Configuring Blackhole

This section describes how to configure blackhole traffic diversion to defend against oversized volumes of attack traffic.

Context

You can configure blackhole traffic diversion for the blackhole router to divert the oversized volumes of traffic destined to specific IP addresses to a blackhole IP address. In this way, the large volumes of traffic will not occupy the inbound bandwidth of the cleaning device, and the services of other customers are ensured. After you enable blackhole traffic diversion, the blackhole router discards all traffic destined to the specified IP address. Exercise caution when you use this function.

Procedure

Configure a blackhole API.

Choose Defense > Policy Settings > Black Hole Traffic Diversion.
Click on the Blackhole page.

Select a service provider and set related parameters for authentication. At present, the service provider of China Telecom DamDDoS are supported.

Parameter	Description
Enable blackhole API	Whether to enable the blackhole API function of a service provider. You can create blackhole API traffic diversion policies only after enabling this function.
Default plugging policy	This parameter is supported only in DamDDoS. Default traffic blocking policy. Plugging the whole network Plug the other operators Plugging foreign operators Plug other operators (only telecom network access)
URL	URL of the service provider blackhole API.
Username	Authentication user name of the service provider blackhole API.
Password	Authentication password of the service provider blackhole API. The passwords must meet the minimum complexity requirement. That is, the passwords must contain at least three of the following, including upper-case letters (A to Z), lower-case letters (a to z), digits (0 to 9), and special characters (such as !, #, $, and %). You must change the passwords periodically.
Automatic releasing time	Aging time of blackhole API traffic diversion, which ranges from 5 to 1400 minutes. Blackhole API traffic diversion is automatically cancelled after this aging time is due.

Click Test to authenticate the service provider URL, user name, and password.
After the information is authenticated, click OK.

Create blackhole traffic diversion.
1. Choose Defense > Policy Settings > Black Hole Traffic Diversion.
2. Click on the Blackhole page.
3. Select a blackhole mode. Blackhole traffic diversion can be implemented through the cleaning device and service provider blackhole API.
4. Choose Clean Device or Service provider from the drop-down list and set the IP address and subnet mask for blackhole traffic diversion.
  After blackhole traffic diversion is configured, all traffic destined to the specified IP address is discarded.
5. Optional: Choose Automatically enable.
6. Click OK.