The base configuration templates apply to all routers in the fabric.

Primary loopback IP and SNMP templates

These are examples of templates defining the primary Loopback IP and SNMP.

Primary loop:

<devices xmlns="http://tail-f.com/ns/ncs">
  <device> 
    <name>{$DEVICE}</name>
    <config>
      <interface xmlns="http://tail-f.com/ned/cisco-ios-xr">
        <Loopback>
          <id>0</id>
          <description>Loopback for L2VPN Leaf</description>
          <ipv4>
            <address>
              <ip>{$LOOPBACK_IP}</ip>
              <mask>255.255.255.255</mask>
            </address>
          </ipv4>
        </Loopback>
       </interface>
    </config>
  </device>
</devices>

SNMP:

  <devices xmlns="http://tail-f.com/ns/ncs">
    <device>
      <name>{$DEVICE}</name>
      <config>
        <snmp-server xmlns="http://tail-f.com/ned/cisco-ios-xr">
          <ifmib>
            <ifalias>
              <long/>
            </ifalias>
            <stats>
              <cache/>
            </stats>
          </ifmib>
          <packetsize>4096</packetsize>
          <ifindex>persist</ifindex>
          <host>
            <address>10.0.0.250</address>
            <type>traps</type>
            <community-string>${SNMPTRAP_COMM}</community-string>
            <version>2c</version>
            <udp-port>1062</udp-port>
          </host>
          <community>
            <name>${SNMP_RW_COMM}</name>
            <RW/>
          </community>
          <community>
            <name>${SNMP_RO_COMM}</name>
            <RO/>
          </community>
          <location>"Fabric-A Location"</location>
          <trap-source>
            <MgmtEth>0/RP0/CPU0/0</MgmtEth>
          </trap-source>
        </snmp-server>
      </config>
    </device>
  </devices>

PTP configuration

<devices xmlns="http://tail-f.com/ns/ncs">
    <device>
      <name>{$DEVICE}</name>
      <config>
        <ptp xmlns="http://tail-f.com/ned/cisco-ios-xr">
          <clock>
            <domain>24</domain>
            <profile>
              <name>g.8275.1</name>
              <clock-type>T-BC</clock-type>
            </profile>
          </clock>
          <profile>
            <name>timeTransmitter</name>
            <multicast>
              <target-address>
                <ethernet>01-80-C2-00-00-0E</ethernet>
              </target-address>
            </multicast>
            <transport>ethernet</transport>
            <sync>
              <frequency>16</frequency>
            </sync>
            <clock>
              <operation>two-step</operation>
            </clock>
            <announce>
              <frequency>8</frequency>
            </announce>
            <delay-request>
              <frequency>16</frequency>
            </delay-request>
          </profile>


          <profile>
            <name>timeReceiver</name>
            <multicast>
              <target-address>
                <ethernet>01-80-C2-00-00-0E</ethernet>
              </target-address>
            </multicast>
            <transport>ethernet</transport>
            <announce>
              <timeout>5</timeout>
              <frequency>8</frequency>
            </announce>
            <delay-request>
              <frequency>16</frequency>
            </delay-request>
          </profile>
          <physical-layer-frequency/>
          <log>
            <servo>
              <events/>
            </servo>
            <best-master-clock>
              <changes/>
            </best-master-clock>
          </log>
        </ptp>
      </config>
    </device>
  </devices>

IS-IS configuration

<devices xmlns="http://tail-f.com/ns/ncs">
    <device>
      <name>{$DEVICE}</name>
      <config>
        <router xmlns="http://tail-f.com/ned/cisco-ios-xr">
          <isis>
            <tag>
              <name>CORE</name>
            <is-type>level-2-only</is-type>
              <net>
                <id>{$ISIS_NET}</id>
              </net>
              <flex-algo>
                <id>128</id>
                <metric-type>
                  <delay/>
                </metric-type>
                <advertise-definition/>
              </flex-algo>
              <distribute>
                <link-state>
                  <instance-id>{$BGP_LS_INSTANCE_ID}</instance-id>
                </link-state>
              </distribute>
              <log>
                <adjacency>
                  <changes/>
                </adjacency>
                <pdu>
                  <drops/>
                </pdu>
              </log>
              <lsp-refresh-interval>65000</lsp-refresh-interval>
            <max-lsp-lifetime>65535</max-lsp-lifetime>

