FastNetMon Advanced per-network hostgroups

FastNetMon Advanced provides an option to implement attack detection for all networks in FastNetMon configuration (as defined in networks_list) on per network basis. In this mode FastNetMon counts all traffic for particular prefix and sends alerts when total traffic for particular network exceeds defined value.

Current implementation does not allow to set thresholds for particular network. Same thresholds apply for all prefixes configured for your network.

To enable this logic please use following command:

sudo fcli set main enable_ban_network true
sudo fcli commit

Then you need to enable alerts for each protocol version (please note that IPv6 is not supported yet):

sudo fcli set main enable_ban_network_ipv4 true
sudo fcli set main enable_ban_network_ipv6 true
sudo fcli commit 

After that you need to create hostgroup with special name global_network_ipv4 and set calculation methoid to "network_ipv4":

sudo fcli set hostgroup global_network_ipv4
sudo fcli set hostgroup global_network_ipv4 calculation_method network_ipv4
sudo fcli set hostgroup global_network_ipv4 enable_ban true
sudo fcli set hostgroup global_network_ipv4 enable_ban_incoming true
sudo fcli set hostgroup global_network_ipv4 enable_ban_outgoing true
sudo fcli commit

Please do not forget to enable all thresholds for newly created hostgroup.

After that FastNetMon will show networks which exceed threshold in output of following command:

sudo fcli show network_block

You can manually block particular network this way:

sudo fcli set network_block 11.22.33.44/24

To unblock network you need to use UUID of network this way:

sudo fcli delete network_block <UUID>

We have full support of standard notify script for per network alerts and you can enable it this way:

sudo fcli set main notify_script_network_enabled true
sudo fcli set main notify_script_network_path /usr/local/bin/notify_json.py
sudo fcli commit

In addition to this logic we have so called BGP attribute mirroring option which reads BGP attributes from particular BGP session (defined by name) and overrides some of them:

sudo fcli set main bgp_announce_network_mirror_attributes_ipv4 true
sudo fcli set main bgp_announce_network_mirror_attributes_ipv6 true
sudo fcli set main bgp_announce_network_mirror_attributes_peer_name_ipv4 CORE_ROUTER_EXT
sudo fcli set main bgp_announce_network_mirror_attributes_peer_name_ipv6 CORE_ROUTER_EXT
sudo fcli commit

Then you can define BGP communities to use for these announces:

sudo fcli set main bgp_announce_network_communities_ipv4 65001:777
sudo fcli commit

With this configuration in place FastNetMon will read announces from your own routers and re-announce them with new communities and all original attributes in place.

Please note that no standalone BGP announces are supported for per network hostgroups yet.