docs/bgp/bgp-user-guide-flowspec-family.rst

   1 .. _bgp-user-guide-flowspec-family:
   2
   3 Flow Specification Family
   4 =========================
   5 The BGP Flow Specification (BGP-FS) Multiprotocol extension can be used to distribute traffic flow specifications.
   6 For example, the BGP-FS can be used in a case of (distributed) denial-of-service (DDoS) attack mitigation procedures and traffic filtering (BGP/MPLS VPN service, DC).
   7
   8 .. contents:: Contents
   9    :depth: 2
  10    :local:
  11
  12 Configuration
  13 ^^^^^^^^^^^^^
  14 This section shows a way to enable BGP-FS family in BGP speaker and peer configuration.
  15
  16 BGP Speaker
  17 '''''''''''
  18 To enable BGP-FS support in BGP plugin, first configure BGP speaker instance:
  19
  20 **URL:** ``/restconf/config/openconfig-network-instance:network-instances/network-instance/global-bgp/openconfig-network-instance:protocols``
  21
  22 **RFC8040 URL:** ``/rests/data/openconfig-network-instance:network-instances/network-instance=global-bgp/protocols``
  23
  24 **Method:** ``POST``
  25
  26 .. tabs::
  27
  28    .. tab:: XML
  29
  30       **Content-Type:** ``application/xml``
  31
  32       **Request Body:**
  33
  34       .. code-block:: xml
  35
  36          <protocol xmlns="http://openconfig.net/yang/network-instance">
  37              <name>bgp-example</name>
  38              <identifier xmlns:x="http://openconfig.net/yang/policy-types">x:BGP</identifier>
  39              <bgp xmlns="urn:opendaylight:params:xml:ns:yang:bgp:openconfig-extensions">
  40                  <global>
  41                      <config>
  42                          <router-id>192.0.2.2</router-id>
  43                          <as>65000</as>
  44                      </config>
  45                      <afi-safis>
  46                          <afi-safi>
  47                              <afi-safi-name>IPV4-FLOW</afi-safi-name>
  48                          </afi-safi>
  49                          <afi-safi>
  50                              <afi-safi-name>IPV6-FLOW</afi-safi-name>
  51                          </afi-safi>
  52                          <afi-safi>
  53                              <afi-safi-name>IPV4-L3VPN-FLOW</afi-safi-name>
  54                          </afi-safi>
  55                          <afi-safi>
  56                              <afi-safi-name>IPV6-L3VPN-FLOW</afi-safi-name>
  57                          </afi-safi>
  58                      </afi-safis>
  59                  </global>
  60              </bgp>
  61          </protocol>
  62
  63    .. tab:: JSON
  64
  65       **Content-Type:** ``application/json``
  66
  67       **Request Body:**
  68
  69       .. code-block:: json
  70
  71          {
  72              "protocol": [
  73                  {
  74                      "identifier": "openconfig-policy-types:BGP",
  75                      "name": "bgp-example",
  76                      "bgp-openconfig-extensions:bgp": {
  77                          "global": {
  78                              "config": {
  79                                  "router-id": "192.0.2.2",
  80                                  "as": 65000
  81                              },
  82                              "afi-safis": {
  83                                  "afi-safi": [
  84                                      {
  85                                          "afi-safi-name": "IPV4-FLOW"
  86                                      },
  87                                      {
  88                                          "afi-safi-name": "IPV6-FLOW"
  89                                      },
  90                                      {
  91                                          "afi-safi-name": "IPV4-L3VPN-FLOW"
  92                                      },
  93                                      {
  94                                          "afi-safi-name": "IPV6-L3VPN-FLOW"
  95                                      }
  96                                  ]
  97                              }
  98                          }
  99                      }
 100                  }
 101              ]
 102          }
 103
 104 BGP Peer
 105 ''''''''
 106 Here is an example for BGP peer configuration with enabled BGP-FS family.
 107
 108 **URL:** ``/restconf/config/openconfig-network-instance:network-instances/network-instance/global-bgp/openconfig-network-instance:protocols/protocol/openconfig-policy-types:BGP/bgp-example/bgp/neighbors``
 109
 110 **Method:** ``POST``
 111
 112 .. tabs::
 113
 114    .. tab:: XML
 115
 116       **Content-Type:** ``application/xml``
 117
 118       **Request Body:**
 119
 120       .. code-block:: xml
 121
 122          <neighbor xmlns="urn:opendaylight:params:xml:ns:yang:bgp:openconfig-extensions">
 123              <neighbor-address>192.0.2.1</neighbor-address>
 124              <afi-safis>
 125                  <afi-safi>
 126                      <afi-safi-name>IPV4-FLOW</afi-safi-name>
 127                  </afi-safi>
 128                  <afi-safi>
 129                      <afi-safi-name>IPV6-FLOW</afi-safi-name>
 130                  </afi-safi>
 131                  <afi-safi>
 132                      <afi-safi-name>IPV4-L3VPN-FLOW</afi-safi-name>
 133                  </afi-safi>
 134                  <afi-safi>
 135                      <afi-safi-name>IPV6-L3VPN-FLOW</afi-safi-name>
 136                  </afi-safi>
 137              </afi-safis>
 138          </neighbor>
 139
 140    .. tab:: JSON
 141
 142       **Content-Type:** ``application/json``
 143
 144       **Request Body:**
 145
 146       .. code-block:: json
 147
 148          {
 149              "neighbor": [
 150                  {
 151                      "neighbor-address": "192.0.2.1",
 152                      "afi-safis": {
 153                          "afi-safi": [
 154                              {
 155                                  "afi-safi-name": "IPV4-FLOW"
 156                              },
 157                              {
 158                                  "afi-safi-name": "IPV6-FLOW"
 159                              },
 160                              {
 161                                  "afi-safi-name": "IPV4-L3VPN-FLOW"
 162                              },
 163                              {
 164                                  "afi-safi-name": "IPV6-L3VPN-FLOW"
 165                              }
 166                          ]
 167                      }
 168                  }
 169              ]
 170          }
 171
 172 Flow Specification API
 173 ^^^^^^^^^^^^^^^^^^^^^^
 174 Following trees illustrate the BGP Flow Specification routes structure.
 175
 176 IPv4 Flow Specification Route
 177 '''''''''''''''''''''''''''''
 178 .. code-block:: console
 179
 180    :(flowspec-routes-case)
 181      +--ro flowspec-routes
 182         +--ro flowspec-route* [route-key path-id]
 183            +--ro route-key     string
 184            +--ro flowspec*
 185            |  +--ro (flowspec-type)?
