Percontext DDoS¶
Overview¶
The Percontext DDoS Custom Resource Definition (CRD) configures the Traffic Management Microkernel (TMM) Proxy Pod to protect applications from Denial of Service / Distributed Denial of Service (Dos/DDoS) attacks. Using custom packet signatures, the Percontext DDoS inspects all application traffic processed by the TMM Proxy Pod, to detect, report and/or mitigate DoS/DDoS events. Percontext DDoS is a subset of Global DDoS. It enables to protect each application or virtual server.
There are two Custom Resource Definition (CRD) available for configuring DDoS: Global DDoS (F5BigDdosGlobal) and Percontext DDoS (F5BigDdosProfile). The Global DDoS CRD should be used for specific functionality on a global level, while the Percontext DDoS CRD can be used for virtual server level protection.
This document guides you through understanding, configuring and installing a simple Percontext DDoS CR.
DDoS Scaling¶
To protect against both global and virtual DoS vectors. For global vectors, we protect the entire BIG-IP instance, with thresholds and limits that are per TMM pod. However, for virtual vectors, we protect a specific application (virtual server). Since the virtual server exists on all pods, and we have a DAG behind the instance, we need to divide certain thresholds and limits by the current number of pods.
The rate limit, detection threshold, and BD rate limit and threshold are divided by the number of TMM pods. However, we don’t divide the BA rate limit and threshold by the number of pods since the DAG will cause the same packets to go to the same TMM.
CR Parameters¶
The tables below describe the Percontext DDoS CRD sections used in this document. For the full list of parameters, refer to the PercontextDDoS Reference.
hslPublisher¶
Parameter | Description |
---|---|
hslPublisher |
Specifies the endpoint logging server to send logging messages. References the F5BigLogHslpub CR by metadata.name parameter. |
allowList¶
Allows you to exclude specific types of traffic from DDoS mitigations.
Parameter | Description |
---|---|
allowList |
Specifies the F5BigCneAddresslist by metadata.name containing the source IP addresses to exclude from DDoS detection/mitigation. |
vectors¶
DDoS attack vectors are the methods or techniques used by attackers to carry out a Distributed Denial of Service (DDoS) attack.
Parameter | Description |
---|---|
vectors |
Specifies the type of Vector to detect and mitigate. Refer to PercontextDDoS Referencefor a full list. |
CR Example for Percontext DDoS¶
apiVersion: "k8s.f5net.com/v1"
kind: F5BigDdosProfile
metadata:
name: "cnf-dns-ddos"
namespace: "cnf-gateway"
Spec:
hslPublisher: "cnf-hsl-pub"
vectors:
allowList:
srcAddressList: "outbound-nat"
CR shortName¶
CR shortNames provide an easy way to view installed CRs, and their configuration parameters. The CR shortName can also be used to delete the CR instance. The Percontext DDoS shortName is vddos.
View CR instance:
kubectl get vddos -n <namespace>
View CR configuration:
kubectl get vddos -n <namespace> -o yaml
Multiple TMM Proxy Pods¶
When Dos/DDoS attacks are detected, the attack is identified using a unique attack identifier (attack-ID). To ensure the attack-ID can be shared across multiple TMM Proxy Pods, avoiding duplicate attack-ID entries, the dSSM Database must be installed. The first TMM Proxy Pod to detect an attack stores the attack-ID in the dSSM database, and the TMM Proxy Pod replicas then check the dSSM database before creating any new attack-IDs.
Requirements¶
Ensure you have:
- Installed the BIG-IP Controller.
- Installed the dSSM Database when scaling TMM Proxy Pods.
- A Linux based workstation.
Installation¶
Use these steps to install the example Percontext DDoS CR, and the optional CNFs CR. Each step offers a brief description of the example CR.
Tip: Open a second shell to view the CNFs Event Logs while installing.
