Fortinet FortiDDoS, Руководство по установке

Страница: 26 / 37

Configuration Options Using traffic diversion in service provider environment
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401
26
http://docs.fortinet.com/ • Feedback
Traffic diversion
using a single
divert-from and
inject-to router
and a switch
Refer to Figure 19 . A single router acts a Divert-from and Inject-to router. A very simple
deployment is explained in Figure 19 . This involves Layer 2 forwarding through the
FortiDDoS device.
One interface on the Internet side of the Router is used to divert the traffic to the
attacked destination. This traffic passes through the FortiDDoS device through a
switch. The traffic is then forwarded to the Inject-to interface on the same Router
through the same switch.
To ensure that the traffic is symmetric and both incoming and outgoing traffic to/from
the attacked destination go through the FortiDDoS device, the LAN interface of the
Router is used to divert the traffic from the attacked destination. This traffic passes
through the FortiDDoS device through a switch. The traffic is then forwarded to the
Inject-to interface on the same Router through the same switch.
A static route is added on the Router for addresses for the attacked customer network.
Having the longest matching prefix, the rule matches first and therefore all traffic to
attacked customer network is diverted from Router to the L3 Switch through the
FortiDDoS device network rather than going straight from Router to Distribution
Switch.
The return path for traffic should preferably be via a FortiDDoS appliance. The solution
will work even if the traffic is unidirectional through the FortiDDoS appliance.
Bidirectional traffic helps the FortiDDoS device determine the statefulness within
connections.
To ensure that the return traffic passes through the FortiDDoS device, use Policy
Based Routing (PBR) available in most routers. This allows routing based on source
address of the packets and interface to be routed via an address.
Figure 19: Traffic diversion using a single divert-from and inject-to router and a FortiDDoS unit