F5BigDdosGlobal

Overview

Function

Declares the global DDoS protection configuration for a CNE instance, defining global options, attack vectors, Behavioral DoS signatures, and an allow list that apply across all TMM instances.

This resource configures the Traffic Management Microkernel (TMM) proxy pod to protect applications and the TMM pod from Denial of Service and Distributed Denial of Service (DoS/DDoS) attacks. Using custom packet signatures, this resource inspects all application traffic that the TMM proxy pod processes, and detects, reports, or mitigates DoS/DDoS events.

Names

Singular name	Plural name	Short name
f5-big-ddos-global	f5-big-ddos-globals	ddos

API group and version

k8s.f5net.com/v1

Scope

Namespace

Specification

spec

Field	Required	Default	Description
dosGlobalOptions object	No	{}	Global DDoS options.
adosGlobalOptions object	No	{}	Asymmetric DoS (ADoS) global options. These apply only in ADoS mode.
bdosGlobalOptions object	No	{}	Behavioral DoS (BDoS) global options.
hslPublisher string	No	""	Reference to the HSL publisher name, the endpoint logging server that receives the log messages. Maximum length is 255 characters.
vectors object	No	{}	Flood and error attack vectors for advanced DDoS protection. See spec.vectors.
behavioralDos object	No	{}	Behavioral DoS configuration for dynamic and custom signatures.
allowList object	No	{}	Allow list configuration to exclude traffic sources from DDoS detection or mitigation.

spec.dosGlobalOptions

Field	Required	Default	Description
common object	No	{}	Common DoS system database variables.

spec.dosGlobalOptions.common

Field	Required	Default	Description
forceSwDos boolean	No	false	Forces software DoS instead of hardware offload on hardware-capable systems. Accepted values: true, false.

spec.adosGlobalOptions

Field	Required	Default	Description
pktMeteringRate string	No	one-percent	Global packet metering rate, as the percentage of total ingress packets replicated to the CPU for processing. Accepted values: one-percent, two-percent, four-percent, five-percent, ten-percent, twenty-percent, twenty-five-percent, fifty-percent, one-hundred-percent.
advancedOptions object	No	{}	Advanced ADoS options. Change these only after careful consideration.

spec.adosGlobalOptions.advancedOptions

Field	Required	Default	Description
bdosAnomalyThresholdPercent integer	No	10	Anomaly threshold percentage. Defines the upper limit for each predicate considered for signature generation. Accepted values: 1 to 100.
bdosMinPredicates integer	No	7	Minimum number of predicates to form a signature. Change this only after consultation. Accepted values: 3 to 8.
bdosSensHighThroughput integer	No	10	Least required throughput percent to qualify a signature for hardware mitigation when the mitigation sensitivity is high. Accepted values: 1 to 50.
bdosSensHighMitigation integer	No	95	Mitigation threshold limit applied to a valid signature when the mitigation sensitivity is high. Accepted values: 50 to 100.
bdosSensMediumThroughput integer	No	12	Least required throughput percent to qualify a signature for hardware mitigation when the mitigation sensitivity is medium. Accepted values: 1 to 50.
bdosSensMediumMitigation integer	No	90	Mitigation threshold limit applied to a valid signature when the mitigation sensitivity is medium. Accepted values: 50 to 100.
bdosSensLowThroughput integer	No	15	Least required throughput percent to qualify a signature for hardware mitigation when the mitigation sensitivity is low. Accepted values: 1 to 50.
bdosSensLowMitigation integer	No	80	Mitigation threshold limit applied to a valid signature when the mitigation sensitivity is low. Accepted values: 50 to 100.

spec.bdosGlobalOptions

Field	Required	Default	Description
logLevel string	No	error	Deprecated. Log level for the BDoS pod. Use dynamic logging instead. Accepted values: critical, error, warning, notice, debug.
advancedOptions object	No	{}	Advanced BDoS options. Change these only after careful consideration.

Note

logLevel is deprecated. Use dynamic logging instead.

spec.bdosGlobalOptions.advancedOptions

Field	Required	Default	Description
anomalyDetectFreq integer	No	10	Anomaly detection frequency, in seconds. Accepted values: 10 to 256.
learningPeriod integer	No	120	Learning period for network traffic, in minutes. Doesn’t apply in ADoS mode. Accepted values: 15 to 7200.
anomalyThreshFloor integer	No	100	Floor threshold used when attack thresholds become very low after anomaly detection. Accepted values: 100 to 4294967295.
transSigMergePeriods integer	No	2	Number of merge (correlation) periods before which a signature is considered transient. Accepted values: 0 to 1000.
sigDisableNoStatsPeriods integer	No	5	Number of no-stats periods before an active signature is turned off. Accepted values: 1 to 30.

spec.vectors

The vectors object defines flood and error attack vectors. Most vectors share a common set of fields, described in Common flood vector fields and Common error vector fields. The tables that follow list each vector, its category, and any fields it adds beyond the common set.