 186            |     +--:(port-case)
 187            |     |  +--ro ports*
 188            |     |     +--ro op?      numeric-operand
 189            |     |     +--ro value?   uint16
 190            |     +--:(destination-port-case)
 191            |     |  +--ro destination-ports*
 192            |     |     +--ro op?      numeric-operand
 193            |     |     +--ro value?   uint16
 194            |     +--:(source-port-case)
 195            |     |  +--ro source-ports*
 196            |     |     +--ro op?      numeric-operand
 197            |     |     +--ro value?   uint16
 198            |     +--:(icmp-type-case)
 199            |     |  +--ro types*
 200            |     |     +--ro op?      numeric-operand
 201            |     |     +--ro value?   uint8
 202            |     +--:(icmp-code-case)
 203            |     |  +--ro codes*
 204            |     |     +--ro op?      numeric-operand
 205            |     |     +--ro value?   uint8
 206            |     +--:(tcp-flags-case)
 207            |     |  +--ro tcp-flags*
 208            |     |     +--ro op?      bitmask-operand
 209            |     |     +--ro value?   uint16
 210            |     +--:(packet-length-case)
 211            |     |  +--ro packet-lengths*
 212            |     |     +--ro op?      numeric-operand
 213            |     |     +--ro value?   uint16
 214            |     +--:(dscp-case)
 215            |     |  +--ro dscps*
 216            |     |     +--ro op?      numeric-operand
 217            |     |     +--ro value?   dscp
 218            |     +--:(fragment-case)
 219            |     |  +--ro fragments*
 220            |     |     +--ro op?      bitmask-operand
 221            |     |     +--ro value?   fragment
 222            |     +--:(destination-prefix-case)
 223            |     |  +--ro destination-prefix?   inet:ipv4-prefix
 224            |     +--:(source-prefix-case)
 225            |     |  +--ro source-prefix?        inet:ipv4-prefix
 226            |     +--:(protocol-ip-case)
 227            |        +--ro protocol-ips*
 228            |           +--ro op?      numeric-operand
 229            |           +--ro value?   uint8
 230            +--ro path-id       path-id
 231            +--ro attributes
 232               +--ro extended-communities*
 233                  +--ro transitive?                             boolean
 234                  +--ro (extended-community)?
 235                     +--:(traffic-rate-extended-community-case)
 236                     |  +--ro traffic-rate-extended-community
 237                     |     +--ro informative-as?        bgp-t:short-as-number
 238                     |     +--ro local-administrator?   netc:bandwidth
 239                     +--:(traffic-action-extended-community-case)
 240                     |  +--ro traffic-action-extended-community
 241                     |     +--ro sample?            boolean
 242                     |     +--ro terminal-action?   boolean
 243                     +--:(redirect-extended-community-case)
 244                     |  +--ro redirect-extended-community
 245                     |     +--ro global-administrator?   bgp-t:short-as-number
 246                     |     +--ro local-administrator?    binary
 247                     +--:(traffic-marking-extended-community-case)
 248                     |  +--ro traffic-marking-extended-community
 249                     |     +--ro global-administrator?   dscp
 250                     +--:(redirect-ipv4-extended-community-case)
 251                     |  +--ro redirect-ipv4
 252                     |     +--ro global-administrator?   inet:ipv4-address
 253                     |     +--ro local-administrator?    uint16
 254                     +--:(redirect-as4-extended-community-case)
 255                     |  +--ro redirect-as4
 256                     |     +--ro global-administrator?   inet:as-number
 257                     |     +--ro local-administrator?    uint16
 258                     +--:(redirect-ip-nh-extended-community-case)
 259                       +--ro redirect-ip-nh-extended-community
 260                          +--ro next-hop-address?   inet:ip-address
 261                          +--ro copy?               boolean
 262
 263
 264 IPv6 Flow Specification Route
 265 '''''''''''''''''''''''''''''
 266 .. code-block:: console
 267
 268    :(flowspec-ipv6-routes-case)
 269      +--ro flowspec-ipv6-routes
 270         +--ro flowspec-route* [route-key path-id]
 271            +--ro flowspec*
 272            |  +--ro (flowspec-type)?
 273            |     +--:(port-case)
 274            |     |  +--ro ports*
 275            |     |     +--ro op?      numeric-operand
 276            |     |     +--ro value?   uint16
 277            |     +--:(destination-port-case)
 278            |     |  +--ro destination-ports*
 279            |     |     +--ro op?      numeric-operand
 280            |     |     +--ro value?   uint16
 281            |     +--:(source-port-case)
 282            |     |  +--ro source-ports*
 283            |     |     +--ro op?      numeric-operand
 284            |     |     +--ro value?   uint16
 285            |     +--:(icmp-type-case)
 286            |     |  +--ro types*
 287            |     |     +--ro op?      numeric-operand
 288            |     |     +--ro value?   uint8
 289            |     +--:(icmp-code-case)
 290            |     |  +--ro codes*
 291            |     |     +--ro op?      numeric-operand
 292            |     |     +--ro value?   uint8
 293            |     +--:(tcp-flags-case)
 294            |     |  +--ro tcp-flags*
 295            |     |     +--ro op?      bitmask-operand
 296            |     |     +--ro value?   uint16
 297            |     +--:(packet-length-case)
 298            |     |  +--ro packet-lengths*
 299            |     |     +--ro op?      numeric-operand
 300            |     |     +--ro value?   uint16
 301            |     +--:(dscp-case)
 302            |     |  +--ro dscps*
 303            |     |     +--ro op?      numeric-operand
 304            |     |     +--ro value?   dscp
 305            |     +--:(fragment-case)
 306            |     |  +--ro fragments*
 307            |     |     +--ro op?      bitmask-operand
 308            |     |     +--ro value?   fragment
 309            |     +--:(destination-ipv6-prefix-case)
 310            |     |  +--ro destination-prefix?   inet:ipv6-prefix
 311            |     +--:(source-ipv6-prefix-case)
 312            |     |  +--ro source-prefix?        inet:ipv6-prefix
 313            |     +--:(next-header-case)
 314            |     |  +--ro next-headers*
 315            |     |     +--ro op?      numeric-operand
 316            |     |     +--ro value?   uint8
 317            |     +--:(flow-label-case)
 318            |        +--ro flow-label*
 319            |           +--ro op?      numeric-operand
 320            |           +--ro value?   uint32
 321            +--ro path-id       path-id
 322            +--ro attributes
 323               +--ro extended-communities*
 324                  +--ro transitive?                             boolean
 325                  +--ro (extended-community)?
 326                     +--:(traffic-rate-extended-community-case)
 327                     |  +--ro traffic-rate-extended-community
 328                     |     +--ro informative-as?        bgp-t:short-as-number
 329                     |     +--ro local-administrator?   netc:bandwidth
 330                     +--:(traffic-action-extended-community-case)
 331                     |  +--ro traffic-action-extended-community
 332                     |     +--ro sample?            boolean
 333                     |     +--ro terminal-action?   boolean
 334                     +--:(redirect-extended-community-case)
 335                     |  +--ro redirect-extended-community
 336                     |     +--ro global-administrator?   bgp-t:short-as-number
 337                     |     +--ro local-administrator?    binary
 338                     +--:(traffic-marking-extended-community-case)
 339                     |  +--ro traffic-marking-extended-community
 340                     |     +--ro global-administrator?   dscp
 341                     +--:(redirect-ipv6-extended-community-case)
 342                     |  +--ro redirect-ipv6
 343                     |     +--ro global-administrator?   inet:ipv6-address
 344                     |     +--ro local-administrator?    uint16
 345                     +--:(redirect-as4-extended-community-case)
 346                     |  +--ro redirect-as4
 347                     |     +--ro global-administrator?   inet:as-number
 348                     |     +--ro local-administrator?    uint16
 349                     +--:(redirect-ip-nh-extended-community-case)
 350                        +--ro redirect-ip-nh-extended-community
 351                           +--ro next-hop-address?   inet:ip-address
 352                           +--ro copy?               boolean
 353
 354 Usage
 355 ^^^^^
 356 The flowspec route represents rules and an action, defined as an extended community.
 357
 358 IPv4 Flow Specification
 359 '''''''''''''''''''''''
 360 The IPv4 Flowspec table in an instance of the speaker's Loc-RIB can be verified via REST:
 361
 362 **URL:** ``/restconf/operational/bgp-rib:bgp-rib/rib/bgp-example/loc-rib/tables/bgp-types:ipv4-address-family/bgp-flowspec:flowspec-subsequent-address-family/bgp-flowspec:flowspec-routes``
 363
 364 **Method:** ``GET``
 365
 366 .. tabs::
 367
 368    .. tab:: XML
 369
 370       **Response Body:**
 371
 372       .. code-block:: xml
 373
 374          <flowspec-routes xmlns="urn:opendaylight:params:xml:ns:yang:bgp-flowspec">
 375              <flowspec-route>
 376                  <path-id>0</path-id>
 377                  <route-key>all packets to 192.168.0.1/32 AND from 10.0.0.2/32 AND where IP protocol equals to 17 or equals to 6 AND where port equals to 80 or equals to 8080 AND where destination port is greater than 8080 and is less than 8088 or equals to 3128 AND where source port is greater than 1024 </route-key>
 378                  <attributes>
 379                      <local-pref>
 380                          <pref>100</pref>
 381                      </local-pref>
 382                      <origin>
 383                          <value>igp</value>
 384                      </origin>
 385                      <as-path></as-path>
 386                      <extended-communities>
 387                          <transitive>true</transitive>
 388                          <redirect-extended-community>
 389                              <local-administrator>AgMWLg==</local-administrator>
 390                              <global-administrator>258</global-administrator>
 391                          </redirect-extended-community>
 392                      </extended-communities>
 393                  </attributes>
 394                  <flowspec>
 395                      <destination-prefix>192.168.0.1/32</destination-prefix>
 396                  </flowspec>
 397                  <flowspec>
 398                      <source-prefix>10.0.0.2/32</source-prefix>
 399                  </flowspec>
 400                  <flowspec>
 401                      <protocol-ips>
 402                          <op>equals</op>
 403                          <value>17</value>
 404                      </protocol-ips>
 405                      <protocol-ips>
 406                          <op>equals end-of-list</op>
 407                          <value>6</value>
 408                      </protocol-ips>
 409                  </flowspec>
 410                  <flowspec>
 411                      <ports>
 412                          <op>equals</op>
 413                          <value>80</value>
 414                      </ports>
 415                      <ports>
 416                          <op>equals end-of-list</op>
 417                          <value>8080</value>
 418                      </ports>
 419                  </flowspec>
 420                  <flowspec>
 421                      <destination-ports>
 422                          <op>greater-than</op>
 423                          <value>8080</value>
 424                      </destination-ports>
 425                      <destination-ports>
 426                          <op>less-than and-bit</op>
 427                          <value>8088</value>
 428                      </destination-ports>
 429                      <destination-ports>
 430                          <op>equals end-of-list</op>
 431                          <value>3128</value>
 432                      </destination-ports>
 433                  </flowspec>
 434                  <flowspec>
 435                      <source-ports>
 436                          <op>end-of-list greater-than</op>
 437                          <value>1024</value>
 438                      </source-ports>
 439                  </flowspec>
 440              </flowspec-route>
 441          </flowspec-routes>
 442
 443    .. tab:: JSON
 444
 445       **Response Body:**
 446
 447       .. code-block:: json
 448
 449          {
 450              "flowspec-routes": {
 451                  "flowspec-route": {
 452                      "path-id": 0,
 453                      "route-key": "all packets to 192.168.0.1/32 AND from 10.0.0.2/32 AND where IP protocol equals to 17 or equals to 6 AND where port equals to 80 or equals to 8080 AND where destination port is greater than 8080 and is less than 8088 or equals to 3128 AND where source port is greater than 1024",
 454                      "attributes": {
 455                          "local-pref": {
 456                              "pref": 100
 457                          },
 458                          "origin": {
 459                              "value": "igp"
 460                          },
 461                          "extended-communities": {
 462                              "transitive": "true",
 463                              "redirect-extended-community": {
 464                                  "local-administrator": "AgMWLg==",
 465                                  "global-administrator": 258
 466                              }
 467                          }
 468                      },
 469                      "flowspec": [
 470                          {
 471                              "destination-prefix": "192.168.0.1/32"
 472                          },
 473                          {
 474                              "source-prefix": "10.0.0.2/32"
 475                          },
 476                          {
 477                              "protocol-ips": [
 478                                  {
 479                                      "op": "equals",
 480                                      "value": 17
 481                                  },
 482                                  {
 483                                      "op": "equals end-of-list",
 484                                      "value": 6
 485                                  }
 486                              ]
 487                          },
 488                          {
 489                              "ports": [
 490                                  {
 491                                      "op": "equals",
 492                                      "value": 80
 493                                  },
 494                                  {
 495                                      "op": "equals end-of-list",
 496                                      "value": 8080
 497                                  }
 498                              ]
 499                          },
 500                          {
 501                              "destination-ports": [
 502                                  {
 503                                      "op": "greater-than",
 504                                      "value": 8080
 505                                  },
 506                                  {
 507                                      "op": "less-than and-bit",
 508                                      "value": 8088
 509                                  },
 510                                  {
 511                                      "op": "equals end-of-list",
 512                                      "value": 3128
 513                                  }
 514                              ]
 515                          },
 516                          {
 517                              "source-ports": {
 518                                  "op": "end-of-list greater-than",
 519                                  "value": 1024
 520                              }
 521                          }
 522                      ]
 523                  }
 524              }
 525          }
 526
 527 IPv6 Flows Specification
 528 ''''''''''''''''''''''''
 529 The IPv6 Flowspec table in an instance of the speaker's Loc-RIB can be verified via REST:
 530
 531 **URL:** ``/restconf/operational/bgp-rib:bgp-rib/rib/bgp-example/loc-rib/tables/bgp-types:ipv6-address-family/bgp-flowspec:flowspec-subsequent-address-family/bgp-flowspec:flowspec-ipv6-routes``
 532
 533 **Method:** ``GET``
 534
 535 .. tabs::
 536
 537    .. tab:: XML
 538
 539       **Response Body:**
 540
 541       .. code-block:: xml
 542
 543          <flowspec-ipv6-routes xmlns="urn:opendaylight:params:xml:ns:yang:bgp-flowspec">
 544              <flowspec-route>
 545                  <path-id>0</path-id>
 546                  <route-key>all packets to 2001:db8:31::/64 AND from 2001:db8:30::/64 AND where next header equals to 17 AND where DSCP equals to 50 AND where flow label equals to 2013 </route-key>
 547                  <attributes>
 548                      <local-pref>
 549                          <pref>100</pref>
 550                      </local-pref>
 551                      <origin>
 552                          <value>igp</value>
 553                      </origin>
 554                      <as-path></as-path>
 555                      <extended-communities>
 556                          <transitive>true</transitive>
 557                          <traffic-rate-extended-community>
 558                              <informative-as>0</informative-as>
 559                              <local-administrator>AAAAAA==</local-administrator>
 560                          </traffic-rate-extended-community>
 561                      </extended-communities>
 562                  </attributes>
 563                  <flowspec>
 564                      <destination-prefix>2001:db8:31::/64</destination-prefix>
 565                  </flowspec>
 566                  <flowspec>
 567                      <source-prefix>2001:db8:30::/64</source-prefix>
 568                  </flowspec>
 569                  <flowspec>
 570                      <next-headers>
 571                          <op>equals end-of-list</op>
 572                          <value>17</value>
 573                      </next-headers>
 574                  </flowspec>
 575                  <flowspec>
 576                      <dscps>
 577                          <op>equals end-of-list</op>
 578                          <value>50</value>
 579                      </dscps>
 580                  </flowspec>
 581                  <flowspec>
 582                      <flow-label>
 583                          <op>equals end-of-list</op>
 584                          <value>2013</value>
 585                      </flow-label>
 586                  </flowspec>
 587              </flowspec-route>
 588          </flowspec-ipv6-routes>
 589
 590    .. tab:: JSON
 591
 592       **Response Body:**
 593
 594       .. code-block:: json
 595
 596          {
 597              "flowspec-ipv6-routes": {
 598                  "flowspec-route": {
 599                      "path-id": 0,
 600                      "route-key": "all packets to 2001:db8:31::/64 AND from 2001:db8:30::/64 AND where next header equals to 17 AND where DSCP equals to 50 AND where flow label equals to 2013",
 601                      "attributes": {
 602                          "local-pref": {
 603                              "pref": 100
 604                          },
 605                          "origin": {
 606                              "value": "igp"
 607                          },
 608                          "extended-communities": {
 609                              "transitive": true,
 610                              "traffic-rate-extended-community": {
 611                                  "informative-as": 0,
 612                                  "local-administrator": "AAAAAA=="
 613                              }
 614                          }
 615                      },
 616                      "flowspec": [
 617                          {
 618                              "destination-prefix": "2001:db8:31::/64"
 619                          },
 620                          {
 621                              "source-prefix": "2001:db8:30::/64"
 622                          },
 623                          {
 624                              "next-headers": {
 625                                  "op": "equals end-of-list",
 626                                  "value": 17
 627                              }
 628                          },
 629                          {
 630                              "dscps": {
 631                                  "op": "equals end-of-list",
 632                                  "value": 50
 633                              }
 634                          },
 635                          {
 636                              "flow-label": {
 637                                  "op": "equals end-of-list",
 638                                  "value": 2013
 639                              }
 640                          }
 641                      ]
 642                  }
 643              }
 644          }
 645
 646
 647 IPv4 L3VPN Flows Specification
 648 ''''''''''''''''''''''''''''''
 649 The IPv4 L3VPN Flowspec table in an instance of the speaker's Loc-RIB can be verified via REST:
