The article explains why the cpu utilization is high when there's flooding attack from internet to NAT address

In customer network, the cpu utilization for service-set is low as there's not much traffic going through CGNAT. Sometimes, the customer can see the following logs indicating the cpu utlization is high on a certain PIC. From the statistic graph, there was traffic surge on outside interface. The lab test confirm the our suspects. When there is a huge of traffic flow sending to CGNAT address, the cpu will spend cpu to delete these sessions, that's reason why cpu is high.

%PFE-1: (FPC Slot 5, PIC Slot 0) Global CPU zone change RED=>GREEN (70.20 %)

 %PFE-1: (FPC Slot 5, PIC Slot 0) CPU zone change RED=>GREEN (70.20 %)

%DAEMON-3-RTLOGD_CPU_LIMIT_TRAP: FPC5:PIC0 CPU zone change RED=>GREEN (70.00 %)

Pros:

• DDOS attacks similar to (ATAKOY) will be mitigated.
• Mitigation starts within seconds of an attack.
• When CPU usage is below 85% (threshold), the SPC3 card will drop only the malicious traffic targeting the attacked IP, allowing legitimate traffic to continue for the given NATTED IP.
• When CPU usage exceeds 85%, a dynamic firewall filter is applied on the PFE to block the Natted Victim IP, requiring no manual intervention.
• During an attack, the IDS will check the installed filter traffic count every 45 seconds to decide whether to remove the filter, dynamically removing it once the attack is over.

Cons:

• If CPU usage exceeds the threshold (>85%), mitigation will occur on the PFE using a dynamic firewall filter, causing all traffic for the attacked IP to be dropped. Subscribers using the attacked IP will lose internet service.

To solve the issue, we could use screen feature to limit session-rate going to ams interface. When session-rate or packet-rate exceeds the configured value, a dynamic filter is created on the FPC to drop the traffic. This will decrease the traffic from outside interface to ams outside interface.

Configuration Required:

set services service-set AMS0_NAT_SS syslog stream AMS0 category screen

set services service-set AMS1_NAT_SS syslog stream AMS1 category screen

set services service-set AMS0_NAT_SS ids-option ids-rule

set services service-set AMS1_NAT_SS ids-option ids-rule

set services screen cpu-throttle percentage 85

set services screen ids-option ids-rule match-direction output

set services screen ids-option ids-rule limit-session by-destination session-rate 1250