In EX switches, the FXPC process goes high and continues to stay high when DDoS protection is disabled.
The FXPC process shows high utilization.
A denial-of-service (DoS) attack is any attempt to deny valid users access to network or server resources by using up all the resources of the network element or server. Distributed denial-of-service (DDoS) attacks involve an attack from multiple sources, enabling a much greater amount of traffic to attack the network. The attacks typically use network protocol control packets to trigger a large number of exceptions to the device’s control plane. This results in an excessive processing load that disrupts normal network operations.
To protect the control plane against DDoS attacks, devices have policers enabled by default for host-bound traffic. If needed, you can modify many policer default values. Host-bound traffic is traffic destined to the Routing Engine, including protocol control packets for routing protocols, such as OSPF and BGP. Traffic destined to router IP addresses is also considered host-bound traffic.
One of the reasons that can cause this issue is configuration below:
ddos-protection { global { disable-fpc; }
When the DDoS is disabled, the DDoS bandwith and burst values are set to large values.
The fw-host and resolve queues have large bandwidth and burst values as seen below. Therefore, any traffic that hits these queues are rate limited to 100000 and can overwhelm the system, leading to high utilization of FXPC process.
------ ------- -------- -------- ----- -------- CMICQ Channel bwidth burst Qlen Proto(s) ------ ------- -------- ------- ------ -------- 15 3 100000 1000 1000 fw-host 20 3 100000 1000 1000 resolve
To avoid this issue, do not disable DDoS protection.
If it is disabled, perform the following:
delete system ddos-protection global disable-fpc
10/26/2024 : Added explanation of DDOS protection and default.