БУ @life_of_network_engineer
Showing posts older than #262 · Back to latest
Enhanced bandwidth and burst policer value (MX Series and EX9200 Series)—We've updated the default bandwidth value from 20000 to 100 pps and burst policer value from 20000 to 100 packets for SNMP traffic.
This enhancement avoids the CPU usage of eventd and snmpd reaching more than 100%. Earlier to this release, when the system receives a violated traffic for SNMP along with other protocols traffic, the CPU usage of eventd and snmpd was reaching more than 100% with an error.
> show ddos-protection protocols snmp
Protocol Group: SNMP
Aggregate policer configuration:
Bandwidth: 100 pps
Burst: 100 packets
System-wide information:
Received: 5964285 Arrival rate: 0 pps
Dropped: 723 Max arrival rate: 100 pps
set system ddos-protection protocols snmp aggregate bandwidth 2000
set system ddos-protection protocols snmp aggregate burst 2000
> show ddos-protection protocols snmp
* = User configured value
Protocol Group: SNMP
Aggregate policer configuration:
Bandwidth: 2000 pps*
Burst: 2000 packets*
# [inputs.gnmi.aliases]
# ddos-protection = "/ddos-stats"
# [[inputs.gnmi.subscription]]
# name = "ddos-protection"
# origin = "openconfig"
# path = "/junos/system/linecard/ddos/"
# subscription_mode = "sample"
# sample_interval = "10s"
For advanced, real-time monitoring and integration with network monitoring systems, Junos provides streaming telemetry sensors. The sensor for exposing DDoS protection data is:
/junos/system/linecard/ddos
/junos/system/linecard/ddos/ This PFE sensor exports the statistics of DDOS from MPC1, MPC2,
MPC3, MPC5, MPC6, MPC7, MPC8, and MPC9 line cards.
Starting in Junos OS Release 22.1R1 EX4650, QFX5110,
QFX5120-48Y, QFX5200 and QFX5210 switches are supported.
Starting in Junos OS Evolved Release 22.3R1, PTX10001-36MR,
PTX10003, PTX10004, PTX10008, PTX10016 routers are
supported.
upstream origin{
server origin1;
server origin2;
}
upstream edge1-shield {
server edge1;
server origin1 backup;
server origin2 backup;
}
upstream edge2-shield {
server edge2;
server origin1 backup;
server origin2 backup;
}
upstream edge3-shield {
server edge3;
server origin1 backup;
server origin2 backup;
}
split_clients $request_uri $upstream_backend {
33% origin;
33% edge2-shield;
33% edge3-shield;
* origin;
}
split_clients $request_uri $upstream_backend {
33% edge1-shield;
33% origin;
33% edge3-shield;
* origin;
}
split_clients $request_uri $upstream_backend {
33% edge1-shield;
33% edge2-shield;
33% origin;
* origin;
}
location / {
proxy_pass http://$upstream_backend;
}
Клиент1 -> edge1 -> edge2 -> origin (edge2 кэширует)
Клиент2 -> edge1 -> edge2 -> из кэша edge2 (без origin!)
Клиент3 -> edge2 -> из кэша edge2 (без origin!)
Клиент4 -> edge2 -> из кэша edge2 (без origin!)
Клиент5 -> edge3 -> edge2 -> из кэша edge2 (без origin!)
Клиент6 -> edge3 -> edge2 -> из кэша edge2 (без origin!)