BGP Flow Specification Client

绝地灬酷狼 2024-04-18 19:48 70阅读 0赞

### Chapter Contents ###

The Border Gateway Protocol (BGP) flow specification client feature enables a device to perform the role of a BGP flow specification client and receive flow specification rules from a BGP flow specification controller. Flow specification rules contain a set of match criteria and actions (also called *flows*). The flows are configured on a controller (device), which advertises the flows to the client device, or specific interfaces on the client.

Attention:IOS XE software supports BGP flow specification client function and does not support BGP flow specification controller function.

*  [Finding Feature Information][]
 *  [Prerequisites for BGP Flow Specification Client][]
 *  [Restrictions for BGP Flow Specification Client][]
 *  [Information About BGP Flow Specification Client][]
 *  [How to Configure BGP Flow Specification Client][]
 *  [Configuration Examples for BGP Flow Specification Client][]
 *  [Additional References for BGP Flow Specification Client][]
 *  [Feature Information for BGP Flow Specification Client][]

## Finding Feature Information ##

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see [Bug Search Tool][] and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to [www.cisco.com/go/cfn][www.cisco.com_go_cfn]. An account on Cisco.com is not required.

## Prerequisites for BGP Flow Specification Client ##

* Identify and configure flow specification rules on the controller.
 
 <table> 
 <tbody> 
 <tr> 
 <td>Note</td> 
 <td> 
 <hr>When the flow specification client is enabled, the matching criteria and corresponding actions in the controller’s flows are remotely injected into the client device, and the flows are programmed into the platform hardware of the client device. 
 <hr></td> 
 </tr> 
 </tbody> 
 </table>

## Restrictions for BGP Flow Specification Client ##

*  In Cisco IOS 15.5(S) release, BGP flow specification is supported only on a BGP flow specification client and route reflector.
 *  Mixing of address family matches and actions is not supported in flow specification rules. For example, IPv4 matches cannot be combined with IPv6 actions and vice versa.

Information About BGP Flow Specification Client

## BGP Flow Specification Model ##

The BGP protocol is used for flow specifications due to unique advantages it offers. The three elements that are used to route flow specifications through BGP enabled devices are: controller, client, and route-reflector (which is optional). This document is specific to the client element function.

Though devices with the IOS XE software (such as ASR 1000, and so on) can perform BGP flow specification client role and not the controller role, a brief outline of the BGP flow specification process is given below for better understanding.

The BGP flow specification functionality allows you to rapidly deploy and propagate filtering and policing functionality among a large number of BGP peer devices to mitigate the effects of a distributed denial-of-service (DDoS) attack over your network.

The BGP flow specification model comprises of a client and a controller (route-reflector usage is optional). The controller is responsible for sending or injecting the flow specification NRLI entry. The client (acting as a BGP speaker) receives the NRLI and programs the hardware forwarding to act on the instruction from the controller. An illustration of this model is provided below.

Figure 1. BGP Flow Specification Model  
![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FybWxpbnV4d3c_size_16_color_FFFFFF_t_70][]

In the above topology, the controller on the left-hand side injects the flow specification NRLI into the client on the right-hand side. The client receives the information, sends it to the flow specification manager component, configures the ePBR (Enhanced Policy Based Routing) infrastructure, which in turn programs the platform hardware of the device. This way, you can create rules to handle DDoS attacks on your network.

## Sample Flow Specification Client Configuration ##

First, associate the device to a BGP autonomous system and enable flow specification policy mapping capability for various address families. Then, identify a neighbor (through its IP address) as a BGP peer and enable the capability to exchange information between the devices through theneighbor activate command. This way, flow specification information can be exchanged between the client, controller, and any other flow specification client device.

!
    router bgp 100
     address-family ipv4 flowspec
      neighbor 10.1.1.1 activate
    !

## Matching Criteria and Actions ##

The flow specification NLRI type consists of several optional sub-components. A specific packet is considered to match the flow specification when it matches the intersection (AND) of all the components present in the specification. The following are the supported component types or tuples that you can define:

<table> 
 <thead> 
 <tr> 
 <th> BGP Flowspec NLRI Type </th> 
 <th> QoS Matching Field (IPv6) </th> 
 <th> QoS Matching Field (IPv4) </th> 
 <th> Input Value </th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;"> Type 1 </td> 
 <td style="vertical-align:top;"> IPv6 destination address </td> 
 <td style="vertical-align:top;"> IPv4 destination address </td> 
 <td style="vertical-align:top;"> Prefix length </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 2 </td> 
 <td style="vertical-align:top;"> IPv6 source address </td> 
 <td style="vertical-align:top;"> IPv4 source address </td> 
 <td style="vertical-align:top;"> Prefix length </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 3 </td> 
 <td style="vertical-align:top;"> IPv6 next header </td> 
 <td style="vertical-align:top;"> IPv4 protocol </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 4 </td> 
 <td style="vertical-align:top;"> IPv6 source or destination port </td> 
 <td style="vertical-align:top;"> IPv4 source or destination port </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 5 </td> 
 <td style="vertical-align:top;"> IPv6 destination port </td> 
 <td style="vertical-align:top;"> IPv4 destination port </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 6 </td> 
 <td style="vertical-align:top;"> IPv6 source port </td> 
 <td style="vertical-align:top;"> IPv4 source port </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 7 </td> 
 <td style="vertical-align:top;"> IPv6 ICMP type </td> 
 <td style="vertical-align:top;"> IPv4 ICMP type </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 8 </td> 
 <td style="vertical-align:top;"> IPv6 ICMP code </td> 
 <td style="vertical-align:top;"> IPv4 ICMP code </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 9 </td> 
 <td style="vertical-align:top;"> IPv6 TCP flags </td> 
 <td style="vertical-align:top;"> IPv4 TCP flags (2 bytes include reserved bits) </td> 
 <td style="vertical-align:top;"> Bit mask </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 10 </td> 
 <td style="vertical-align:top;"> IPv6 packet length </td> 
 <td style="vertical-align:top;"> IPv4 packet length </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 11 </td> 
 <td style="vertical-align:top;"> IPv6 traffic class </td> 
 <td style="vertical-align:top;"> IPv4 DSCP </td> 
 <td style="vertical-align:top;"> Multi-value range </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> Type 12 </td> 
 <td style="vertical-align:top;"> Reserved </td> 
 <td style="vertical-align:top;"> IPv4 fragment bits </td> 
 <td style="vertical-align:top;"> Bit mask </td> 
 </tr> 
 </tbody> 
</table>

How to Configure BGP Flow Specification Client

## Configuring a Device As a Flow Specification Client and Establishing a BGP Peer Relationship With Neighbor ##

The following task explains configuration of a device as a BGP flow specification client. A device interface within a VRF instance can also perform the role of a BGP flow specification client.

**Before You Begin**

Before configuring a device as a flow specification client, it is a good practice to identify and configure the flow specification controller device (and a route reflector, if required). When flow specification rules are configured on the controller, the rules are remotely injected into the client and the matching criteria and corresponding actions are programmed into the platform hardware of the client.

