WAN defense mitigation service
A mitigation service may be used to mitigate a network attack in a network including a group of mitigation devices. Datagrams, intended for a customer that is subject of a network attack, may be received by at least one of the mitigation devices based on an anycast address associated with the mitigation devices. Each of the mitigation devices is addressable via the anycast address. The received datagrams may be processed to remove malicious datagrams and leave legitimate datagrams. The legitimate datagrams may be forwarded to the customer via a tunnel configured between an address associated with the customer and the anycast address associated with the mitigation devices.
1. A method comprising:
receiving, by a network device, traffic intended for a customer device based on a notification, from the customer device, indicating that the customer device is subject of a network attack;
determining, by the network device and based on receiving the traffic, a distance between the network device and each set of devices of a plurality of sets of devices,
each set of devices including a plurality of devices that includes one or more mitigation devices;
identifying, by the network device, a particular set of devices of the plurality of sets of devices based on determining the distance between the network device and each set of devices of the plurality of sets of devices,
the distance between the network device and the particular set of devices being shortest out of the distance between the network device and each set of devices of the plurality of sets of devices; and
redirecting, by the network device, the traffic to the particular set of devices using an anycast address associated with the one or more mitigation devices of the particular set of devices,
redirecting the traffic including:
redirecting the traffic intended for the customer device to the anycast address associated with the one or more mitigation devices of the particular set of devices,
identifying the particular set of devices and redirecting the traffic to the particular set of devices being part of a load-balancing technique,
each of the one or more mitigation devices, of the plurality of sets of devices, being addressable via the anycast address,
the traffic being redirected to the particular set of devices to cause the one or more mitigation devices of the particular set of devices to:
process the traffic to remove malicious traffic and leave legitimate traffic, and
forward the legitimate traffic to the customer device via a tunnel.
2. The method of claim 1 , where redirecting the traffic intended for the customer device further includes:
setting a next-hop attribute for a route or an address, associated with the customer device, to the anycast address associated with the one or more mitigation devices of the particular set of devices.
3. The method of claim 1 , where receiving the traffic includes:
receiving the traffic based on a next-hop attribute, of the traffic, associated with the customer device being changed by a particular network device as part of an ingress policy of the particular network device,
the particular network device being connected to the customer device.
4. The method of claim 1 , where the particular set of devices includes a first set of devices and a second set of devices, and
where redirecting the traffic intended for the customer device further includes:
forwarding a portion of the traffic to the first set of devices, and
forwarding another portion of the traffic to the second set of devices.
5. The method of claim 1 , where identifying the particular set of devices comprises:
identifying, by the network device, the particular set of devices based on a number of hops, between the network device and the particular set of devices, being less than a number of hops between the network device and another set of devices of the plurality of sets of devices.
6. The method of claim 1 , where the tunnel is configured for transmitting data between the anycast address, associated with the one or more mitigation devices of the particular set of devices, and an address associated with the customer device.
7. The method of claim 6 , where a configuration of the tunnel is same as a configuration of another tunnel that is used to send legitimate traffic to the customer device from the one or more mitigation devices of another set of devices of the plurality of sets of devices.
8. The method of claim 6 , where the one or more mitigation devices, of the particular set of devices, apply a tunnel encapsulation to the legitimate traffic, and
where the one or more mitigation devices, of the particular set of devices, forward the legitimate traffic with the tunnel encapsulation to the customer device via the tunnel.
9. A method comprising:
receiving, by a device, traffic intended for a customer device based on a notification, from the customer device, indicating that the customer device is subject of a network attack,
the traffic including malicious traffic and legitimate traffic;
identifying, by the device and based on receiving the traffic, a particular set of devices of a plurality of sets of devices based on a distance between the device and each set of devices of the plurality of sets of devices,
the distance between the device and the particular set of devices being shortest out of the distance between the device and each set of devices of the plurality of sets of devices,
the particular set of devices including a plurality of particular devices;
setting, by the device, a next-hop attribute of the traffic to an address associated with one or more particular devices of the plurality of particular devices; and
redirecting, by the device, the traffic to the particular set of devices based on setting the next-hop attribute of the traffic,
redirecting the traffic including:
redirecting the traffic to the address associated with the one or more particular devices of the plurality of particular devices,
identifying the particular set of devices and redirecting the traffic to the particular set of devices being part of a load-balancing technique,
the traffic being redirected to the particular set of devices to cause the one or more particular devices to:
process the traffic to remove the malicious traffic from the received traffic to obtain the legitimate traffic, and
forward the legitimate traffic to the customer device via a generic routing encapsulation (GRE) tunnel,
the GRE tunnel being configured by the customer device without being configured by the one or more particular devices.
10. The method of claim 9 , where a tunnel encapsulation is applied to the legitimate traffic prior to the legitimate traffic being forwarded to the customer device via the GRE tunnel.
11. The method of claim 9 , where redirecting the traffic to the particular set of devices based on setting the next-hop attribute of the traffic includes:
transmitting the traffic based on an anycast address associated with the one or more particular devices,
each of the one or more particular devices being addressable via the anycast address.