               <address-family>
                <ipv4>
                  <unicast>
                    <metric-style>wide</metric-style>
                   <maximum-paths>32</maximum-paths>
                    <segment-routing>
                      <mpls/>
                    </segment-routing>
                  </unicast>
                </ipv4>
                <ipv6>
                  <unicast>
                    <metric-style>wide</metric-style>
                    <maximum-paths>32</maximum-paths>
                  </unicast>
                </ipv6>
              </address-family>
              <interface>
                <name>Loopback0</name>
                <interface-type>passive</interface-type>
                <address-family>
                  <ipv4>
                    <unicast>
                      <prefix-sid>
                        <index>{$SR_SID_INDEX_ALGO_0}</index>
                      </prefix-sid>
                      <prefix-sid-algorithm>
                        <prefix-sid>
                          <algorithm>
                            <id>128</id>
                            <absolute>{$SR_SID_ABS_ALGO_128}</absolute>
                       </algorithm>
                       </prefix-sid>
                       </prefix-sid-algorithm>
                    </unicast>
                  </ipv4>
                  <ipv6>
                    <unicast/>
                  </ipv6>
                </address-family>
              </interface>
         </tag>
        </isis>
        </router>
      </config>
    </device>
 </devices>

L2VPN leaf template: BGP

<devices xmlns="http://tail-f.com/ns/ncs">
    <name>{$DEVICE}</name>
    <config>
      <router xmlns="http://tail-f.com/ned/cisco-ios-xr">
        <bgp>
          <bgp-no-instance>
            <id>{$BGP_ASN}</id>
            <nsr/>
            <bgp>
              <router-id>{$BGP_ROUTER_ID}</router-id>
              <graceful-restart/>
            </bgp>
            <ibgp>
              <policy>
                <out>
                  <enforce-modifications/>
                </out>
              </policy>
            </ibgp>

            <address-family>
              <l2vpn>
                <evpn/>
              </l2vpn>
            </address-family>
            <neighbor-group>
              <name>SvRR-EVPN</name>
              <remote-as>{$BGP_ASN}</remote-as>
              <update-source>
                <Loopback>0</Loopback>
              </update-source>
              <address-family>
                <l2vpn>
                  <evpn/>
                </l2vpn>
              </address-family>
            </neighbor-group>
            <neighbor>
              <id>10.0.0.100</id>
              <use>
                <neighbor-group>SvRR-EVPN</neighbor-group>
              </use>
            </neighbor>
            <neighbor>
              <id>10.0.0.101</id>
              <use>
                <neighbor-group>SvRR-EVPN</neighbor-group>
              </use>
            </neighbor>
          </bgp-no-instance>
        </bgp>
      </router>
    </config>
  </device>
</devices>

L3VPN leaf template: BGP

<devices xmlns="http://tail-f.com/ns/ncs">
    <name>{$DEVICE}</name>
      <config>
       <router xmlns="http://tail-f.com/ned/cisco-ios-xr">
        <bgp>
          <bgp-no-instance>
            <id>{$BGP_ASN}</id>
            <nsr/>
            <bgp>
              <router-id>{$BGP_ROUTER_ID}</router-id>
              <graceful-restart/>
            </bgp>
            <ibgp>
              <policy>
                <out>
                  <enforce-modifications/>
                </out>
              </policy>
            </ibgp>

            <address-family>
              <vpnv4>
                <unicast/>
              </vpnv4>
              <vpnv6>
                <unicast/>
              </vpnv6>
            </address-family>            
           <neighbor-group>
              <name>SvRR-L3VPN</name>
              <remote-as>{$BGP_ASN}</remote-as>
              <update-source>
                <Loopback>0</Loopback>
              </update-source>
              <address-family>
                <vpnv4>
                  <unicast/>
                </vpnv4>
              </address-family>
            </neighbor-group>
            <neighbor>
              <id>10.0.0.102</id>
              <use>
                <neighbor-group>SvRR-L3VPN</neighbor-group>
              </use>
            </neighbor>
            <neighbor>
              <id>10.0.0.103</id>
              <use>
                <neighbor-group>SvRR-L3VPN</neighbor-group>
              </use>
            </neighbor>
          </bgp-no-instance>
        </bgp>
      </router>
    </config>
  </device>
</devices>

View loaded templates

Use the show packages package edge-fabric-manager templates command on the router CLI to view the loaded templates.

Router-cisco@ncs#show packages package edge-fabric-manager templates
templates [ day1-leaf-l2vpn day1-leaf-l2vpn-v1 day1-leaf-l3vpn delete-leaf-interface-connection fabric-base-isis fabric-base-loopback fabric-base-ptp fabric-base-snmp fabric-generic leaf-interface-connection leaf-interface-connection-v1 spine-interface-connection ]

This example defines a fabric with the ID, fab1, with a base template, fab1-base-template, already defined.

The xr-leaf-l2vpn role and its properties are shown. Multiple templates and their associated variables are defined as part of the role definition. ​The role also defines an interface-template with its own variables which can be used to perform operations such as adding the interface to a specific ISIS instance or assigning a PTP profile.

fabrics fabric-id fab1
 fabric-description "Example Fabric"
 fabric-tags        "test;cisco"
 fabric-template-id fab1-base-template
 device-role device-role-name xr-leaf-l2vpn device-model N540-24Z8Q2C-M
  topology-role     leaf
  role-templates role-template-id leaf-l2vpn-bgp-1
   role-template-variables name BGP_ASN
   !
   role-template-variables name BGP_ROUTER_ID
   !
  !
  role-templates role-template-id leaf-l2vpn-isis-v1
   role-template-variables name BGP_LS_INSTANCE_ID
   !
   role-template-variables name ISIS_NET
   !
   role-template-variables name SR_SID_INDEX_ALGO_0
   !
   role-template-variables name SR_SID_ABS_ALGO_128
   !
  !
  interface-template interface-template-id fab1-interface-template
  interface-template interface-template-variables name MTU
  !
  interface-template interface-template-variables name PTP_PROFILE
  target-os-version 7.11.2
 !
!

The Edge Protect solution consists of these components:

• Edge DDoS Protection Controller: This component runs as a VM on a virtualization infrastructure. The controller is responsible for configuring and deploying detectors, configuring protected objects, and monitoring detected attacks and active mitigations.

• Edge DDoS Protection Detector: This component runs as a third-party application on IOS-XR routers, providing a distributed detection and mitigation engine. There is a single detector deployed to each router.

The Edge Protect operation involves Edge Protect DDoS detection and mitigation. The detection phase uses advanced analytics and examinations to identify specific amplification and application layer attacks. The mitigation phase is performed by deploying either user-driven or automated ACLs to distributed nodes to limit the attack impact.

Edge Protect DDoS detection

Detecting attacks requires having flow-level visibility of traffic traversing the router. In the Edge Protect solution Netflow data is encoded into Google Protobuf format and then consumed by the on-board detection engine. Deployment of the appropriate Netflow configuration is done automatically by the controller when a router acting as a detector is onboarded. Standard or user-defined detection templates are used as a basis for detecting DDoS traffic patterns. These are applied to protected objects, which can apply to an entire device, or a subset of IP addresses based on configuration. Protected objects are then configured with policing and additional mitigation actions.

Edge Protect DDoS mitigation

Mitigation on distributed nodes is performed using standard data plane ACLs. The ACLs contain granular information to mitigate only the attacks, and on platforms supporting User Defined Fields (UDF) can mitigate traffic by pattern matching components in the IP header. Active mitigations are shown both on the main launch screen for the Controller as well as under specific detectors.

For details on Edge DDoS Protection, see the Quick Start Guide for Edge DDoS Protection.

This is an example of an automated ACL used to mitigate an attack. In this case, the protected objects cover the 203.0.113.100 and 198.51.100.2 IP addresses. The ACL is as granular as possible to mitigate attacks in a targeted manner. ACL sequence number 1 blocks DNS packets with a specific length 228 and sequence 6 blocks an application layer attack against http.

RP/0/RP0/CPU0:cst-8712-pa2#show run ipv4 access-list myACL
ipv4 access-list myACL
 1 deny udp any eq 3000 host 203.0.113.100 eq domain packet-length eq 228
 6 deny tcp any eq 3400 host 198.51.100.2 eq www match-all -established -fin -psh +syn -urg packet-length eq 1178
 1301 permit ipv4 any any