Figure 623 CAR
Like the previous network flooding mitigation techniques, CAR must be implemented by your service provider. Since CAR impacts the performance of a router, expect to pay extra to have your ISP run CAR at all times, or you can work out an agreement in which CAR is turned on after you first detect the attack. To configure CAR to implement the three preceding examples, you start by defining the traffic types by ACLs, as shown in the following example. permit means the traffic should be rate limited; der means it should be passed unmolested.
! ACL for ICMP Traffic access-list 102 permit icmp any any
! ACL for TCP SYN Traffic access-list 103 permit tcp any any syn
! ACL for UDP Traffic access-list 104 permit udp any any
After the ACLs are defined, the rate-limit statements are applied to each ACL. The rate-limit statements can be applied inbound or outbound; because these statements are generally made from the SP's perspective, they are all outbound. After the access list to match is defined, three rates are provided. Th first is the committed rate; in the case of ICMP, this is 100 Kbps. The next two numbers are the burst rate and the extended burst rate. The final statements define what the router should do when traffic conforms to the committed rate and what should be done when it exceeds the committed rate. In most cases, the conform action is transmit and the exceed action is drop. Here is what the commands look like:
Router(config)#interface S0
Router(config-if)#rate-limit output access-group 102 100000 8000 8000 conform-action transmit exceed-action drop
Router(config-if)#rate-limit output access-group 103 50000 4000 4000 conform-action transmit exceed-action drop
Router(config-if)#rate-limit output access-group 104 5000000 50000 50000 conform-action transmit exceed-action drop
Continue reading here: CAR Design Considerations
Was this article helpful?