close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Device Interfaces
play_arrow Other Interfaces
play_arrow Monitor and Troubleshooting Interfaces
- Monitor Interfaces
- Troubleshooting Interfaces
play_arrow Configuration Statements and Operational Commands

list Table of Contents

English

Discard Interfaces

date_range 20-Dec-24

arrow_backward

arrow_forward

The discard interface dsc is not a physical interface but a virtual interface that discards packets.

Discard Interface Overview

The discard interface is a virtual interface that silently discards packets as they arrive. The discard interface is especially useful when the network is under a denial-of-service (DoS) attack. You (the network administrator) can configure a policy to drop millions of requests from being sent to a given target address or set of addresses.

You can configure which traffic Junos OS forwards to the discard interface and what it does with that traffic. A local policy determines which traffic Junos OS forwards to the discard interface. Junos OS performs the action specified by an output filter before it discards the traffic.

Benefits

With a discard interface, you can configure filters for counting, logging, and sampling the traffic before any type of attack occurs. Discard static routes don't give you the same flexibility.
The discard interface allows you to identify the ingress point of a DoS attack. When your network is under attack, Junos OS identifies the target host IP address while the local policy forwards attacking packets to the discard interface.

Discard Interface Configuration

Keep the following guidelines in mind when configuring the discard interface:

Only the logical interface unit 0 is supported.
A discard interface can have only one logical unit (unit 0), but you can configure multiple IP addresses on that unit.
The filter and address statements are optional.
Although you can configure an input filter and a filter group, these configuration statements have no effect because traffic is not transmitted from the discard interface.
The discard interface does not support class of service (CoS).

Configure the Discard Interface
Configure an Output Policy

Configure the Discard Interface

To configure a discard interface:

In configuration mode, navigate to the [edit interfaces] hierarchy level.
```
[edit]
user@host# edit interfaces
```
Configure the discard interface. Note that you must use dsc to configure the discard interface and ensure that no other discard interface is already configured.
```
[edit interfaces]
user@host# edit dsc
```
Configure the logical interface (unit 0) and the protocol family.
```
[edit interfaces dsc]
user@host# edit unit 0 family family
```

(Optional) Apply an output filter to the discard interface.

content_copy zoom_out_map
[edit interfaces dsc unit 0 family family]
user@host# set filter output filter-name

Commit the configuration and go to the top of the hierarchy level.
```
[edit interfaces dsc unit 0 family family]
user@host# commit
user@host# top
```

Configure an Output Policy

You must configure an output policy to set up the community on the routes injected into the network.

To configure an output policy:

In configuration mode, go to the [edit policy-options] hierarchy level.
```
[edit]
user@host# edit policy-options
```

Configure a routing policy.

content_copy zoom_out_map
[edit policy-options]
user@host# edit policy-statement statement-name

Configure a policy term with a name.

content_copy zoom_out_map
[edit policy-options policy-statement statement-name]
user@host# edit term term-variable

Configure the list of prefix-lists of routes to match with a name.
```
[edit policy-options policy-statement statement-name term term-variable]
user@host# set from prefix-list name
```
Configure the action that is to be taken when the if and to conditions match with the then statement. In this case, configure the BGP community properties (set, add, and delete) associated with a route.
```
[edit policy-options policy-statement statement-name term term-variable]
user@host# set then community (set | add | delete) community-name
```
Commit the configuration and go to the top of the hierarchy level.
```
[edit interfaces dsc unit 0 family family]
user@host# commit
user@host# top
```

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release

Description

20.1

Starting in Junos OS release 20.1, for MX Series routers, the discard interface is also supported for the inet6 family.

arrow_backward PREVIOUS Protocol Family and Interface Address Properties

NEXT arrow_forward IP Demultiplexing Interfaces

Interfaces Fundamentals for Junos OS

ON THIS PAGE