBGP Connector
Wanguard Sensor and Wanguard Filter can send and withdraw BGP announcements (advertisements,
routing updates) automatically using Response actions (detailed on page 27), in the following cases:
To protect your network by announcing DDoSed destinations to the upstream provider(s) using a special
BGP community. Your side will no longer route the attacked addresses making them effectively null-
routed by your BGP peers. This network protection technique is called blackhole routing, null-routing or
RTBH (Remote Triggered Black Hole).
To re-route attacked destinations through servers running Wanguard Filter, block attackers' packets and
re-inject cleaned traffic back into the network. This network protection technique is called traffic
scrubbing, clean pipe, side filtering or sinkhole routing.
To leverage BGP FlowSpec for RTBH and/or traffic diversion.
To announce the attacking IP in BGP when S/RTBH is available.
Console users can view, send and withdraw BGP announcements manually from Reports » Tools » BGP
Operations » <Black Hole> or <Divert Traffic>. The logs are stored in Reports » Tools » BGP Operations » BGP
Announcement Archive.
If you do not need any of those features, you can safely skip this chapter.
Wanguard supports two different back ends for dealing with BGP announcements:
●
Quagga
provides a mature and widely used BGP daemon that closely resembles existing closed-source
platforms like IOS. This is the recommended back end if support for BGP FlowSpec is not needed.
●
ExaBGP
is a Python-based tool, typically used outside of the data plane to do path manipulation on a
BGP network that may be composed of closed-source components. ExaBGP already supports newer
technologies such as FlowSpec, although it is still under heavy development.
BGP Connector
is a front end to an existing Quagga BGPd or ExaBGP configuration . BGP Connectors are used
solely to announce IPs, subnets or FlowSpec rules to a previously configured back end, using the parameters from
their configuration (route map, community, etc.).
Install and configure Quagga BGPd (or ExaBGP if your network supports FlowSpec), before adding a BGP
Connector. Most BGP-related configuration steps are listed on Appendix 3 – page 109 and on Appendix 4 – page 112.
To add a BGP Connector, click the <+> button from the title bar of the Configuration » Components panel. To
modify an existing BGP Connector, go to Configuration » Components and click its name.
- 51 -
Summary of Contents for wanguard 6.2
Page 1: ......