 650
 651 **URL:** ``/restconf/operational/bgp-rib:bgp-rib/rib/bgp-example/loc-rib/tables/bgp-types:ipv4-address-family/bgp-flowspec:flowspec-l3vpn-subsequent-address-family/bgp-flowspec:flowspec-l3vpn-ipv4-routes``
 652
 653 **Method:** ``GET``
 654
 655 .. tabs::
 656
 657    .. tab:: XML
 658
 659       **Response Body:**
 660
 661       .. code-block:: xml
 662
 663          <flowspec-l3vpn-ipv4-routes xmlns="urn:opendaylight:params:xml:ns:yang:bgp-flowspec">
 664              <flowspec-l3vpn-route>
 665                  <path-id>0</path-id>
 666                  <route-key>[l3vpn with route-distinguisher 172.16.0.44:101] all packets from 10.0.0.3/32</route-key>
 667                  <attributes>
 668                      <local-pref>
 669                          <pref>100</pref>
 670                      </local-pref>
 671                      <ipv4-next-hop>
 672                          <global>5.6.7.8</global>
 673                      </ipv4-next-hop>
 674                      <origin>
 675                          <value>igp</value>
 676                      </origin>
 677                      <as-path></as-path>
 678                      <extended-communities>
 679                          <transitive>true</transitive>
 680                          <redirect-ip-nh-extended-community>
 681                              <copy>false</copy>
 682                              <next-hop-address>0.0.0.0</next-hop-address>
 683                          </redirect-ip-nh-extended-community>
 684                      </extended-communities>
 685                  </attributes>
 686                  <route-distinguisher>172.16.0.44:101</route-distinguisher>
 687                  <flowspec>
 688                      <source-prefix>10.0.0.3/32</source-prefix>
 689                  </flowspec>
 690              </flowspec-l3vpn-route>
 691          </flowspec-l3vpn-ipv4-routes>
 692
 693    .. tab:: JSON
 694
 695       **Response Body:**
 696
 697       .. code-block:: json
 698
 699          {
 700              "flowspec-l3vpn-ipv4-routes": {
 701                  "flowspec-l3vpn-route": {
 702                      "path-id": 0,
 703                      "route-key": "[l3vpn with route-distinguisher 172.16.0.44:101] all packets from 10.0.0.3/32",
 704                      "attributes": {
 705                          "local-pref": {
 706                              "pref": 100
 707                          },
 708                          "ipv4-next-hop": {
 709                              "global":"5.6.7.8"
 710                          },
 711                          "origin": {
 712                              "value": "igp"
 713                          },
 714                          "extended-communities": {
 715                              "transitive": true,
 716                              "redirect-ip-nh-extended-community": {
 717                                  "copy": false,
 718                                  "next-hop-address": "0.0.0.0"
 719                              }
 720                          }
 721                      },
 722                      "route-distinguisher": "172.16.0.44:101",
 723                      "flowspec": {
 724                          "source-prefix": "10.0.0.3/32"
 725                      }
 726                  }
 727              }
 728          }
 729
 730 Programming
 731 ^^^^^^^^^^^
 732 IPv4 Flow Specification
 733 '''''''''''''''''''''''
 734 This examples show how to originate and remove IPv4 fowspec route via programmable RIB.
 735 Make sure the *Application Peer* is configured first.
 736
 737 **URL:** ``/restconf/config/bgp-rib:application-rib/10.25.1.9/tables/bgp-types:ipv4-address-family/bgp-flowspec:flowspec-subsequent-address-family/bgp-flowspec:flowspec-routes``
 738
 739 **Method:** ``POST``
 740
 741 .. tabs::
 742
 743    .. tab:: XML
 744
 745       **Content-Type:** ``application/xml``
 746
 747       **Request Body:**
 748
 749       .. code-block:: xml
 750
 751          <flowspec-route xmlns="urn:opendaylight:params:xml:ns:yang:bgp-flowspec">
 752              <route-key>flow1</route-key>
 753              <path-id>0</path-id>
 754              <flowspec>
 755                  <destination-prefix>192.168.0.1/32</destination-prefix>
 756              </flowspec>
 757              <flowspec>
 758                  <source-prefix>10.0.0.1/32</source-prefix>
 759              </flowspec>
 760              <flowspec>
 761                  <protocol-ips>
 762                      <op>equals end-of-list</op>
 763                      <value>6</value>
 764                  </protocol-ips>
 765              </flowspec>
 766              <flowspec>
 767                  <ports>
 768                      <op>equals end-of-list</op>
 769                      <value>80</value>
 770                  </ports>
 771              </flowspec>
 772              <flowspec>
 773                  <destination-ports>
 774                      <op>greater-than</op>
 775                      <value>8080</value>
 776                  </destination-ports>
 777                  <destination-ports>
 778                      <op>and-bit less-than end-of-list</op>
 779                      <value>8088</value>
 780                  </destination-ports>
 781              </flowspec>
 782              <flowspec>
 783                  <source-ports>
 784                      <op>greater-than end-of-list</op>
 785                      <value>1024</value>
 786                  </source-ports>
 787              </flowspec>
 788              <flowspec>
 789                  <types>
 790                      <op>equals end-of-list</op>
 791                      <value>0</value>
 792                  </types>
 793              </flowspec>
 794              <flowspec>
 795                  <codes>
 796                      <op>equals end-of-list</op>
 797                      <value>0</value>
 798                  </codes>
 799              </flowspec>
 800              <flowspec>
 801                  <tcp-flags>
 802                      <op>match end-of-list</op>
 803                      <value>32</value>
 804                  </tcp-flags>
 805              </flowspec>
 806              <flowspec>
 807                  <packet-lengths>
 808                      <op>greater-than</op>
 809                      <value>400</value>
 810                  </packet-lengths>
 811                  <packet-lengths>
 812                      <op>and-bit less-than end-of-list</op>
 813                      <value>500</value>
 814                  </packet-lengths>
 815              </flowspec>
 816              <flowspec>
 817                  <dscps>
 818                      <op>equals end-of-list</op>
 819                      <value>20</value>
 820                  </dscps>
 821              </flowspec>
 822              <flowspec>
 823                  <fragments>
 824                      <op>match end-of-list</op>
 825                      <value>first</value>
 826                  </fragments>
 827              </flowspec>
 828              <attributes>
 829                  <origin>
 830                      <value>igp</value>
 831                  </origin>
 832                  <as-path/>
 833                  <local-pref>
 834                      <pref>100</pref>
 835                  </local-pref>
 836                  <extended-communities>
 837                      ....
