LPTS EPFT feature

记录一下LPTS EPFT这个feature, LPTS是用来保护Cisco XR 设备CPU的,防止一些ARP/DHCP/DNS/ICMP 等攻击流量punt 到板卡的CPU,那LPTS EPFT这个feature使能后会对这些流量进行一些监控, 超过一定速率就会进行一些惩罚。

配置:

RP/0/RSP0/CPU0:ASR9006-M#show run lpts punt excessive-flow-trap
Fri Jan 29 16:42:08.014 UTC
lpts punt excessive-flow-trap
 penalty-rate arp 100
 penalty-timeout arp 1
 subscriber-interfaces
 non-subscriber-interfaces

对那些流量进行监控:

RP/0/RSP0/CPU0:ASR9006-M#show lpts punt excessive-flow-trap  information 
Fri Jan 29 16:02:59.820 UTC

--------------------------------------------------------------
              Police         Penalty
              Rate (pps)     Timeout (mins)
 Protocol   Default Config   Default Config   Punt Reasons
 --------   --------------   --------------   ----------------
 ARP           10     -         15     -      ARP
                                              Reverse ARP
                                              Dynamic ARP Inspection (DAI)

 ICMP          10     -         15     -      ICMP
                                              ICMP-local
                                              ICMP-app
                                              ICMP-control
                                              ICMP-default

 DHCP          10     -         15     -      DHCP Snoop Request
                                              DHCP Snoop Reply
                                              DHCP Broadcast

 PPPOE         10     -         15     -      PPP over Ethernet (PPPoE)
                                              PPPoE packets for RSP
                                              PPPoE packet/config mismatch
                                              PPPoE packet/config mismatch for RSP

 PPP           10     -         15     -      Point-to-Point Protocol (PPP)
                                              PPP packets for RSP

 IGMP          10     -         15     -      IGMP
                                              IGMP Snoop
                                              MLD snooping

 IPv4/v6       10     -         15     -      IP Subscriber (IPSUB)
                                              IPv4 options
                                              IPv4 FIB
                                              IPv4 TTL exceeded
                                              IPv4 fragmentation needed
                                              IPv4/v6 adjacency
                                              IPV4/v6 unknown IFIB
                                              UDP-known
                                              UDP-listen
                                              IPv4 tunnel not configred
                                              UDP-default
                                              TCP-known
                                              TCP-listen
                                              TCP-cfg-peer
                                              TCP-default
                                              Raw-listen
                                              Raw-default

 L2TP          10     -         15     -      Layer 2 Tunneling Protocol, version 2 (L2TPv2)
                                              L2TPv2-default
                                              L2TPv2-known
                                              L2TPv3

 UNCLASSIFIED      10     -         15     -      Unclassified packets
                                              Unclassified packets for RSP

 OSPF           0     -         15     -      OSPF-mc-known
                                              OSPF-mc-default
                                              OSPF-uc-known
                                              OSPF-uc-default

 BGP            0     -         15     -      BGP-known
                                              BGP-cfg-peer
                                              BGP-default

超过多少速率会被惩罚:

这个监控是基于一种采样算法的, 计算方式如下:(计算公式中有三个参数可调)。也就是说默认速率为1000 packet / 800ms, 可满足一些正常的ARP、SSH DHCP的流量。

100(sample 0.01) x 2(pick 2 packet) x 5(5 times) = 1000 packets/ 800ms

RP/0/RSP0/CPU0:ASR9006-M#run attach 0/0/cpu0
Fri Jan 29 16:17:36.395 UTC
attach: Starting session 1 to node 0/0/cpu0
# spp_ui
spp-ui> copp table

Eviction threshold:      2              <<< change by "lpts punt exces eviction-threshold <>"
Report threshold:        5              <<< change by "lpts punt exces report-threshold <>"
Max-IPG:                 800            <<< change by "lpts punt exce max-flow-gap <>"

惩罚方式

主接口

对于主而言,超过速率惩罚措施为15分钟内来自某MAC地址的流量均被DROP,会有如下log显示

这里的问题在于,如下我们下联设备误PING了, 由于ICMP的速率可能会达到2500pps, 和容易处罚该惩罚, 这样就会造成从peer接口过来的流量会被全部drop, 如果起了路由协议,路由协议也会中断。

RP/0/RP1/CPU0:CORE6-ASR9922-A#show logging | in TRAP
Wed Jan 13 07:39:01.788 UTC
LC/0/1/CPU0:Jan 13 06:48:24.362 : flowtrap[196]: %OS-FLOWTRAP-4-BAD_ACTOR_MAC_DETECTED : Excessive ICMP-app flow detected from source MAC address 78ba.f96b.eb82 on interface TenGigE0/1/0/1. Traffic from this MAC address will be dropped for 15 minutes.
子接口

对于子接口而言, 超过速率惩罚措施为15分钟内流量会被限制为 10pps , 有如下log 显示

这个惩罚为, 出方向所有流量都被限速10pps, 入方向所有for us 的流量被限速10pps(穿越流量不受)。

LC/0/0/CPU0:Jan 12 00:35:58.370 CST: flowtrap[217]: %OS-FLOWTRAP-4-BAD_ACTOR_INTF_DETECTED : Excessive ICMP-app flow detected on interface TenGigE0/0/0/3.38032178. The interface will be penalty-policed at 10 pps for 15 minutes. 

默认限速是10pps, 可以使用命令“lpts punt excessive-flow-trap penalty-rate xx”修改

默认惩罚时间是15min, 可以使用命令lpts punt excessive-flow-trap penalty-timeout xx 修改

           

No comments

Comments feed for this article

Reply

Your email address will not be published.