Hey Haitham,
Ok lets understand the solution requirement / TMS - vSP role and than config flow here:-
Requirements :-
1. VSM-500 card
2. One peak-TMS ( Threat management system)
3. vSP ( this is collector which manages TMS)
4. Arbor DDoS license
TMS-SP role :-
Arbor PeakFlow SP is for management & collector where as,
Arbor Peakflow vTMS on VSM-500 is for Scrubbing and mitigation of traffic
Threat managment system (TMS) is Arbor OS which is designed for operation on VSM-500 card which uses linux KVM ( kernel based virtua-machine) software.
Communication of QNX with TMS happen over vNIC interfaces, some interfaces we can use for mangment ( accessibility to TMS) and some for TMS mitigation.
Configuring managment ports help you to manage TMS through GUI.
Config flow:-
1. First you need to install TMS ova.
2. After installing ova and configuring the interfaces with IP addresses suggested above.
3. BGP config peering to divert traffic to TMS for scrubbing
4. Need to configure Neflow to export packet to SP
5. optimize SP rules if needed
Your questions :
1. Offramp interface is to divert traffic from network to TMS ( scrubber) router which is installed on ASR9k VSM-500 card. The other side of this IP is at TMS
2. OnRAMP interface is for communication to re-injecting the legit traffic into the network from TMS to the router. The other side of this IP is at TMS
interface Bundle-Ether2.100
description offramp subinterface
ipv4 address 13.37.13.37 255.255.255.252
bundle load-balancing hash src-ip
load-interval 30
encapsulation dot1q 100
on which interface I should assign 13.37.13.38 255.255.255.252???
!
interface Bundle-Ether2.101
description onramp subinterface
vrf onramp
ipv4 address 13.37.13.41 255.255.255.252
load-interval 30
encapsulation dot1q 101
on which interface I should assign 13.37.13.42 255.255.255.252???
2. The Bundle is made over vNIC interfaces which are connected to linux which hosted TMS. Make sure you apply cli "bundle load-balancing hash src-ip" on bundle interface for proper load balancing.
for bundle id 2 which is used in this configuration for interfaces TenGigE0/1/1/0, 1, 2, 3 as above. where is the other end of this bundle???
3. Here is the VSM Architecture to understand where these NIC interface connected.
4. This is the MGMT interface for accessibility of TMS via GUI
is this interfaces is on the VSM card itself and where to configure the gateway for this interface???
5.
how to configure BGP between ASR9000 and TMS which is held on the VSM card? which IP address/interfaces used to do BGP peering? is it the Mgmt0 on TMS or the OFF/ON RAMP interfaces??
Once you install TMS then you need to access it by using CLI
virtual-service connect name <> console node X/n/CPU0, & then press ENTER
you will be prompted with below options :-
Do you want to begin the install process?
This will remove all current data and
configuration [n/y] y
System hostname? [arbos] router_name
IP address for interface mgt0: [none] mgt0_address
Netmask for interface mgt0: [255.255.255.0] netmask ( you should use /30 pool)
Media for interface mgt0: [none] (skip)
IP address for interface mgt1: [none] (skip)
Default route: [none] df_rte_address (this is to match the IP address for TMS interface TenGigE0/1/1/5)
set on router>
bgp access from which network? [done] 0.0.0.0/0
bgp access from which network? [done] ::/0 (for IPv6)
bgp access from which network? [done]
http access from which network? [done]
https access from which network? [done]0.0.0.0/0
https access from which network? [done] ::/0 (for IPv6)
https access from which network? [done]
ping access from which network? [done] 0.0.0.0/0
ping access from which network? [done]::/0 (for IPv6)
ping access from which network? [done]
snmp access from which network? [done]0.0.0.0/0
snmp access from which network? [done]::/0 (for IPv6)
snmp access from which network? [done]
telnetccaccess from which network? [done]
ssh access from which network? [done]0.0.0.0/0
ssh access from which network? [done] ::/0 (for IPv6)
ssh access from which network? [done]
Generating new SSH host key file.....done.
Current time and date: [181002062017.24] date and time
NTP server IP address: [done] ntp_svr_addr1
NTP server IP address: [done] ntp_svr_addr2
NTP server IP address: [done]
Press ENTER to reboot
after reboort
At the login prompt, type admin, and then press ENTER
At the password prompt, type arbor and then press ENTER
Change the administrator password. Type / services aaa local password admin interactive , and then press ENTER
a. Type the new password, and then press ENTER
b. Re-type the new password, and then press ENTER
Type / services tms start, and then press ENTER
Commit the configuration changes. Type / config write, and then press ENTER
To log off, type exit, and then press ENTER
6
can you paste a sample BGP configuration for this setup?.
router bgp 65000
bgp router-id <rtr_id>
address-family ipv4 unicast
!
address-family ipv4 flowspec
!
neighbor-group ibgp-routers
remote-as 1
update-source Loopback0
address-family ipv4 unicast
next-hop-self
!
!
neighbor-group ibgp-flowspec
remote-as 1
update-source <interface>
address-family ipv4 flowspec
!
!
neighbor <ip>
use neighbor-group ibgp-routers
!
neighbor <ip>
remote-as 1
use neighbor-group ibgp-flowspec
address-family ipv4 unicast
!
!
!
flowspec
local-install interface-all
In case if you stuck further i recommend you to open a TAC case where we can access your network and help you in setting up the solution.
Thanks
Nitin Pabbi