FortiDDoS Deployment Guide for Cloud Signaling with Verisign OpenHybrid

Transcription

1 FortiDDoS Deployment Guide for Cloud Signaling with Verisign OpenHybrid

2 FORTINET DOCUMENT LIBRARY FORTINET VIDEO GUIDE FORTINET BLOG CUSTOMER SERVICE & SUPPORT FORTIGATE COOKBOOK FORTINET TRAINING SERVICES FORTIGUARD CENTER END USER LICENSE AGREEMENT FEEDBACK Tuesday, February 23, 2016 FortiDDoS Deployment Guide for Cloud Signaling with Verisign OpenHybrid

3 TABLE OF CONTENTS Change Log 4 Solution overview 5 Cloud mitigation triggers 6 Configuration 6 Verisign OpenHybrid registration 6 FortiDDoS registration 7 FortiDDoS signaling threshold 8 Escalation 10

4 Change Log Change Log Date Change Description Initial release. 4 FortiDDoS Deployment Guide

5 Solution overview Solution overview FortiDDoS appliances can block many types of Layer 3, Layer 4, and Layer 7 distributed denial-of-service (DDoS) and related attacks. A FortiDDoS appliance deployed in the customer premises network (CPN) provides effective defense against DDoS attacks as long the upstream Internet link is not saturated. When the upstream link is flooded, the upstream network elements must be able to cleanse the attack and forward legitimate traffic to the customer premises. Fortinet is a Verisign OpenHybrid partner. FortiDDoS uses the Verisign REST API to signal to Verisign that FortiDDoS has detected an attack, the destination subnet, the attack type, and the attack size. This cloud signaling feature enables small/medium businesses and enterprises that have deployed FortiDDoS in the CPN to work with Verisign to divert traffic during large attacks to the Verisign scrubbing station. "Clean traffic" that is not dropped at the scrubbing station is forwarded to its destination. A hybrid solution like this leverages the power of FortiDDoS to mitigate attacks granularly until the upstream network pipe reaches its limits. When that occurs, the Verisign overcapacity and scrubbing techniques can be used to mitigate network layer attacks. Depending on the size of the network and the type of attack, Verisign might use BGP-based diversion or DNS-based diversion. Discuss with Verisign the requirements for these options and make a plan best suited for your deployment. Figure 1 is an example when BGP is used. Figure 1: Topology 5 FortiDDoS Deployment Guide

6 Verisign OpenHybrid registration Cloud mitigation triggers 1. The normal path flows from the egress router to the customer premises network, through FortiDDoS. It is classified into its service protection profile (SPP) and processed; clean traffic is forwarded to its destination. 2. When there is an attack and traffic reaches the SPP policy packet per second threshold, FortiDDoS signals Verisign OpenHybrid. 3. The Verisign administrator might use BGP routing or DNS to redirect traffic to the Verisign scrubbing station. 4. Verisign uses its methods to inspect and drop attacks. 5. Clean traffic is injected back into the network. When BGP routing is used, it is typically GRE encapsulated. 6. The GRE traffic passes through FortiDDoS. The destination IP address is the enterprise firewall, so it is classified into a different SPP. 7. The GRE traffic is decapsulated by an enterprise firewall and then forwarded toward its destination. Cloud mitigation triggers FortiDDoS signals Verisign OpenHybrid when the packet rate (packets per second) specified in the SPP policy is reached. Configuration This section describes the FortiDDoS configuration. It includes the following steps: Verisign OpenHybrid registration FortiDDoS registration FortiDDoS signaling threshold Verisign OpenHybrid registration Complete registration with Verisign before you configure the connection on FortiDDoS. Refer to Verisign OpenHybrid documentation for information about registering a CPN DDoS device. When you log into OpenHybrid and complete registration, you provide the following information about the FortiDDoS CPN appliance. Field Description Example Cloud Signaling Source Required Field. Defines type of source sending the data. FortiDDoS FortiDDoS Deployment Guide 6

7 Configuration FortiDDoS registration Field Description Example Serial Number Optional FI800B Model Number Optional 800B Source ID FDD + Serial number FDDFI800B Description Optional Fortinet.com FortiDDoS registration On FortiDDoS, the registration settings are used for the connection with Verisign OpenHybrid. Basic steps 1. Go to Global Settings > Deployment and select Customer Premises. CLI commands: CP-FDD # config ddos global setting CP-FDD (setting) # set signaling-mode customer-premises CP-FDD (setting) # end 2. Go to Global Settings > Signaling and provide details for the connection with Verisign OpenHybrid. When you complete the third-party configuration for deployments with Verisign, you must specify: Customer account ID (assigned by Verisign) API key (must match the key set in Verisign OpenHybrid) Verisign URL ( 7 FortiDDoS Deployment Guide

8 FortiDDoS signaling threshold Configuration CLI commands: CP-FDD # config ddos global service-provider-devices CP-FDD (service-provid~r) # edit Verisign1 CP-FDD (SP-FDD) # set sp-device-type ThirdParty CP-FDD (SP-FDD) # set enable-sp-device enable CP-FDD (SP-FDD) # set account-id CP-FDD (SP-FDD) # set shared-secret/authorization-key 56455f47a602062e d768f8a CP-FDD (SP-FDD) # set address-type url CP-FDD (SP-FDD) # set url CP-FDD (SP-FDD) # end After it has been saved, you cannot modify the third-party signaling configuration. If you need to make changes, you must create a new configuration and delete the one it is replacing. FortiDDoS signaling threshold On the CPN FortiDDoS, the SPP policy settings determine the volume threshold at which to signal Verisign. Basic Steps 1. On the FortiDDoS CPN appliance, go to Global Settings > Switching Policy, enable the feature, and set a timeout. FortiDDoS Deployment Guide 8

9 Configuration FortiDDoS signaling threshold config ddos global spp-switching-policy set switching enable set timeout 255 end 2. Go to Global Settings > SPP Policy. When you configure the SPP policy, follow these guidelines: SPP Switching Enable. Alternate Service Protection Profile Specify the same SPP name. For example, if you are configuring SPP-1, specify SPP-1 as the alternate as well. The switch to the same SPP is what triggers the signaling to Verisign OpenHybrid. Threshold Packet rate at which signaling occurs. After the initial learning period and system recommendations are applied, check the thresholds for all protocols in use. The sum of the thresholds for all protocols is a good approximation for the maximum rate you specify here. config ddos global spp-policy edit ProtectedSubnet set subnet-id 2 set ip-version IPv4 set ip /24 set spp SPP-0 set enable-alt-spp enable set alt-spp SPP-0 set switching-threshold end If Verisign uses BGP to reinject traffic toward the destination, you should configure a separate SPP and SPP policy for the destination firewall. It should have a high inbound and outbound thresholds for GRE (protocol 47) traffic. 9 FortiDDoS Deployment Guide

10 FortiDDoS signaling threshold Escalation Escalation If you encounter issues with the solution deployment, contact your Fortinet sales engineer or Fortinet Customer Service & Support: FortiDDoS Deployment Guide 10