Systems and methods for configuring encapsulation tunnels based on dynamic capacity checks
An automatic provisioning and configuration system for threat mitigation may be provided. Hardware and software resources may be automatically configured to designate a return path for forwarding clean data packets to a target network. A return path from a scrubbing center to the target network may be selected and configured, for example, based on the geographic location of the scrubbing center and information regarding available capacity of the return path to the target network, among other information. The system may also perform a set of dynamic checks to determine whether one or more scrubbing centers have capacity (and/or are likely to continue to have capacity) to provide an encapsulation tunnel between the scrubbing center and the target network for clean return traffic.
1. A method for mitigating threats in a network, comprising:
receiving, from a computing device, a first selection of a first threat mitigation system for protecting a target service;
dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service;
sending an indication of the available capacity to the computing device;
receiving, from the computing device, a second selection of a desired capacity of the threat mitigation system; and
automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity,
wherein identifying the available capacity comprises:
automatically determining, from a plurality of scrubbing centers of the threat mitigation system, an optimal scrubbing center for the target service based on at least one of geographic proximity or latency between the plurality of scrubbing centers and the target service; and
automatically determining existing routers in at least the optimal scrubbing center of the threat mitigation system, wherein the first router is one of the existing routers.
2. The method of claim 1 , wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system.
3. The method of claim 2 , wherein the identifying the available capacity includes identifying a number of existing encapsulation tunnels configured on the network interface card.
4. The method of claim 3 , wherein the identifying the available capacity includes predicting usage of the existing encapsulation tunnels.
5. The method of claim 1 , wherein the automatically configuring includes:
configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and
transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system and instructions for configuring the first encapsulation tunnel at the router of the target service.
6. The method of claim 5 further comprising:
identifying a second threat mitigation system;
concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and
transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service.
7. The method of claim 1 further comprising:
receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service;
receiving, at the first threat mitigation system, a network packet directed to the target service;
determining, by the first threat mitigation system, whether to forward the network packet based on the instructions;
in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service.
8. The method of claim 1 further comprising:
wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths.
9. A method for mitigating threats in a network, comprising:
causing display of a plurality of scrubbing centers of a threat mitigation system;
receiving, from a computing device, a first selection of a particular scrubbing center of the plurality of scrubbing centers for protecting a target service;
dynamically calculating available capacity of at least the particular scrubbing center to deliver traffic to the target service;
causing display of one or more bandwidth options for an encapsulation tunnel originating from the particular scrubbing center, wherein the one or more bandwidth options is at or below the available capacity;
receiving, from the computing device, a second selection of a desired bandwidth for the particular scrubbing center;
automatically configuring, in response to the second selection, a first encapsulation tunnel with the desired bandwidth for transmitting packets to the target service;
receiving, by the first scrubbing center a network packet directed to the target service;
determining, by the first scrubbing center, whether to forward the network packet to the target service; and
in response to determining to forward the network packet to the target service, transmitting the packet to the target service via the encapsulation tunnel,
wherein calculating the available capacity comprises:
automatically determining, from a plurality of scrubbing centers of the threat mitigation system, an optimal scrubbing center for the target service based on at least one of geographic proximity or latency between the plurality of scrubbing centers and the target service; and
determining existing routers in at least the optimal scrubbing center of the threat mitigation system, wherein the first router is one of the existing routers.
10. The method of claim 9 , wherein dynamically calculating available capacity comprises determining bandwidth of a network card in a first router of the particular scrubbing center.
11. The method of claim 10 , wherein dynamically calculating available capacity comprises identifying a number of existing encapsulation tunnels configured on the network interface card.
12. The method of claim 11 , wherein dynamically calculating available capacity comprises includes predicting usage of the existing encapsulation tunnels.
13. A system for mitigating threats in a network, comprising:
at least one processor; and
memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising:
receiving, from a computing device, a first selection of a first threat mitigation system for protecting a target service;
dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service;
sending an indication of the available capacity to the computing device;
receiving, from the computing device, a second selection of a desired capacity of the first threat mitigation system; and
automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity,
wherein identifying the available capacity comprises:
automatically determining, from a plurality of scrubbing centers of the threat mitigation system, an optimal scrubbing center for the target service based on at least one of geographic proximity or latency between the plurality of scrubbing centers and the target service; and
automatically determining existing routers in at least the optimal scrubbing center of the threat mitigation system, wherein the first router is one of the existing routers.
14. The system of claim 13 , wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system, identifying a number of existing encapsulation tunnels configured on the network interface card, and predicting usage of the existing encapsulation tunnels.
15. The system of claim 13 , wherein the automatically configuring includes:
configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and
transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system and instructions for configuring the first encapsulation tunnel at the router of the target service.
16. The system of claim 15 , wherein the method further comprises:
identifying a second threat mitigation system;
concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and
transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service.
17. The system of claim 13 , wherein the method further comprises:
receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service;
receiving, at the first threat mitigation system, a network packet directed to the target service;
determining, by the first threat mitigation system, whether to forward the network packet based on the instructions;
in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service.
18. The system of claim 13 , wherein the method further comprises:
wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths.