Global DDoS Custom Resource

The GlobalDDoS Custom Resource (CR) configures the Traffic Management Microkernel (TMM) proxy pod to protect applications and the TMM Pod from Denial of Service / Distributed Denial of Service (Dos/DDoS) attacks. Using custom packet signatures, the Global DDoS inspects all application traffic processed by the TMM Proxy Pod, to detect, report and/or mitigate DoS/DDoS events.

This document helps you understand, configure, and install a simple GlobalDDoS CR.

Hardware Acceleration for DDoS protection

The BIG-IP Next for Kubernetes’s Hardware Acceleration helps you offload only certain DoS vectors and address list to DPU to reduce the DDoS mitigation workload on the CPU and allow it to perform other functions. User must set dosGlobalOptions.common.forceSwDos to false in GlobalDDoS CR and back reference it to GatewayClass using spec.targetRef to use Hardware Acceleration for DDoS mitigation. Only a few DoS vectors and address list supports Hardware Acceleration, see F5BigDdosGlobal CRD. It is not possible for users to selectively enable Hardware Acceleration for a subset of the supported DoS vectors.

Ensuring Unique Attack-IDs with dSSM Database

When Dos/DDoS attacks are detected, they are assigned a unique attack identifier (attack-ID). In order to prevent duplicate entries of attack-IDs and facilitate sharing among multiple TMM Proxy Pods, it is necessary to have the dSSM Database installed. The first TMM Proxy Pod that detects an attack will store its attack-ID in the dSSM database, and any subsequent TMM Proxy Pod replicas will first check the database before generating new attack-IDs.

Dos/DDoS Statistics

Use the steps below to verify the Global DDoS CR DoS/DDoS statistics:

1. Connect to the debug sidecar:

   kubectl exec -it ds/f5-tmm -c debug -n <namespace> -- shell
   

   In this example, the debug sidecar is in the f5-bnk Namespace:

   kubectl exec -it ds/f5-tmm -c debug -n f5-bnk -- shell
   

2. Verify the DoS/DDoS statistics:

   tmctl -f /var/tmstat/blade dos_stat -s context_name,vector_name,profile_name,protocol_type,status,attack_detected,attack_count,drops
   

   context_name vector_name         profile_name        protocol_type status  
   ------------ ------------------- ------------------- ------------- --------
   Device       L3/4 BDoS                               L4 BDoS       Ready   
   Device       DNS AAAA Query      cnf-dns-ddos-global Device        Learning
   Device       IPv6 fragment flood cnf-dns-ddos-global Device        Learning
   
   attack_detected attack_count drops
   --------------- ------------ -----
               0            0     0
               0            0     0
               0            0     0