 838                  </extended-communities>
 839              </attributes>
 840          </flowspec-route>
 841
 842    .. tab:: JSON
 843
 844       **Content-Type:** ``application/json``
 845
 846       **Request Body:**
 847
 848       .. code-block:: json
 849
 850          {
 851              "flowspec-route": [
 852                  {
 853                      "route-key": "flow1",
 854                      "path-id": 0,
 855                      "flowspec": [
 856                          {
 857                              "destination-prefix": "192.168.0.1/32"
 858                          },
 859                          {
 860                              "source-prefix": "10.0.0.1/32"
 861                          },
 862                          {
 863                              "protocol-ips": [
 864                                  {
 865                                      "op": "end-of-list equals",
 866                                      "value": 6
 867                                  }
 868                              ]
 869                          },
 870                          {
 871                              "ports": [
 872                                  {
 873                                      "op": "end-of-list equals",
 874                                      "value": 80
 875                                  }
 876                              ]
 877                          },
 878                          {
 879                              "destination-ports": [
 880                                  {
 881                                      "op": "greater-than",
 882                                      "value": 8080
 883                                  },
 884                                  {
 885                                      "op": "end-of-list and-bit less-than",
 886                                      "value": 8088
 887                                  }
 888                              ]
 889                          },
 890                          {
 891                              "source-ports": [
 892                                  {
 893                                      "op": "end-of-list greater-than",
 894                                      "value": 1024
 895                                  }
 896                              ]
 897                          },
 898                          {
 899                              "types": [
 900                                  {
 901                                      "op": "end-of-list equals",
 902                                      "value": 0
 903                                  }
 904                              ]
 905                          },
 906                          {
 907                              "codes": [
 908                                  {
 909                                      "op": "end-of-list equals",
 910                                      "value": 0
 911                                  }
 912                              ]
 913                          },
 914                          {
 915                              "tcp-flags": [
 916                                  {
 917                                      "op": "end-of-list match",
 918                                      "value": 32
 919                                  }
 920                              ]
 921                          },
 922                          {
 923                              "packet-lengths": [
 924                                  {
 925                                      "op": "greater-than",
 926                                      "value": 400
 927                                  },
 928                                  {
 929                                      "op": "end-of-list and-bit less-than",
 930                                      "value": 500
 931                                  }
 932                              ]
 933                          },
 934                          {
 935                              "dscps": [
 936                                  {
 937                                      "op": "end-of-list equals",
 938                                      "value": 20
 939                                  }
 940                              ]
 941                          },
 942                          {
 943                              "fragments": [
 944                                  {
 945                                      "op": "end-of-list match",
 946                                      "value": "first"
 947                                  }
 948                              ]
 949                          }
 950                      ],
 951                      "attributes": {
 952                          "origin": {
 953                              "value": "igp"
 954                          },
 955                          "local-pref": {
 956                              "pref": 100
 957                          }
 958                      }
 959                  }
 960              ]
 961          }
 962
 963 -----
 964
 965 **Extended Communities**
 966
 967 * **Traffic Rate**
 968
 969 .. tabs::
 970
 971    .. tab:: XML
 972
 973       .. code-block:: xml
 974          :linenos:
 975          :emphasize-lines: 5
 976
 977          <extended-communities>
 978              <transitive>true</transitive>
 979              <traffic-rate-extended-community>
 980                  <informative-as>123</informative-as>
 981                  <local-administrator>AAAAAA==</local-administrator>
 982               </traffic-rate-extended-community>
 983          </extended-communities>
 984
 985       @line 5: A rate in bytes per second, *AAAAAA==* (0) means traffic discard.
 986
 987    .. tab:: JSON
 988
 989       .. code-block:: json
 990          :linenos:
 991          :emphasize-lines: 6
 992
 993          {
 994              "extended-communities" : {
 995                  "transitive": true,
 996                  "traffic-rate-extended-community": {
 997                      "informative-as": 123,
 998                      "local-administrator": "AAAAAA=="
 999                  }
1000              }
1001          }
1002
1003       @line 6: A rate in bytes per second, *AAAAAA==* (0) means traffic discard.
1004
1005 * **Traffic Action**
1006
1007 .. tabs::
1008
1009    .. tab:: XML
1010
1011       .. code-block:: xml
1012
1013          <extended-communities>
1014              <transitive>true</transitive>
1015              <traffic-action-extended-community>
1016                  <sample>true</sample>
1017                  <terminal-action>false</terminal-action>
1018              </traffic-action-extended-community>
1019          </extended-communities>
1020
1021    .. tab:: JSON
1022
1023       .. code-block:: json
1024
1025          {
1026              "extended-communities" : {
1027                  "transitive": true,
1028                  "traffic-action-extended-community": {
1029                      "sample": true,
1030                      "terminal-action": false
1031                  }
1032              }
1033          }
1034
1035 * **Redirect to VRF AS 2byte format**
1036
1037 .. tabs::
1038
1039    .. tab:: XML
1040
1041       .. code-block:: xml
1042
1043          <extended-communities>
1044              <transitive>true</transitive>
1045              <redirect-extended-community>
1046                  <global-administrator>123</global-administrator>
1047                  <local-administrator>AAAAew==</local-administrator>
1048              </redirect-extended-community>
1049          </extended-communities>
1050
1051    .. tab:: JSON
1052
1053       .. code-block:: json
1054
1055          {
1056              "extended-communities" : {
1057                  "transitive": true,
1058                  "redirect-extended-community": {
1059                      "global-administrator": 123,
1060                      "local-administrator": "AAAAew=="
1061                  }
1062              }
1063          }
1064
1065 * **Redirect to VRF IPv4 format**
1066
1067 .. tabs::
1068
1069    .. tab:: XML
1070
1071       .. code-block:: xml
1072
1073          <extended-communities>
1074              <transitive>true</transitive>
1075              <redirect-ipv4>
1076                  <global-administrator>192.168.0.1</global-administrator>
1077                  <local-administrator>12345</local-administrator>
1078              </redirect-ipv4>
1079          </extended-communities>
1080
1081    .. tab:: JSON
1082
1083       .. code-block:: json
1084
1085          {
1086              "extended-communities" : {
1087                  "transitive": true,
1088                  "redirect-ipv4": {
1089                      "global-administrator": "192.168.0.1",
1090                      "local-administrator": 12345
1091                  }
1092              }
1093          }
1094
1095 * **Redirect to VRF AS 4byte format**
1096
1097 .. tabs::
1098
1099    .. tab:: XML
1100
1101       .. code-block:: xml
1102
1103          <extended-communities>
1104              <transitive>true</transitive>
1105              <redirect-as4>
1106                  <global-administrator>64495</global-administrator>
1107                  <local-administrator>12345</local-administrator>
1108              </redirect-as4>
1109          </extended-communities>
1110
1111    .. tab:: JSON
1112
1113       .. code-block:: json
1114
1115          {
1116              "extended-communities" : {
1117                  "transitive": true,
1118                  "redirect-as4": {
1119                      "global-administrator": 64495,
1120                      "local-administrator": 12345
1121                  }
1122              }
1123          }
1124
1125 * **Redirect to IP**
1126
1127 .. tabs::
1128
1129    .. tab:: XML
1130
1131       .. code-block:: xml
1132
1133          <extended-communities>
1134              <transitive>true</transitive>
1135              <redirect-ip-nh-extended-community>
1136                  <copy>false</copy>
1137              </redirect-ip-nh-extended-community>
1138          </extended-communities>
1139
1140    .. tab:: JSON
1141
1142       .. code-block:: json
1143
1144          {
1145              "extended-communities" : {
1146                  "transitive": true,
1147                  "redirect-ip-nh-extended-community": {
1148                      "copy": false
1149                  }
1150              }
1151          }
1152
1153 * **Traffic Marking**
1154
1155 .. tabs::
1156
1157    .. tab:: XML
1158
1159       .. code-block:: xml
1160
1161          <extended-communities>
1162              <transitive>true</transitive>
1163              <traffic-marking-extended-community>
1164                  <global-administrator>20</global-administrator>
1165              </traffic-marking-extended-community>
1166          </extended-communities>
1167
1168    .. tab:: JSON
1169
1170       .. code-block:: json
1171
1172          {
1173              "extended-communities" : {
1174                  "transitive": true,
1175                  "traffic-marking-extended-community": {
1176                      "global-administrator": 20
1177                  }
1178              }
1179          }
1180
1181 -----
1182
1183 To remove the route added above, following request can be used:
1184
1185 **URL:** ``/restconf/config/bgp-rib:application-rib/10.25.1.9/tables/bgp-types:ipv4-address-family/bgp-flowspec:flowspec-subsequent-address-family/bgp-flowspec:flowspec-routes/bgp-flowspec:flowspec-route/flow1/0``
1186
1187 **Method:** ``DELETE``
1188
1189 IPv4 L3VPN Flow Specification
1190 '''''''''''''''''''''''''''''