Common flood vector fields

Flood vectors (for example, ipv4IcmpFlood, synFlood, udpFlood, dnsAQuery) share these fields.

Field	Required	Default	Description
state string	No	detection-only	Enforcement for the attack type. detection-only monitors, learns, and alerts. mitigation also mitigates. Accepted values: detection-only, mitigation.
detectionThresholdEps integer	No	4294967295	Packets per second the system must find in traffic to detect this attack. Accepted values: 0 to 4294967295.
detectionThresholdPercentage integer	No	4294967295	Threshold percent the system must find in traffic to detect this attack. Accepted values: 0 to 4294967295.
rateLimit integer	No	4294967295	Maximum packets per second allowed for the vector. The system drops excess traffic beyond the limit. Accepted values: 0 to 4294967295.
perSrcIpDetectionEps integer	No	4294967295	Packets per second used to identify a source IP address as a bad actor. Accepted values: 0 to 4294967295.
perSrcIpLimitEps integer	No	4294967295	Rate limit applied to a source IP address identified as a bad actor. Accepted values: 0 to 4294967295.
perDstIpDetectionEps integer	No	4294967295	Events per second used to identify a destination IP address as under attack. Accepted values: 0 to 4294967295.
perDstIpLimitEps integer	No	4294967295	Rate limit applied to a destination IP address identified as under attack. Accepted values: 0 to 4294967295.

Common error vector fields

Error vectors (for example, ipv4BadTtl, badTcpChecksum, dnsMalformed) share these fields. When you turn on an error vector, the system detects and drops the attack based on the threshold configuration.

Field	Required	Default	Description
detectionThresholdEps integer	No	4294967295	Packets per second the system must find in traffic to detect this attack. Accepted values: 0 to 4294967295.
detectionThresholdPercentage integer	No	4294967295	Threshold percent the system must find in traffic to detect this attack. Accepted values: 0 to 4294967295.

Flood vectors

Each of these vectors uses the common flood vector fields. Vectors with extra fields are noted. The Hardware acceleration column shows whether the platform can offload the vector to hardware.

Vector	Category	Hardware acceleration	Extra fields
ipv4IcmpFlood	IPv4 flood	Yes	—
tidcmp	IPv4 flood	Yes	—
ipv4FragFlood	IPv4 flood	No	—
ipv4OverlapFrag	IPv4 flood	No	—
ipv4LowTtl	IPv4 flood	Yes	—
ipv4NoPayload	IPv4 flood	Yes	—
ipv4OptFrame	IPv4 flood	No	—
ipv6L4ExtHdrsGoEnd	IPv6 flood	Yes	—
ipv6BadExtHdrOrder	IPv6 flood	No	No per-source or per-destination fields.
ipv6IcmpFlood	IPv6 flood	No	—
ipv6FragFlood	IPv6 flood	Yes	—
ipv6AtomicFrag	IPv6 flood	No	—
ipv4MappedIpv6Addr	IPv6 flood	No	No per-source or per-destination fields.
ipv6RoutingHdrType0	IPv6 flood	No	—
ipv6LowHopCount	IPv6 flood	Yes	lowHopCount
ipv6ExtHdrTooLarge	IPv6 flood	No	maxIpv6ExtHdrSize
ipv6WithExtHdrFrames	IPv6 flood	No	ipv6ExtHdrFrameType
ipv6TooManyExtHdrs	IPv6 flood	No	maxIpv6ExtHdrs
tcpUnknownOptions	TCP flood	—	—
tcpRstFlood	TCP flood	Yes	—
tcpFlagsUncommonFlood	TCP flood	No	—
tcpSynOversize	TCP flood	No	—
tcpBadUrg	TCP flood	Yes	—
tcpOptOverrunsTcpHdr	TCP flood	No	—
tcpWindowSize	TCP flood	No	—
nonTcpConnection	TCP flood	No	—
tcpOptIllegalLen	TCP flood	No	—
synFlood	TCP flood	Yes	synCookie
synAckFlood	TCP flood	Yes	onlyUnsolicited
ackFlood	TCP flood	Yes	—
ackTimestampFlood	TCP flood	No	timestampCookie
udpFlood	UDP flood	Yes	udpPortList
noListenerMatch	Common flood	—	—
uncommonIpProtocols	IP flood	—	excludedIpProtocols
unknownIpProtocols	IP flood	—	No per-source or per-destination fields.
unknownIpOptions	IP flood	—	—
dnsAQuery	DNS flood	—	—
dnsAaaaQuery	DNS flood	—	—
dnsAnyQuery	DNS flood	—	—
dnsPtrQuery	DNS flood	—	—
dnsAxfrQuery	DNS flood	—	—
dnsCnameQuery	DNS flood	—	—
dnsIxfrQuery	DNS flood	—	—
dnsMxQuery	DNS flood	—	—
dnsNsQuery	DNS flood	—	—
dnsOtherQuery	DNS flood	—	—
dnsSoaQuery	DNS flood	—	—
dnsSrvQuery	DNS flood	—	—
dnsTxtQuery	DNS flood	—	—
oversizedDns	DNS flood	—	maxDnsSize
dnsNxdomainQuery	DNS flood	—	validDomains, wellKnownProxies
etherBroadcastPkt	Layer 2 flood	Yes	No per-source or per-destination fields.
etherMulticastPkt	Layer 2 flood	Yes	No per-source or per-destination fields.
arpFlood	Layer 2 flood	Yes	No per-source or per-destination fields.
l2LenGtIpLen	Layer 2 flood	No	No per-source or per-destination fields.
singleEndpointSweep	Single endpoint	No	packetTypes
singleEndpointFlood	Single endpoint	No	packetTypes
icmpFragFlood	ICMP flood	Yes	—
icmpFrameTooLarge	ICMP flood	No	No per-source or per-destination fields.
hostUnreachable	ICMP flood	Yes	—
igmpFlood	IGMP flood	Yes	—
igmpFragFlood	IGMP flood	No	—

