Secure the Control Plane

Firewall Filters on lo0.0

Use firewall filters on lo0.0 per address family which is automatically replicated across all PFE ASICs.

Packet Classification in the Host Path

During ingress processing, the PFE classifies packets in hardware:

• Transit traffic — Forwarded through the data plane (local PFE, fabric, or back‑to‑back)
• Exception traffic — Sent to the host path for control plane processing (for example, packets destined to router IPs, TTL = 1, IP options, or checksum errors)

Key Protection Point for Inbound Traffic

Packets traverse multiple filtering stages before reaching the RE. The most critical control is the loopback firewall filter.

Loopback Firewall Filters

To enable early packet drops in hardware for host-path exception traffic without affecting transit traffic, apply firewall filters to the lo0.0 interface for the inet, inet6, and mpls protocol families. Junos OS automatically distributes these filters to all PFE ASICs:

Best Practices

Follow these guidelines when configuring control-plane protection with loopback firewall filters:

Use Dynamic Prefix Lists with apply-path

• Use apply-path to create prefix lists that automatically reflect the active configuration. This approach simplifies maintenance and ensures that filters stay synchronized with configuration changes.

  Example BGP filter terms:

Use discard Instead of reject

• Use discard (silent drop) to avoid generating responses that can be exploited by scanners.

Enable Counters

• Configure counters for each term to support monitoring through SNMP or telemetry.

Applly Policers to Open Protocols

• Rate-limit protocols such as ICMP to protect control-plane resources:

Add Explicit Default Deny Terms

• Drop unauthorized traffic directed to router addresses.

• Add syslog action for further security analysis.

• Drop all remaining exception traffic.

Configure Logging for Untrusted Traffic

• Create a dedicated syslog file to capture control-plane drops for auditing and troubleshooting:

You can monitor firewall term and policer counters in near real time by using streaming telemetry. Subscribe to the sensor path /junos/system/linecard/firewall and set the collection interval to 30 seconds.

DDOS Protection

Junos DDoS protection (control-plane DDoS protection) is a distributed, hardware-accelerated and software-based mechanism that protects the Routing Engine (RE) from excessive exception traffic. The system operates in the Packet Forwarding Engine (PFE) on all line cards, dropping malicious or excessive traffic early in the forwarding pipeline before it reaches the RE CPU.

Unlike traditional control plane policing (CoPP), which relies on CPU-based rate limiting at a single point, Junos DDoS protection is fully distributed. Each PFE ASIC, line card CPU, and RE CPU enforces its own set of hardware or software policers that are consistent with RE-level policies. This architecture provides line-rate protection regardless of the number of Flexible PIC Concentrators (FPCs) in the system.

Junos DDoS protection uses a three-stage model:

• Stage 1 (Packet Forwarding Engine hardware)—Applies hardware rate limiters to drop or throttle traffic at the ingress pipeline.
• Stage 2 (line card CPU)—Applies software policers to traffic punted to the line card CPU.
• Stage 3 (Routing Engine CPU)—Applies software policers to protect the Routing Engine CPU.

This layered approach ensures scalable and effective protection of control-plane resources across the entire platform.

Junos DDoS protection supports two types of policers:

• Aggregate (AG) policers—Apply rate limits per protocol (for example, all BGP traffic).
• Specific packet (SP) policers—Apply fine-grained rate limits to individual packet types within a protocol (for example, BGP Open messages versus BGP Update messages).

The interaction between these policers is illustrated in the following example for DHCP protocol protection.

Default DDoS policers use conservative thresholds to reduce the risk of false positives. Adjust these values as needed based on network requirements:

• Bandwidth—Packets per second (PPS)
• Burst size—Number of packets allowed in a burst
• Violation handling—Events generate syslog messages

Configure protocol-specific policers under the following hierarchy:

To monitor DDoS protection statistics, run the following command:

You can also monitor DDOS protection statistics via streaming telemetry by subscribing to the sensor path: /junos/system/linecard/ddos. Recommended interval rate is 60 seconds.