1191 This examples show how to originate and remove IPv4 L3VPN fowspec route via programmable RIB.
1192
1193 **URL:** ``/restconf/config/bgp-rib:application-rib/10.25.1.9/tables/bgp-types:ipv4-address-family/bgp-flowspec:flowspec-l3vpn-subsequent-address-family/bgp-flowspec:flowspec-l3vpn-ipv4-routes``
1194
1195 **Method:** ``POST``
1196
1197 .. tabs::
1198
1199    .. tab:: XML
1200
1201       **Content-Type:** ``application/xml``
1202
1203       **Request Body:**
1204
1205       .. code-block:: xml
1206
1207          <flowspec-l3vpn-route xmlns="urn:opendaylight:params:xml:ns:yang:bgp-flowspec">
1208              <path-id>0</path-id>
1209              <route-key>flow-l3vpn</route-key>
1210              <route-distinguisher>172.16.0.44:101</route-distinguisher>
1211              <flowspec>
1212                  <source-prefix>10.0.0.3/32</source-prefix>
1213              </flowspec>
1214              <attributes>
1215                  <local-pref>
1216                      <pref>100</pref>
1217                  </local-pref>
1218                  <origin>
1219                     <value>igp</value>
1220                  </origin>
1221                  <as-path></as-path>
1222                  <extended-communities>
1223                      <transitive>true</transitive>
1224                      <redirect-ipv4>
1225                          <global-administrator>172.16.0.44</global-administrator>
1226                          <local-administrator>102</local-administrator>
1227                      </redirect-ipv4>
1228                  </extended-communities>
1229              </attributes>
1230          </flowspec-l3vpn-route>
1231
1232    .. tab:: JSON
1233
1234       **Content-Type:** ``application/json``
1235
1236       **Request Body:**
1237
1238       .. code-block:: json
1239
1240          {
1241              "flowspec-l3vpn-route": [
1242                  {
1243                      "route-key": "flow-l3vpn",
1244                      "path-id": 0,
1245                      "route-distinguisher": "172.16.0.44:101",
1246                      "flowspec": [
1247                          {
1248                              "source-prefix": "10.0.0.3/32"
1249                          }
1250                      ],
1251                      "attributes": {
1252                          "origin": {
1253                              "value": "igp"
1254                          },
1255                          "extended-communities": [
1256                              {
1257                                  "redirect-ipv4": {
1258                                      "global-administrator": "172.16.0.44",
1259                                      "local-administrator": 102
1260                                  },
1261                                  "transitive": true
1262                              }
1263                          ],
1264                          "local-pref": {
1265                              "pref": 100
1266                          }
1267                      }
1268                  }
1269              ]
1270          }
1271
1272 -----
1273
1274 To remove the route added above, following request can be used:
1275
1276 **URL:** ``/restconf/config/bgp-rib:application-rib/10.25.1.9/tables/bgp-types:ipv4-address-family/bgp-flowspec:flowspec-l3vpn-subsequent-address-family/bgp-flowspec:flowspec-l3vpn-ipv4-routes/flowspec-l3vpn-route/flow-l3vpn/0``
1277
1278 **Method:** ``DELETE``
1279
1280 IPv6 Flow Specification
1281 '''''''''''''''''''''''
1282 This examples show how to originate and remove IPv6 fowspec route via programmable RIB.
1283
1284 **URL:** ``/restconf/config/bgp-rib:application-rib/10.25.1.9/tables/bgp-types:ipv6-address-family/bgp-flowspec:flowspec-subsequent-address-family/bgp-flowspec:flowspec-ipv6-routes``
1285
1286 **Method:** ``POST``
1287
1288 .. tabs::
1289
1290    .. tab:: XML
1291
1292       **Content-Type:** ``application/xml``
1293
1294       **Request Body:**
1295
1296       .. code-block:: xml
1297
1298          <flowspec-route xmlns="urn:opendaylight:params:xml:ns:yang:bgp-flowspec">
1299              <route-key>flow-v6</route-key>
1300              <path-id>0</path-id>
1301              <flowspec>
1302                  <destination-prefix>2001:db8:30::3/128</destination-prefix>
1303              </flowspec>
1304              <flowspec>
1305                  <source-prefix>2001:db8:31::3/128</source-prefix>
1306              </flowspec>
1307              <flowspec>
1308                  <flow-label>
1309                      <op>equals end-of-list</op>
1310                      <value>1</value>
1311                  </flow-label>
1312              </flowspec>
1313              <attributes>
1314                  <extended-communities>
1315                      <transitive>true</transitive>
1316                      <redirect-ipv6>
1317                          <global-administrator>2001:db8:1::6</global-administrator>
1318                          <local-administrator>12345</local-administrator>
1319                      </redirect-ipv6>
1320                  </extended-communities>
1321                  <origin>
1322                      <value>igp</value>
1323                  </origin>
1324                  <as-path/>
1325                  <local-pref>
1326                      <pref>100</pref>
1327                  </local-pref>
1328              </attributes>
1329          </flowspec-route>
1330
1331    .. tab:: JSON
1332
1333       **Content-Type:** ``application/json``
1334
1335       **Request Body:**
1336
1337       .. code-block:: json
1338
1339          {
1340              "flowspec-route": [
1341                  {
1342                      "route-key": "flow-v6",
1343                      "path-id": 0,
1344                      "flowspec": [
1345                          {
1346                              "destination-prefix": "2001:db8:30::3/128"
1347                          },
1348                          {
1349                              "source-prefix": "2001:db8:31::3/128"
1350                          },
1351                          {
1352                              "flow-label": [
1353                                  {
1354                                      "op": "end-of-list equals",
1355                                      "value": 1
1356                                  }
1357                              ]
1358                          }
1359                      ],
1360                      "attributes": {
1361                          "origin": {
1362                              "value": "igp"
1363                          },
1364                          "extended-communities": [
1365                              {
1366                                  "redirect-ipv6": {
1367                                      "global-administrator": "2001:db8:1::6",
1368                                      "local-administrator": 12345
1369                                  },
1370                                  "transitive": true
1371                              }
1372                          ],
1373                          "local-pref": {
1374                              "pref": 100
1375                          }
1376                      }
1377                  }
1378              ]
1379          }
1380
1381 -----
1382
1383 To remove the route added above, following request can be used:
1384
1385 **URL:** ``/restconf/config/bgp-rib:application-rib/10.25.1.9/tables/bgp-types:ipv6-address-family/bgp-flowspec:flowspec-subsequent-address-family/bgp-flowspec:flowspec-ipv6-routes/bgp-flowspec:flowspec-route/flow-v6/0``
1386
1387 **Method:** ``DELETE``
1388
1389 References
1390 ^^^^^^^^^^
1391 * `Dissemination of Flow Specification Rules <https://tools.ietf.org/html/rfc5575>`_
1392 * `Dissemination of Flow Specification Rules for IPv6 <https://tools.ietf.org/html/draft-ietf-idr-flow-spec-v6-07>`_
1393 * `BGP Flow-Spec Extended Community for Traffic Redirect to IP Next Hop <https://tools.ietf.org/html/draft-ietf-idr-flowspec-redirect-ip-00>`_
1394 * `Clarification of the Flowspec Redirect Extended Community <https://tools.ietf.org/html/rfc7674>`_
1395 * `Revised Validation Procedure for BGP Flow Specifications <https://tools.ietf.org/html/draft-ietf-idr-bgp-flowspec-oid-03>`_