Error vectors

Each of these vectors uses the common error vector fields. The Hardware acceleration column shows whether the platform can offload the vector to hardware.

Vector	Category	Hardware acceleration
ipv4BadTtl	IPv4 error	Yes
ipv4BadVer	IPv4 error	Yes
ipv4BadSrc	IPv4 error	Yes
ipv4ErrorChecksum	IPv4 error	Yes
ipv4FragError	IPv4 error	Yes
ipv4ShortFrag	IPv4 error	No
ipv4HdrLenTooShort	IPv4 error	No
ipv4HdrLenGtL2Len	IPv4 error	No
ipv4OptIllegalLen	IPv4 error	No
ipv4LenGtL2Len	IPv4 error	No
ipv6DupExtHdr	IPv6 error	No
ipv6BadHopCount	IPv6 error	Yes
ipv6BadVersion	IPv6 error	No
ipv6AddrLenGtL2Len	IPv6 error	No
ipv6PayloadLenLtL2Len	IPv6 error	No
ipv6BadAddr	IPv6 error	No
ipv6FragError	IPv6 error	Yes
ipv6FragOverlapError	IPv6 error	No
ipv6ShortFragError	IPv6 error	No
badTcpChecksum	TCP error	—
tcpHdrLenGtL2Len	TCP error	—
tcpHdrLenTooShort	TCP error	—
tcpFlagsMalformed	TCP error	—
badUdpChecksum	UDP error	Yes
badUdpHdr	UDP error	Yes
landAttack	Layer 4 error	—
badSctpChecksum	Layer 4 error	—
dnsMalformed	DNS error	—
dnsQdCountLimit	DNS error	—
unsolicitedDnsResponse	DNS error	—
etherSrcEqualDstAddr	Layer 2 error	No
badIcmpChecksum	ICMP error	No
badIcmpFrame	ICMP error	No
badIgmpFrame	IGMP error	Yes

spec.vectors.ipv6LowHopCount extra fields

Field	Required	Default	Description
lowHopCount integer	No	1	Minimum value for the hop count. Accepted values: 1 to 4.

spec.vectors.ipv6ExtHdrTooLarge extra fields

Field	Required	Default	Description
maxIpv6ExtHdrSize integer	No	128	Maximum allowed size, in bytes, of the IPv6 extension header field. Accepted values: 0 to 1024.

spec.vectors.ipv6WithExtHdrFrames extra fields

Field	Required	Default	Description
ipv6ExtHdrFrameType array	No	[all]	IPv6 extension header types to match. Accepted values: auth, dstopt, esp, frag, hbh, mobility, route, all.

spec.vectors.ipv6TooManyExtHdrs extra fields

Field	Required	Default	Description
maxIpv6ExtHdrs integer	No	4	Number of IPv6 extension headers allowed. Accepted values: 0 to 15.

spec.vectors.synFlood.synCookie

When SYN cookie is on, the system sends a cookie in the SYN-ACK response during a SYN flood. It creates the TCP flow only when the client responds with the SYN cookie.

