Principles of BGP VPNv6 Flow Specification

To deploy dynamic BGP VPNv6 Flow Specification, a traffic analysis server is required, and a BGP VPNv6 Flow Specification IBGP peer relationship must be established between the traffic analysis server and each ingress PE. As shown in Figure 1, the working process of dynamic BGP VPNv6 Flow Specification includes the following steps:

1. PE2 and PE3 sample traffic and send sampled traffic to the traffic analysis server.
2. The server checks the sampled traffic based on pre-configured rules to identify attack traffic.
3. The traffic analysis server generates a BGP VPNv6 Flow Specification route based on the characteristics of the attack traffic and sends the route carrying traffic filtering rules to PE1 through the BGP VPNv6 Flow Specification IBGP connection.
4. Upon receipt of the route, PE1 crosses it to VPNA and generates a traffic control policy based on the route to control traffic matching the filtering rules.

To deploy static BGP VPNv6 Flow Specification, a BGP VPN IPv6 Flow Specification route needs to be created manually on PE3 based on the characteristics of common attack traffic. After the BGP Flow-VPNv6 address family is enabled, PE3 generates a BGP VPNv6 Flow Specification route. Then a BGP VPNv6 Flow Specification IBGP peer relationship must be established between PE3 and the ingress PE (PE1) to transmit the BGP VPNv6 Flow Specification route. As shown in Figure 2, the working process of static BGP VPNv6 Flow Specification includes the following steps:

1. A BGP VPNv6 Flow Specification route is created manually on PE3, and a filtering rule and traffic control action are configured based on the characteristics of the attack traffic.
2. The BGP VPNv6 Flow Specification route is advertised to PE1 through the BGP VPNv6 Flow Specification IBGP connection.
3. Upon receipt of the route, PE1 crosses it to VPNA and generates a traffic control policy based on the route to control traffic matching the filtering rules.