PBR

Hello everyone,

The USG6620 is connected to an S7706 through a GE electrical interface. The USG6620 connects to the municipal office through an uplink GE optical interface, and the S7706 connects to the subordinate offices in the downstream direction.

Traffic from the extranet to the network segment corresponding to the server is diverted to the DDoS through BGP on the USG6620. The DDoS traffic is injected back to the USG6620 through PBR. After receiving the traffic, the USG6620 diverts the traffic to the intranet through PBR.

The configurations on the USG6620 are as follows:

bgp 100

 peer 10.10.100.18 as-number 100

 #

 ipv4-family unicast

  undo synchronization

  peer 10.10.100.18 enable

#

policy-based-route

 rule name DDos-YinLiu/HuiZhu

  ingress-interface GigabitEthernet1/0/7

  action pbr egress-interface GigabitEthernet1/0/5 next-hop 10.10.100.70

The AntiDDoS configuration is as follows:

bgp 100

 peer 10.10.100.17 as-number 100

 #

 ipv4-family unicast

  undo synchronization

  import-route unr

  peer 10.10.100.17 enable

  peer 10.10.100.17 route-policy 1 export

  peer 10.10.100.17 advertise-community

#

policy-based-route

 rule name huizhu

  ingress-interface GigabitEthernet1/0/6

  action pbr egress-interface GigabitEthernet1/0/7 next-hop 10.10.100.21

However, after the test, the policy-based routing redirection of the USG6620 does not take effect, and the extranet traffic cannot be diverted to the server after passing through the AntiDDoS.

Please help me! Thank you!