Field	Required	Default	Description
state string	No	enable	Status of the SYN cookie. Accepted values: enable, disable.
verifiedList string	No	enable	Adds valid client entries that respond to the SYN cookie to the verified list. In ADoS mode, the verified list is always on and this setting has no effect. Accepted values: enable, disable.
threshold integer	No	4294967295	Threshold value. Accepted values: 0 to 4294967295.
hwScrubTime integer	No	120	Scrub time, in minutes, for flushing verified list entries from hardware. Supported in ADoS mode only. Accepted values: 1 to 450.
verifiedListSkipDos boolean	No	true	When true, the system skips the TCP SYN/ACK flood and TCP RST flood vectors for IP addresses in the verified list. Has no effect when the verified list isn’t on. Supported in ADoS mode only. Accepted values: true, false.

spec.vectors.synAckFlood extra fields

Field	Required	Default	Description
onlyUnsolicited boolean	No	true	When true, counts only unsolicited SYN-ACKs received. When false, counts all SYN-ACKs received. Accepted values: true, false.

spec.vectors.ackTimestampFlood extra fields

Field	Required	Default	Description
timestampCookie boolean	No	true	When true, turns on the timestamp cookie on all VLANs. Accepted values: true, false.

spec.vectors.udpFlood.udpPortList

Field	Required	Default	Description
listType string	No	exclude-listed-ports	Whether to exclude or include the listed ports when detecting the UDP flood. Accepted values: exclude-listed-ports, include-listed-ports.
entries array	No	[]	UDP port entries used for detection. Must contain no more than four items.

spec.vectors.udpFlood.udpPortList.entries[]

Field	Required	Default	Description
port string	Yes	—	UDP port number, as a string. Accepted values: 0 to 65535.
matchDirection string	No	either	Direction of the match for the port. Accepted values: either, dst, src.

spec.vectors.uncommonIpProtocols extra fields

Field	Required	Default	Description
excludedIpProtocols array	No	See description	IP protocols to treat as common and exclude from this vector’s detection and mitigation thresholds. When empty, the system excludes the default protocol list. Accepts IANA protocol names, or any as a wildcard. Default: ah, any, esp, etherip, gre, hopopt, icmp, igmp, ipcomp, ipip, ipv4, ipv6, ipv6-frag, ipv6-icmp, ipv6-nonxt, ipv6-opts, ipv6-route, mobility-header, ospf, pim, sctp, tcp, udp.

spec.vectors.oversizedDns extra fields

Field	Required	Default	Description
maxDnsSize integer	No	4096	Maximum allowed size for DNS. Accepted values: 256 to 8192.

spec.vectors.dnsNxdomainQuery extra fields

Field	Required	Default	Description
validDomains array	No	[]	Domains that the vector treats as valid. Each domain is up to 253 characters.
wellKnownProxies object	No	{}	Configuration for DNS proxies. Use this when a mitigation drop for queries from an intermediate DNS proxy isn’t tolerated.

spec.vectors.dnsNxdomainQuery.wellKnownProxies

Field	Required	Default	Description
responseRateLimit integer	No	0	Maximum packets per second response rate. The system sends no responses once the limit is exceeded. Accepted values: 0 to 4294967295.
srcAddressList string	No	""	Soft reference to a F5BigCneAddresslist resource of source addresses for DNS proxies from which the DNS request originated and to which responses must be sent. The addresses must use only prefix 32 for IPv4 and 128 for IPv6. Maximum length is 253 characters.

spec.vectors.singleEndpointSweep and spec.vectors.singleEndpointFlood extra fields

singleEndpointSweep tracks packets by source address. singleEndpointFlood tracks packets by destination address. The system drops packets that match a packet type and exceed the rate limit.

