RE: Switch with high ACL capacity

[Ryan Hamel <Ryan.Hamel () quadranet com>]

I would see if you can get your upstream providers to apply rules to a dedicated interface upstream (drop NTP, 
memcache, LDAP, rate limit SSDP), and connect that to your switch, which would announce the /32’s or /128’s to pull the 
traffic over. You would of course have to announce the /24 or /48 through the carrier that has the filters in place to 
ensure they get all the traffic. After post processing the spoofed traffic, it should leave you with flooding to take 
care of.

--
Ryan Hamel
Network Administrator
ryan.hamel () quadranet com | +1 (888) 578-2372
QuadraNet Enterprises, LLC. | Dedicated Servers, Colocation, Cloud

From: NANOG <nanog-bounces () nanog org> On Behalf Of Tim Jackson
Sent: Tuesday, November 06, 2018 11:52 AM
To: nanog () ics-il net
Cc: nanog list <nanog () nanog org>
Subject: Re: Switch with high ACL capacity

Juniper QFX10000(including 100002) supports ~64k ACL entries + FlowSpec

--
Tim

On Tue, Nov 6, 2018 at 1:49 PM Mike Hammett <nanog () ics-il net<mailto:nanog () ics-il net>> wrote:
The intent is to see if I can construct a poor man's DDOS scrubber. There are low cost systems out there for the 
detection, but they just trigger something else to do the work. Obviously there is black hole routing, but I'm looking 
for something with a bit more finesse.

If I need to get a switch anyway, might as well try to take advantage of it for other uses.

-----Mike HammettIntelligent Computing SolutionsMidwest Internet ExchangeThe Brothers WISP

----- Original Message -----
From: Lotia, Pratik M <Pratik.Lotia () charter com<mailto:Pratik.Lotia () charter com>>
To: Mike Hammett <nanog () ics-il net<mailto:nanog () ics-il net>>, 'nanog list' <nanog () nanog org<mailto:nanog () 
nanog org>>
Sent: Tue, 06 Nov 2018 12:29:15 -0600 (CST)
Subject: Re: Switch with high ACL capacity

Mike,

Can you shed some light on the use case? Looks like you are confusing ACLs and BGP Flowspec. ACLs and Flowspec rules 
are similar in some ways but they have a different use case. ACLs cannot be configured using Flowspec announcements. 
Flowspec can be loosely explained as 'Routing based on L4 rules' (there's a lot more to it than just L4). I doubt if a 
there is a Switch which can hold a large number of Flowspec entries.


~Pratik Lotia
“Improvement begins with I.”


On 11/6/18, 10:39, "NANOG on behalf of Mike Hammett" <nanog-bounces () nanog org<mailto:nanog-bounces () nanog org> on 
behalf of nanog () ics-il net<mailto:nanog () ics-il net>> wrote:

    I am looking for recommendations as to a 10G or 40G switch that has the ability to hold a large number of entries 
in ACLs.

    Preferred if I can get them there via the BGP flow spec, but some sort of API or even just brute force on the 
console would be good enough.

    Used or even end of life is fine.

    -----Mike HammettIntelligent Computing SolutionsMidwest Internet ExchangeThe Brothers WISP


E-MAIL CONFIDENTIALITY NOTICE:
The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain 
confidential and/or legally privileged information. If you are not the intended recipient of this message or if this 
message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this 
message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, 
distribution, copying, or storage of this message or any attachment is strictly prohibited.