-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfastnetmoon.txt
125 lines (87 loc) · 4.46 KB
/
fastnetmoon.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
wget https://install.fastnetmon.com/installer -Oinstaller
chmod +x installer
./installer
wget http://install.fastnetmon.com/installer -Oinstaller
chmod +x installer
./installer -install_graphic_stack
https://fastnetmon.com/docs-fnm-advanced/advanced-visual-traffic/
https://fastnetmon.com/docs-fnm-advanced/fastnetmon-attack-notification-in-grafana/
fcli
set main influxdb_database fastnetmon
set main influxdb_host 127.0.0.1
set main influxdb_port 8086
set main influxdb_push_period 1
set main influxdb enable
commit
fcli
set main networks_list 103.92.204.0/24
set main networks_list 103.92.205.0/24
set main networks_list 103.92.206.0/24
set main networks_list 103.92.207.0/24
commit
fcli
set main netflow enable
set main netflow_ports 2055
set main netflow_host 0.0.0.0
set main netflow_sampling_ratio 10
set main netflow_custom_sampling_ratio_enable enable
set main average_calculation_time 30
set main average_calculation_time_for_subnets 30
set main average_calculation_time_for_hostgroups 30
commit
fcli
set hostgroup zip-cyber-cafe
set hostgroup zip-cyber-cafe threshold_mbps 500
set hostgroup zip-cyber-cafe ban_for_bandwidth enable
set hostgroup zip-cyber-cafe enable_ban enable
set hostgroup zip-cyber-cafe networks 103.92.204.0/24
set hostgroup zip-cyber-cafe networks 103.92.205.0/24
set hostgroup zip-cyber-cafe networks 103.92.206.0/24
set hostgroup zip-cyber-cafe networks 103.92.207.0/24
commit
##bgp-config##
https://fastnetmon.com/docs-fnm-advanced/fastnetmon-bgp-unicast-configuration/
fcli
set bgp zip-cyber-cafe-bgp
set bgp zip-cyber-cafe-bgp local_asn 65001
set bgp zip-cyber-cafe-bgp remote_asn 65001
set bgp zip-cyber-cafe-bgp local_address 11.22.33.44
set bgp zip-cyber-cafe-bgp remote_address 22.33.44.55
set bgp zip-cyber-cafe-bgp active enable
commmit
++JUNIPER++RTBH++
set chassis fpc 4 sampling-instance ipfix
set chassis fpc 5 sampling-instance ipfix
set interfaces ae1 unit 422 family inet sampling input
set interfaces ae2 unit 705 family inet sampling input
set interfaces ae3 unit 403 family inet sampling input
set forwarding-options sampling instance ipfix input rate 40000
set forwarding-options sampling instance ipfix family inet output flow-server 59.153.100.158 port 2055
set forwarding-options sampling instance ipfix family inet output flow-server 59.153.100.158 version-ipfix template ipv4
set forwarding-options sampling instance ipfix family inet output inline-jflow source-address 59.153.100.157
set protocols bgp group FASTNET neighbor 59.153.100.158 local-address 59.153.100.157
set protocols bgp group FASTNET neighbor 59.153.100.158 import FASTNET_IN
set protocols bgp group FASTNET neighbor 59.153.100.158 export FASTNET_OUT
set protocols bgp group FASTNET neighbor 59.153.100.158 peer-as 134732
++UPSTREAM-RTBH-PEERS++
set policy-options community FASTNET-IN members 65535:666
set policy-options policy-statement FASTNET-IN term 1 from community FASTNET-IN
set policy-options policy-statement FASTNET-IN term 1 from route-filter 0.0.0.0/0 upto /32
set policy-options policy-statement FASTNET-IN term 1 then local-preference add 800
set policy-options policy-statement FASTNET-IN term 1 then accept
set policy-options policy-statement FASTNET-IN term 1000 then reject
set policy-options policy-statement FASTNET-OUT term 1000 then reject
++UPSTREAM-RTBH-PEERS++
set policy-options community LEVEL3-DDOS-TAG members 58682:444
set policy-options policy-statement L3-DDOS-OUT term 1 from community FASTNET_IN
set policy-options policy-statement L3-DDOS-OUT term 1 then community add LEVEL3-DDOS-TAG
set policy-options policy-statement L3-DDOS-OUT term 1 then accept
set policy-options policy-statement L3-DDOS-OUT term 2 from route-filter 59.153.100.1/32 exact
set policy-options policy-statement L3-DDOS-OUT term 2 from route-filter 59.153.100.2/32 exact
set policy-options policy-statement L3-DDOS-OUT term 2 from route-filter 59.153.100.3/32 exact
set policy-options policy-statement L3-DDOS-OUT term 2 from route-filter 59.153.100.4/32 exact
set policy-options policy-statement L3-DDOS-OUT term 2 from route-filter 59.153.100.5/32 exact
set policy-options policy-statement L3-DDOS-OUT term 2 then community add LEVEL3-DDOS-TAG
set policy-options policy-statement L3-DDOS-OUT term 2 then accept
set policy-options policy-statement L3-DDOS-OUT term 1000 then reject
set policy-options policy-statement L3-DDOS-IN term 1000 then reject