Field	Required	Default	Description
packetTypes array	No	See description	Packet types considered for detection. Must contain at least one item. Accepted values include atomic-frag, bad-packet, the dns-* query types, ext-hdr, host-unreachable, igmp, ip-frag, ip-overlap-frag, ipv4-*, ipv6-*, no-l4, routing-hdr-type-0, suspicious, tcp-rst, tcp-syn-ack, tcp-syn-only, tcp-window-size, tidcmp, and udp. Defaults to all packet types.

spec.behavioralDos

Field	Required	Default	Description
dynamicSignatures object	No	{}	Dynamic signature configuration. Dynamic signatures in the global context aren’t supported in ADoS mode.
customSignatures array	No	[]	Custom Behavioral DoS signatures for traffic the default signatures don’t match. Must contain no more than 32 items.

spec.behavioralDos.dynamicSignatures

Field	Required	Default	Description
dynSigDetection string	No	disabled	Detection mode for traffic anomalies used to generate dynamic signatures. enabled applies all thresholds and threshold actions. disabled applies no action. learn-only tracks statistics without enforcing thresholds and generates no logs. learn-only isn’t supported in ADoS mode. Accepted values: disabled, enabled, learn-only.
mitigationSensitivity string	No	none	Sensitivity level for dropping packets when mitigating attacks with dynamic signatures. Applies only when dynSigDetection is enabled. none detects only. Accepted values: none, low, medium, high.
networkFamily boolean	No	false	Uses only L3/L4 network predicates for dynamic signature generation. Valid only when dynSigDetection is enabled or learn-only. Accepted values: true, false.
dnsFamily boolean	No	false	Uses DNS predicates with L3/L4 predicates for dynamic signature generation. Valid only when dynSigDetection is enabled or learn-only. Accepted values: true, false.

spec.behavioralDos.customSignatures[]

Field	Required	Default	Description
name string	No	""	Name of the custom Behavioral DoS signature. Maximum length is 255 characters.
state string	No	detection-only	Enforcement for the attack type. Accepted values: detection-only, mitigation.
detectionThresholdEps integer	No	4294967295	Packets per second the system must find in traffic to detect this attack. Accepted values: 0 to 4294967295.
rateLimit integer	No	4294967295	Maximum packets per second allowed. The system drops excess traffic. Accepted values: 0 to 4294967295.

spec.allowList

Field	Required	Default	Description
srcAddressList string	No	""	Soft reference to a F5BigCneAddresslist resource of source addresses to exclude from DDoS detection or mitigation. The addresses must use only prefix 32 for IPv4 and 128 for IPv6. Maximum length is 253 characters.
entries array	No	[]	Individual allow list entries. Must contain no more than eight items.

spec.allowList.entries[]

Field	Required	Default	Description
name string	Yes	—	Name of the allow list entry. Must be 1 to 256 characters.
entryType string	Yes	—	Type of entry for the matching logic. Accepted values: dst-match, src-match, v4-all, v6-all, ip-all.
ipProtocol string	No	any	IP protocol for the entry. Accepted values: any, icmp, igmp, tcp, udp.
matchingAddress string	No	any	Matching address. Set this only for the src-match or dst-match entry types. For the *-all entry types, the value is any. Must be 3 to 512 characters.
dstPort integer	No	0	Destination port. Set this only when ipProtocol is tcp or udp. Accepted values: 0 to 65535.
srcVlan string	No	any	Incoming traffic from a VLAN that the rule applies to. any matches traffic from all VLANs. Maximum length is 255 characters.

Prerequisites

Before you configure this resource, make sure that:

• The F5SPKVlan resource is configured.

• The GatewayClass resource is configured.

Example manifests

F5BigLogHslpub

apiVersion: k8s.f5net.com/v1
kind: F5BigLogHslpub
metadata:
  name: hsl-publisher
  namespace: f5-bnk
spec:
  pool:
    - name: hsl-pool
      endpoint:
        - 192.0.2.100:514
  syslog:
    - name: syslog
      format: rfc5424
      protocol: tcp
      pool: hsl-pool

F5BigDdosGlobal

apiVersion: "k8s.f5net.com/v1"
kind: F5BigDdosGlobal
metadata:
  name: gateway-global-ddos
  namespace: f5-bnk
spec:
  dosGlobalOptions:
    common:
      forceSwDos: true
  hslPublisher: hsl-publisher
  vectors:
    ipv4IcmpFlood:
      state: mitigation
      perSrcIpDetectionEps: 4000
      rateLimit: 5000

SecPolicy

Attach the F5BigDdosGlobal resource to the GatewayClass resource with a SecPolicy resource.

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-gatewayclass
  namespace: f5-bnk
spec:
  extensionRefs:
    - name: gateway-global-ddos
      group: k8s.f5net.com
      kind: F5BigDdosGlobal
  targetRefs:
    - name: f5-gateway-class-1
      kind: GatewayClass
      group: gateway.networking.k8s.io

Note

To turn on DDoS hardware offload, set spec.dosGlobalOptions.common.forceSwDos to false.