12. The method of claim 11 , where identifying the particular set of devices comprises:
identifying the particular set of devices based on a number of hops between the particular set of devices and the device.
13. The method of claim 9 , further comprising:
redirecting the traffic intended for the customer device to one or more sets of devices, of the plurality of sets of devices, using anycasting.
14. The method of claim 9 , further comprising:
forwarding a portion of the traffic intended for the customer device to a first set of devices of the particular set of devices, and
forwarding another portion of the traffic intended for the customer device to a second set of devices of the particular set of devices.
15. A system comprising:
a device to:
receive traffic intended for a customer device that is subject of a network attack,
the traffic including malicious traffic and legitimate traffic;
identify a particular set of devices, of a plurality of sets of devices, based on a distance between the device and each set of devices of the plurality of sets of devices,
the distance between the device and the particular set of devices being shortest out of the distance between the device and each set of devices of the plurality of sets of devices,
the particular set of devices including a plurality of particular devices;
set a next-hop attribute of the traffic to an address associated one or more particular devices of the plurality of particular devices; and
redirect the traffic to the particular set of devices based on setting the next-hop attribute of the traffic,
when redirecting the traffic, the device is to:
redirect the traffic to the address associated with the one or more particular devices of the plurality of particular devices,
the particular set of devices being identified and the traffic being redirected to the particular set of devices as part of a load-balancing technique,
the traffic being redirected to the particular set of devices to cause the one or more particular devices to:
process the traffic to remove the malicious traffic and leave the legitimate traffic, and
forward the legitimate traffic to the customer via a tunnel,
the tunnel being configured by the customer device without being configured by the one or more particular devices.
16. The system of claim 15 , where the tunnel is configured to transmit data from an anycast address, associated with the one or more particular devices, to an address associated with the customer device.
17. The system of claim 15 , where the tunnel includes a generic routing encapsulation tunnel that is used by the one or more particular devices to send legitimate traffic to the customer device.
18. The system of claim 15 , further comprising the one or more particular devices,
where the one or more particular devices are to:
apply a tunnel encapsulation to the legitimate traffic, and
forward the legitimate traffic with the tunnel encapsulation to the customer via the tunnel.
19. The system of claim 15 , where, when identifying the particular set of devices, the device is to:
identify the particular set of devices based on a number of hops between the particular set of devices and the device.
20. The system of claim 15 , where the device is further to:
receive, from the customer device, a notification of the network attack.
21. A system comprising:
a network device to:
receive traffic intended for a customer device that is subject of a network attack,
the traffic including malicious traffic and legitimate traffic;
identify a particular set of devices, of a plurality of sets of devices, based on a distance between the network device and each set of devices of the plurality of sets of devices,
the distance between the network device and the particular set of devices being shortest out of the distance between the network device and each set of devices of the plurality of sets of devices,
the particular set of devices including a plurality of particular devices;
set a next-hop attribute of the traffic to an address associated with one or more particular devices of the plurality of particular devices; and
transmit a particular portion of the traffic to the particular set of devices based on setting the next-hop attribute of the traffic,
when transmitting the particular portion of the traffic, the network device is to:
transmit the particular portion of the traffic to the address associated with the one or more particular devices of the plurality of particular devices,
the particular set of devices being identified and the particular portion of the traffic being transmitted to the particular set of devices as part of a load-balancing technique,
the particular portion of the traffic being transmitted to the particular set of devices to cause the one or more particular devices to:
process the particular portion of the traffic to remove the malicious traffic and leave the legitimate traffic, and
forward the legitimate traffic to the customer via a generic routing encapsulation (GRE) tunnel,
the GRE tunnel being configured by the customer device without being configured by the one or more particular devices.
22. The system of claim 21 , where the network device is further to:
transmit additional traffic, intended for the customer device, to another particular set of devices of the plurality of sets of devices,
the other particular set of devices including other particular devices,
the additional traffic being transmitted to the other particular devices to cause one or more of the other particular devices to:
process the additional traffic to remove additional malicious traffic from the additional traffic to obtain additional legitimate traffic, and
forward the additional legitimate traffic to the customer device via another GRE tunnel,
a configuration of the other GRE tunnel being same as a configuration of the GRE tunnel.
23. The system of claim 21 , where the network device is further to:
forward a portion of other traffic to a first set of devices of the plurality of sets of devices, and
forward another portion of the other traffic to a second set of devices of the plurality of sets of devices.
24. The method of claim 9 , further comprising:
transmitting additional traffic, intended for the customer device, to another particular set of devices of the plurality of sets of devices,
the other particular set of devices including other particular devices,
the additional traffic being transmitted to the other particular devices to cause one or more of the other particular devices to:
process the additional traffic to remove additional malicious traffic from the additional traffic to obtain additional legitimate traffic, and
forward the additional legitimate traffic to the customer device via another GRE tunnel,
the other GRE tunnel being configured by the customer device, without being configured by the one or more of the other particular devices, using a configuration that is same as a configuration of the GRE tunnel.