Configuration Options
Using traffic diversion in service provider environment
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401
25
•
The FortiDDoS device is a layer-2 bridge and therefore does not have either a MAC
address or an IP address in the data path (path of the packets.). To allow such
diversions, you must therefore connect the device to interfaces on the routers or
switches that have a routeable IP address.
Refer to
. Following terminology is used in this section:
•
Divert-from router—Router from which the FortiDDoS device diverts the attacked
customer traffic.
•
Inject-to router—Router to which the FortiDDoS device forwards the legitimate
traffic to the attacked customer.
A very simple deployment is explained in
. This involves Layer 2 forwarding
through the FortiDDoS device.
One additional interface on the Divert-from Router - Router 1 is used to divert the
traffic to the attacked destination. This traffic passes through the FortiDDoS device.
The traffic is then forwarded to the Inject-to Router - Router 2. These two interfaces are
in the same network (192.168.1.x) and therefore an ARP request from Router 1 for
192.168.1.2 passes through the FortiDDoS device and reaches Router 2 and Router 2
can respond back with an ARP reply and vice versa.
A static route is added on Router 1 for addresses for the attacked customer network.
Having the longest matching prefix, the rule matches first and therefore all traffic to
attacked customer network is diverted from Router 1 to Router 2 through the
FortiDDoS device network rather than going straight from Router 1 to Router 2. The
return path for traffic should preferably be via the FortiDDoS appliance. The solution
will work even if the traffic is unidirectional through the FortiDDoS device. Bidirectional
traffic helps the FortiDDoS device determine the statefulness within connections.
Figure 18:
Traffic Diversion and a FortiDDoS device
Summary of Contents for FortiDDoS
Page 1: ...FortiDDoS v3 2 Installation Guide ...
Page 37: ......