**SUMMARY STEPS**

**1.**    enable

**2.**    configure terminal

**3.**    router bgp as-number

**4.**    address-family \{ipv4 | ipv6\} flowspec

**5.**    neighbor ip-address activate

**6.**    exit

**7.**    address-family \{ipv4 | ipv6\} flowspec vrf vrf-name

**8.**    neighbor ip-address remote-as as-number

**9.**    neighbor ip-address activate

**10.**    exit

**DETAILED STEPS**

<table> 
 <tbody> 
 <tr> 
 <th>&nbsp;</th> 
 <th>Command or Action</th> 
 <th>Purpose</th> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;1</td> 
 <td style="vertical-align:top;">enable&nbsp; Example: <pre>Device&gt; enable</pre> </td> 
 <td style="vertical-align:top;"> Enables privileged EXEC mode. 
 <ul> 
 <li><a rel="nofollow"></a>Enter your password if prompted.</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;2</td> 
 <td style="vertical-align:top;">configure terminal&nbsp; Example: <pre>Device# configure terminal </pre> </td> 
 <td style="vertical-align:top;"> Enters global configuration mode </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;3</td> 
 <td style="vertical-align:top;">router bgp&nbsp;as-number&nbsp; Example: <pre>Device(config)# router bgp 100</pre> </td> 
 <td style="vertical-align:top;"> Specifies the autonomous system number and enters the BGP configuration mode, allowing you to configure the BGP routing process. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;4</td> 
 <td style="vertical-align:top;">address-family&nbsp;{ipv4&nbsp;|&nbsp;ipv6}&nbsp;flowspec&nbsp; Example: <pre>Device(config-bgp)# address-family ipv4 flowspec</pre> </td> 
 <td style="vertical-align:top;"> Specifies either the IPv4 or IPv6 address family and enters BGP address family configuration mode, and initializes the global address family for flow specification policy mapping. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;5</td> 
 <td style="vertical-align:top;">neighbor&nbsp;ip-address&nbsp;activate&nbsp; Example: <pre>Device(config-bgp-af)# neighbor 10.1.1.1 activate</pre> </td> 
 <td style="vertical-align:top;"> Places the device in neighbor configuration mode for BGP routing and configures the neighbor IP address as a BGP peer. Enables the device to advertise (and receive information), including its IP address, to its BGP neighbor. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;6</td> 
 <td style="vertical-align:top;">exit&nbsp; Example: <pre>Device(config-bgp-af)# exit</pre> </td> 
 <td style="vertical-align:top;"> Exits BGP address family configuration mode and enters BGP configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;7</td> 
 <td style="vertical-align:top;">address-family&nbsp;{ipv4&nbsp;|&nbsp;ipv6}&nbsp;flowspec&nbsp;vrf&nbsp;vrf-name&nbsp; Example: <pre>Device(config-bgp)# address-family ipv4 flowspec vrf vrf1</pre> </td> 
 <td style="vertical-align:top;"> Specifies either the IPv4 or IPv6 address family for the VRF, enters BGP address family configuration mode, and initializes the global address family for flow specification policy mapping. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;8</td> 
 <td style="vertical-align:top;">neighbor&nbsp;ip-address&nbsp;remote-as&nbsp;as-number&nbsp; Example: <pre>Device(config-bgp-af)# neighbor 2001:DB8:1::1 remote-as 100</pre> </td> 
 <td style="vertical-align:top;"> Places the device in neighbor configuration mode for BGP routing and configures the neighbor (IP address) as a BGP peer. The&nbsp;remote-as&nbsp;keyword assigns the specified remote autonomous system number to the neighbor. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;9</td> 
 <td style="vertical-align:top;">neighbor&nbsp;ip-address&nbsp;activate&nbsp; Example: <pre>Device(config-bgp-af)# neighbor 2001:DB8:1::1 activate</pre> </td> 
 <td style="vertical-align:top;"> Enables the device to advertise (and receive information), including its IP address, to its BGP neighbor. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;10</td> 
 <td style="vertical-align:top;">exit&nbsp; Example: <pre>Device(config-bgp-af)# exit</pre> </td> 
 <td style="vertical-align:top;"> Exits BGP address family configuration mode and enters BGP configuration mode. </td> 
 </tr> 
 </tbody> 
</table>

## Configuring a Flow Specification Policy On All Interfaces Of a Device ##

The following configuration task explains flow specification policy configuration on all interfaces of a device for the IPv4 and IPv6 address families, and on interfaces within a VRF instance.

**SUMMARY STEPS**

**1.**    enable

**2.**    configure terminal

**3.**    flowspec

**4.**    address-family ipv4

**5.**    local-install interface-all

**6.**    exit

**7.**    address-family ipv6

**8.**    local-install interface-all

**9.**    exit

**10.**    vrf vrf-name

**11.**    address-family ipv4

**12.**    local-install interface-all

**13.**    exit

**14.**    address-family ipv6

**15.**    local-install interface-all

**16.**    exit

**DETAILED STEPS**

<table> 
 <tbody> 
 <tr> 
 <th>&nbsp;</th> 
 <th>Command or Action</th> 
 <th>Purpose</th> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;1</td> 
 <td style="vertical-align:top;">enable&nbsp; Example: <pre>Device&gt; enable</pre> </td> 
 <td style="vertical-align:top;"> Enables privileged EXEC mode. 
 <ul> 
 <li><a rel="nofollow"></a>Enter your password if prompted.</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;2</td> 
 <td style="vertical-align:top;">configure terminal&nbsp; Example: <pre>Device# configure terminal </pre> </td> 
 <td style="vertical-align:top;"> Enters global configuration mode </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;3</td> 
 <td style="vertical-align:top;">flowspec&nbsp; Example: <pre>Device(config)# flowspec </pre> </td> 
 <td style="vertical-align:top;"> Enters flowspec configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;4</td> 
 <td style="vertical-align:top;">address-family ipv4&nbsp; Example: <pre>Device(config-flowspec)# address-family ipv4 </pre> </td> 
 <td style="vertical-align:top;"> Specifies the IPv4 address family and enters flow specification address family configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;5</td> 
 <td style="vertical-align:top;">local-install interface-all&nbsp; Example: <pre>Device(config-flowspec-af)# local-install interface-all</pre> </td> 
 <td style="vertical-align:top;"> Installs the flowspec policy on all interfaces. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;6</td> 
 <td style="vertical-align:top;">exit&nbsp; Example: <pre>Device(config-flowspec-af)# exit</pre> </td> 
 <td style="vertical-align:top;"> Exits flow specification address family configuration mode and enters flowspec configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;7</td> 
 <td style="vertical-align:top;">address-family ipv6&nbsp; Example: <pre>Device(config-flowspec)# address-family ipv6 </pre> </td> 
 <td style="vertical-align:top;"> Specifies the IPv6 address family and enters flow specification address family configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;8</td> 
 <td style="vertical-align:top;">local-install interface-all&nbsp; Example: <pre>Device(config-flowspec-af)# local-install interface-all</pre> </td> 
 <td style="vertical-align:top;"> Installs the flowspec policy on all interfaces. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;9</td> 
 <td style="vertical-align:top;">exit&nbsp; Example: <pre>Device(config-flowspec-af)# exit</pre> </td> 
 <td style="vertical-align:top;"> Exits flow specification address family configuration mode and enters flowspec configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;10</td> 
 <td style="vertical-align:top;">vrf&nbsp;vrf-name&nbsp; Example: <pre>Device(config-flowspec)# vrf vrf10</pre> </td> 
 <td style="vertical-align:top;"> Configures a VRF instance and enters flow specification VRF configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;11</td> 
 <td style="vertical-align:top;">address-family ipv4&nbsp; Example: <pre>Device(config-flowspec-vrf)# address-family ipv4 </pre> </td> 
 <td style="vertical-align:top;"> Specifies the IPv4 address family and enters VRF flow specification address family configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;12</td> 
 <td style="vertical-align:top;">local-install interface-all&nbsp; Example: <pre>Device(config-flowspec-vrf-af)# local-install interface-all</pre> </td> 
 <td style="vertical-align:top;"> Installs the flowspec policy on all interfaces. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;13</td> 
 <td style="vertical-align:top;">exit&nbsp; Example: <pre>Device(config-flowspec-vrf-af)# exit</pre> </td> 
 <td style="vertical-align:top;"> Exits VRF flow specification address family configuration mode and enters VRF flow specification configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;14</td> 
 <td style="vertical-align:top;">address-family ipv6&nbsp; Example: <pre>Device(config-flowspec-vrf)# address-family ipv6 </pre> </td> 
 <td style="vertical-align:top;"> Specifies the IPv6 address family and enters VRF flow specification address family configuration mode. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;15</td> 
 <td style="vertical-align:top;">local-install interface-all&nbsp; Example: <pre>Device(config-flowspec-vrf-af)# local-install interface-all</pre> </td> 
 <td style="vertical-align:top;"> Installs the flowspec policy on all interfaces. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>Step&nbsp;16</td> 
 <td style="vertical-align:top;">exit&nbsp; Example: <pre>Device(config-flowspec-vrf-af)# exit</pre> </td> 
 <td style="vertical-align:top;"> Exits VRF flow specification address family configuration mode and enters VRF flow specification configuration mode. </td> 
 </tr> 
 </tbody> 
</table>

## Verifying BGP Flow Specification Client ##

These commands display flow specification configuration details:

**SUMMARY STEPS**

**1.**    show flowspec summary

**2.**    show bgp ipv4 flowspec

**3.**    show flowspec vrf vrf-name afi-all

**DETAILED STEPS**

--------------------

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;">Step&nbsp;1&nbsp;&nbsp;</td> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>show flowspec summary&nbsp; Example: <pre>Device # show flowspec summary

FlowSpec Manager Summary:
Tables: 2
Flows: 1

</pre> Provides a summary of the flow specification rules present on the node. In this example, the&nbsp;Tables&nbsp;field indicates that the flow specification policy mapping capability is enabled for IPv4 and IPv6 address families. The&nbsp;Flows&nbsp;field indicates that a single flow has been defined across the entire table. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;">Step&nbsp;2&nbsp;&nbsp;</td> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>show bgp ipv4 flowspec&nbsp; Example: <pre>Device # show bgp ipv4 flowspec

Dest:192.0.2.0/24, Source:10.1.1.0/24, DPort:&gt;=120&amp;&lt;=130,SPort:&gt;=25&amp;&lt;=30,DSCP:=30/208 BGP routing table entry for Dest:192.0.2.0/24, Source:10.1.1.0/24,Proto:=47,DPort:&gt;=120&amp;&lt;=130,SPort:&gt;=25&amp;&lt;=30,DSCP:=30/208 &lt;snip&gt;
Paths: (1 available, best #1)
  Advertised to update-groups (with more than one peer):
    0.3
  Path #1: Received by speaker 0
  Advertised to update-groups (with more than one peer):
0.3 Local
0.0.0.0 from 0.0.0.0 (3.3.3.3) Origin IGP, localpref 100, valid, redistributed, best, group-best
Received Path ID 0, Local Path ID 1, version 42
Extended community: FLOWSPEC Traffic-rate:100,0

</pre> Use this command to verify if a flow specification rule configured on the flow specification controller (device) is available on the BGP side. In this example,&nbsp;redistributed&nbsp;indicates that the flow specification rule is not internally originated, but one that has been redistributed from the flow specification process to BGP. The extended community (the BGP attribute used to send the match and action criteria to peer devices) that is configured is also displayed. In this example, the action defined is to rate limit the traffic. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;">Step&nbsp;3&nbsp;&nbsp;</td> 
 <td style="vertical-align:top;"><a rel="nofollow"></a>show flowspec vrf&nbsp;vrf-name&nbsp;afi-all&nbsp; Example: <pre>Device # show flowspec vrf vrf100 afi-all

VRF: vrf100     AFI: IPv4
    Flow         :DPort:=101,SPort:=101,TCPFlags:~0xFF,Length:&gt;=100&amp;&lt;=1500,DSCP:=63
    Actions      :Redirect: VRF vrf200 Route-target: ASN2-200:2  (bgp.1)
    Flow         :DPort:=102,SPort:=102,TCPFlags:~0xFF,Length:&gt;=100&amp;&lt;=1500,DSCP:=63
    Actions      :Redirect: VRF vrf200 Route-target: ASN2-200:2  (bgp.1)

</pre> Use this command to verify if a flow specification rule is in a specific VRF associated with the flow specification client (device). </td> 
 </tr> 
 </tbody> 
</table>

--------------------

Configuration Examples for BGP Flow Specification Client

## Example: Configuring a Device As a Flow Specification Client and Establishing a BGP Peer Relationship With Neighbor ##

Device> enable
    Device# configure terminal
    Device (config)# router bgp 100
    Device (config-bgp)# address-family ipv4 flowspec
    Device (config-bgp-af)# neighbor 10.1.1.1 activate
    Device (config-bgp-af)# exit
    Device (config-bgp)# address-family ipv4 flowspec vrf vrf1
    Device (config-bgp-af)# neighbor 2001:DB8:1::1 remote as 100
    Device (config-bgp-af)# neighbor 2001:DB8:1::1 activate
    Device (config-bgp-af)# exit