Optional: The example F5BigLogHslpub CR specifies a remote server with IP/port [2002::10:30:2:220]:514 and the udp protocol. Copy and paste the example into a YAML file:
Note: The F5BigLogHslpub CR will be referenced by the Percontext DDoS.
apiVersion: k8s.f5net.com/v1 kind: F5BigLogHslpub metadata: name: "cnf-hsl-pub" namespace: "cnf-gateway" spec: pool: - name: "cnf-hslpool" endpoint: - "[2002::10:30:2:220]:514" syslog: - name: "syslog-dest" format: "rfc5424" protocol: "udp" pool: "cnf-hslpool"
Install the F5BigLogHslpub CR:
kubectl apply -f cnf-hsl-cr.yaml
Install the F5BigCneAddresslist CR:
kubectl apply -f cnf-address-list.yaml
The example F5BigCneAddresslist specifies of IP addresses 2002::192:168:10:1 and 192.168.10.1. Copy and paste the example into a YAML file:
Note: The F5BigCneAddresslist CR defines lists of IP addresses that can be referenced by the Percontext DDoS CR. The DDoS supports the individual IP addresses and do not work on IP ranges or pre-fixes.
apiVersion: "k8s.f5net.com/v1" kind: F5BigCneAddresslist metadata: name: "outbound-nat" namespace: "cnf-gateway" spec: addresses: - "2002::192:168:10:1" - "192.168.10.1"
The example mitigates ipv6-frag-flood and dns-aaaa-query attacks, and excludes the F5BigCneAddresslist IPs from the policy. Copy and paste the example into a YAML file:
apiVersion: "k8s.f5net.com/v1" kind: F5BigDdosProfile metadata: name: "cnf-dns-vddos" namespace: "cnf-gateway" spec: hslPublisher: "cnf-hsl-pub" vectors: ipv6FragFlood: state: "mitigation" rateLimit: 200 perSrcIpDetectionEps: 100 dnsAaaaQuery: state: "detection-only" detectionThresholdEps: 100 allowList: srcAddressList: "outbound-nat"
Install the Percontext DDoS CR:
kubectl apply -f cnf-ddos-cr.yaml -n cnf-gateway
In this example, the BIG-IP Controller logs indicate the Percontext DDoS CR was added/updated:
I0208 12:00:00:12345 1 event.go:282] Event(v1.ObjectReference{Kind:"F5Dos", F5Dos cnf-gateway/cnf-dns-ddos was added/updated
Verify the percontext DDoS status.
kubectl get f5-big-ddos-profiles.k8s.f5net.com
The Percontext DDoS will inspect all application traffic processed by the TMM Proxy Pod. Continue to the Additional CRs and Dos/DDoS Statistics sections.
A reference in the virtual server is necessary to configure per-context DoS.
apiVersion: "k8s.f5net.com/v1" kind: F5BigDnsApp metadata: name: "cnf-dns-virtual" namespace: "cnf-gateway" spec: # Rest of the F5BigDnsApp config goes here. ddosProfile: "cnf-dns-vddos"
Additional CRs¶
To begin Dos/DDoS detection and mitigation, install one of the Traffic management CNFs CRs.
Dos/DDoS Statistics¶
Use the steps below to verify the Percontext DDoS CR DoS/DDoS statistics:
Connect to the debug sidecar:
kubectl exec -it deploy/f5-tmm -c debug -n <namespace> -- bash
In this example, the debug sidecar is in the cnf-gateway Namespace:
kubectl exec -it deploy/f5-tmm -c debug -n cnf-gateway -- bash
Verify the DoS/DDoS statistics:
tmctl -f /var/tmstat/blade dos_stat -s context_name,vector_name,profile_name,protocol_type,status,attack_detected,attack_count,drops
context_name vector_name -------------------------------------- ------------------- Device L3/4 BDoS Device IPv6 fragment flood default-cnf-dns-virtual-virtual_server AAAA query DOS default-cnf-dns-virtual-virtual_server IPv6 fragment flood Device DNS AAAA Query profile_name protocol_type status attack_detected attack_count drops --------------------- ------------- -------- --------------- ------------ ----- L4 BDoS Ready 0 0 0 implicit Device Learning 0 0 0 cnf-dns-vddos-virtual DNS Learning 0 0 0 cnf-dns-vddos-virtual Network Learning 0 0 0 implicit Device Learning 0 0 0
Feedback¶
Provide feedback to improve this document by emailing cnfdocs@f5.com.