FastNetMon Advanced offers complete production ready integration with GCore Global DDoS protection service.
Please check your version of FastNetMon is 2.0.373 or newer.
To use this capability please create API access key in your portal this way:
How it works? When FastNetMon detects attack against IP address it determines /24 prefix for IP which is under attack and then announces it to Scrubbing Centre. When ban time expires FastNetMon removes announce from Scrubbing Centre using their API.
Then use fcli to to specify API key:
sudo fcli set plugin scrubbing_services_integration provider_name gcore sudo fcli set plugin scrubbing_services_integration gcore_api_token very-secure-code sudo fcli set plugin scrubbing_services_integration log_path /var/log/fastnetmon/fastnetmon_scrubbing_services_integration.log
And enable callback logic on FastNetMon:
sudo fcli set main notify_script_enabled enable sudo fcli set main notify_script_format json sudo fcli set main notify_script_path /opt/fastnetmon/libraries/scrubbing_services_integration_plugin/scrubbing_services_integration sudo fcli commit
After that we recommend manually blocking some IP address from test prefix and checking that it works as expected.
You can do it this way:
sudo fcli set blackhole 1.2.3.4
And then to unblock list all blocked hosts with their UUIDs:
sudo fcli show blackhole
And unblock it:
sudo fcli delete blackhole <uuid>
Integration logic has very detailed logging and you can find log file here: /var/log/fastnetmon/fastnetmon_scrubbing_services_integration.log