This article is intended to provide guidance on how to configure ddos-protection bandwidth and burst thresholds on Juniper Networks Routers and switches as they come with default thresholds applied on every protocol.

Customer has identified the traffic which triggered the DDOS-violations, but they are all expected packets from trusted sources. Customer wants to increase the ddos-protection bandwidth and burst thresholds to avoid the unnecessary drops on every DDOS violation event.

You can configure the bandwidth and burst thresholds under hierarchy [system ddos-protection protocols <protocol> aggregate] for specific protocol presenting DDOS violations. The best practice is to gradually increate these values with small changes and then monitor the CPU utilization to make sure that there is no high CPU. If still safe, you may continue increasing the thresholds until you have the desired values.

Commands to increase the DDOS protection thresholds:

user@switch# set system ddos-protection protocols vxlan aggregate bandwidth 3500
user@switch# set system ddos-protection protocols vxlan aggregate burst 3000

Monitoring CPU usage:

user@switch> show chassis routing-engine

Note: the idle represents the free CPU processing capacity in percentage. The higher the better.
Note: there is no suggested bandwidth and burst values as this depends entirely on every network environment needs.

2024-07-09 : Article Created

2026-04-03 : Added EX4400s to categories.