JUNI-RT-000680 - The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces - policer

Information

A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.

Solution

Configure storm control for each VPLS bridge domain. Base the rate limiting on expected traffic rates plus some additional capacity.

Configure a policer to rate limit traffic to provide storm control for all VPLS implementations as shown in the example.

[edit firewall]
set policer STORM_POLICER if-exceeding bandwidth-limit 10m burst-size-limit 5m
set policer STORM_POLICER then discard

Configure the filter to specify traffic types to rate limit broadcast, multicast, and unknown unicast storms as shown in the example.

[edit firewall family vpls filter VPLS_FLOOD_FILTER]
set term BROADCAST_TRAFFIC from traffic-type broadcast
set term BROADCAST_TRAFFIC then policer STORM_POLICER accept
set term MULTICAST_TRAFFIC from traffic-type multicast
set term MULTICAST_TRAFFIC then policer STORM_POLICER accept
set term UNKNOWN_UNICAST_TRAFFIC from traffic-type unknown-unicast
set term UNKNOWN_UNICAST_TRAFFIC then policer STORM_POLICER accept

Apply the storm control filter to all VPLS routing instances as shown in the example.

[edit routing-instances VPLS_CUST2]
set forwarding-options family vpls flood input VPLS_FLOOD_FILTER

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_Router_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(2), CAT|II, CCI|CCI-001095, Rule-ID|SV-217073r604135_rule, STIG-ID|JUNI-RT-000680, STIG-Legacy|SV-101137, STIG-Legacy|V-90927, Vuln-ID|V-217073

Plugin: Juniper

Control ID: b91d0492a5b5436a772dc003f63aaceb5ed71be3cdaa85797461c8cd039ed99c