## Example: Configuring a Flow Specification Policy On All Interfaces Of a Device ##

Device> enable
    Device# configure terminal
    Device(config)# flowspec
    Device(config-flowspec)# address-family ipv4 
    Device(config-flowspec-af)# local-install interface-all
    Device(config-flowspec-af)# exit
    Device(config-flowspec)# address-family ipv6
    Device(config-flowspec-af)# local-install interface-all
    Device(config-flowspec-af)#  exit
    Device(config-flowspec)# vrf vrf10
    Device(config-flowspec-vrf)# address-family ipv4 
    Device(config-flowspec-vrf-af)# local-install interface-all
    Device(config-flowspec-vrf-af)# exit
    Device(config-flowspec-vrf)# address-family ipv6 
    Device(config-flowspec-vrf-af)# local-install interface-all
    Device(config-flowspec-vrf-af)# exit

## Additional References for BGP Flow Specification Client ##

### Related Documents ###

<table> 
 <thead> 
 <tr> 
 <th> Related Topic </th> 
 <th> Document Title </th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;"> Cisco IOS commands </td> 
 <td style="vertical-align:top;"> <a href="http://www.cisco.com/en/US/docs/ios/mcl/allreleasemcl/all_book.html" rel="nofollow">Cisco IOS Master Commands List, All Releases</a> </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> BGP commands </td> 
 <td style="vertical-align:top;"> <a href="http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/command/irg-cr-book.html" rel="nofollow">Cisco IOS IP Routing: BGP Command Reference</a> </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;"> BGP Flow Specification Route-reflector Support </td> 
 <td style="vertical-align:top;"> IP Routing: BGP Configuration Guide </td> 
 </tr> 
 </tbody> 
</table>

### Standards and RFCs ###

<table> 
 <thead> 
 <tr> 
 <th> Standard/RFC </th> 
 <th> Title </th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;"> RFC 5575 </td> 
 <td style="vertical-align:top;"> Dissemination of Flow Specification Rules </td> 
 </tr> 
 </tbody> 
</table>

### MIBs ###

<table> 
 <thead> 
 <tr> 
 <th> MIB </th> 
 <th> MIBs Link </th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>CISCO-MIB</li> 
 </ul></td> 
 <td style="vertical-align:top;"> To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: <a href="http://www.cisco.com/go/mibs" rel="nofollow">http://www.cisco.com/go/mibs</a> </td> 
 </tr> 
 </tbody> 
</table>

### Technical Assistance ###

<table> 
 <thead> 
 <tr> 
 <th> Description </th> 
 <th> Link </th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;"> The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. </td> 
 <td style="vertical-align:top;"> <a href="http://www.cisco.com/cisco/web/support/index.html" rel="nofollow">http://www.cisco.com/cisco/web/support/index.html</a> </td> 
 </tr> 
 </tbody> 
</table>

## Feature Information for BGP Flow Specification Client ##

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

<table> Table 1&nbsp;Feature Information for BGP Flow Specification Client 
 <thead> 
 <tr> 
 <th> Feature Name </th> 
 <th> Releases </th> 
 <th> Feature Information </th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;"> BGP Flow Specification Client </td> 
 <td style="vertical-align:top;"> Cisco IOS XE 3.15S </td> 
 <td style="vertical-align:top;"> The BGP flow specification client feature enables a device to perform the role of a BGP flow specification client and receive flow specification rules from a BGP flow specification controller. The following command was introduced or modified:&nbsp;flowspec,&nbsp;local-install interface-all. </td> 
 </tr> 
 </tbody> 
</table>

[Finding Feature Information]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#GUID-DCB20ADF-1F8E-434B-AE97-54802879F34F
[Prerequisites for BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#concept_45837432282805676881293916846068
[Restrictions for BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#concept_758202688431158169640273953390713
[Information About BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#d25e216a1635
[How to Configure BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#d25e596a1635
[Configuration Examples for BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#d25e1264a1635
[Additional References for BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#reference_213460005092944281654092046327334
[Feature Information for BGP Flow Specification Client]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/C3PL-BGP-Flowspec-Client.html#reference_748839743741424230467091474434720
[Bug Search Tool]: https://tools.cisco.com/bugsearch/search
[www.cisco.com_go_cfn]: http://www.cisco.com/go/cfn
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FybWxpbnV4d3c_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/665d98df83214bc38436817fe100a828.png