Configuring How Flow Detection Operates Globally

Flow detection is disabled globally for all protocol groups and packet types by default. After you have turned on flow detection globally with the flow-detection statement at the [edit system ddos-protection global] hierarchy level, you can include the flow-detection-mode statement to configure how flow detection operates globally for all protocol groups and packet types. By default, flow detection operates in automatic mode for all packet types, meaning that it monitors control traffic for suspicious flows only after a DDoS policer has been violated. You can also configure flow detection either to never monitor flows or to always monitor flows.

When flow detection is turned on, traffic flows are monitored by default for all protocol groups and packet types. You can override the global configuration by including the flow-detection-mode statement at the [edit system ddos-protection protocols protocol-group packet-type] hierarchy level to configure how flow detection works for a protocol group or a packet type. You can also use the flow-level-detection statement to specify the behavior for one or more traffic flow aggregation levels (subscriber, logical interface, or physical interface).

CAUTION:

In a virtual chassis configuration, we recommend that you override flow detection for all Virtual Chassis control packets. The flow is based on the MAC address of the module in the FPC slot. If the virtual-chassis control-low flow is in violation, then all control traffic is lost, resulting in unexpected behavior. This behavior can include DHCP and PPPoE control traffic loss, loss of ARP requests, routing protocol flaps, and more.

To override flow detection for Virtual Chassis control packets when you have enabled global flow detection:

Disable flow detection for each packet type.

Flow detection supports the following three modes:

automatic—When a control plane DDoS protection policer is violated, traffic flows where the violation occurred are monitored for suspicious behavior. Each suspicious flow is examined to determine whether it is the culprit flow that caused the violation.
off—Traffic flows are never monitored for any protocol group or packet type.
on—Traffic flows for all protocol groups and packet types are monitored for suspicious flows even when no DDoS protection policer is currently being violated.

Note:

The detection mode is set to automatic by default. This means that if you enable global flow-detection and do not specify a mode, then flows are detected only when the policer is being violated.

To configure how flow detection operates at each flow aggregation level:

Specify the detection mode.

For example, to configure flow detection to always monitor and detect flows for all protocol groups and packet types at all flow aggregation levels: