How to add a new BGP FlowSpec Neighbor in the Corero CMS.

Configuring a BGP Connection for BGP or FlowSpec Routes

Before you can use BGP Routes or FlowSpec in the CMS, you must connect the CMS to your BGP router. There are two ways to connect to the BGP client: a direct connection to the BGP client or via an orchestrator REST API. You can only enable one method of communication between the CMS and your BGP router.

Caution: You can only enable one method of communication between the CMS and your BGP router. You cannot enable BGP CLIENT settings and REST CLIENT settings at the same time. You cannot use REST CLIENT and FlowSpec at the same time. You can enable BGP CLIENT and FlowSpec at the same time as they both use the BGP CLIENT configuration.

Prerequisites

You must have a BGP router on your network edge which can announce and withdraw BGP routes and/or FlowSpec routes. The router must be accessible from the CMS:

l BGP Client connection – Over a TCP connection (used for BGP Routes and/or FlowSpec)
l REST Client Connection – Via your own orchestrator REST API (used for BGP Routes only)

To configure a direct BGP Client connection (BGP Routes/FlowSpec)

1. Use the left-hand menu to navigate to Services > BGP Mitigation.
2. Select the BGP CLIENT tab.
3. Change the Admin State to enabled.
4. Type the Router ID IP address of your local BGP router. This router must be positioned to enable a TCP connection with the CMS.
5. Type your Local AS for this router. 
6. Add an entry for every neighbor (peer) of your local BGP router which may be contacted:
   1. In the Neighbors table, click Add.
   2. Type the Address of the neighbor.
   3. (Optional) If you don't want to use this neighbor yet, change the Admin State to Disable. Otherwise, leave as Enable.
   4. Type the Remote AS of this neighbor.
   5. Type the MD5 Password to access this neighbor.
   6. Click Save.
7. If you want to save the new configuration, and push your changes to any affected Defense devices, click Commit button. Then, on the pop-up dialog, click Commit to push the changes (alternatively, you can click Discard to discard any uncommitted changes).

To configure a REST Client Connection (BGP Routes only)

1. Use the left-hand menu to navigate to Services > BGP Mitigation.
2. Select the REST CLIENT tab.
3. Change the Admin State to enabled.
4. Type your REST API Username and Password.
5. Select the Content Type required.
6. Configure the Announce endpoint:
   1. Type your announce endpoint URL.
   2. Select a HTTP Request Method from the drop-down.
   3. Type the Body content required for your announce endpoint. Use the required tokens as placeholders for the information generated by the CMS for each new black hole.
7. Configure the Withdraw endpoint:
   1. Type your withdraw endpoint URL.
   2. Select a HTTP Request Method from the drop-down.
   3. Type the Body content required for your withdraw endpoint. Use the required tokens as placeholders for the information generated by the CMS for each black hole which needs withdrawn. 

8. (Optional) If there are any additional HTTP Headers required for your REST requests:

1. Click Add.
2. Type the HTTP Header you want to add to the REST requests.
3. Type the Value for that header.
4. Click Save.

Caution: There are three headers you must be cautious of adding to the HTTP headers table.

• accept is by default set to all. Adding it to the HTTP Headers table will overwrite all with your chosen value.

• authorization is set by the Username and Password fields on this page. Using these fields overwrites an authorization header in the table. You must clear the Username and Password fields to use your own authorization value in the HTTP Headers table.

• content-type is set by the Content Type field on this page. Using this field overwrites a content-type header in the table. You must clear the Content Type field to use your own content-type value in the HTTP Headers table.

9. If you want to save the new configuration, and push your changes to any affected Defense devices, click Commit. Then, on the pop-up dialog, click Commit to push the changes (alternatively, you can click Discard to discard any uncommitted changes).

Tip: You can use the CLI to debug the REST API configuration, by viewing the exact REST configuration sent for an announce or withdraw request. The following command enables you to announce or withdraw a DIP and then returns the HTTP request sent: request bgp- mitigation rtbh rest [announce-api|withdraw-api] test address <dipaddress>. Caution: Using the command to send an announce request will block traffic from the specified DIP,  just like manually adding a black hole. 

https://corero.my.site.com/support/servlet/servlet.FileDownload?file=00PTO0000057Otx