Control plane Distributed Denial of Service (DDoS) protection

DDoS attacks typically use a large number of network control packets to trigger exceptions in the network, consuming resources and crippling network operations. Control Plane DDoS protection uses firewall filters and policers to discard or rate-limit control plane traffic (based on bandwidth) so this malicious traffic does not bring down a device. Control Plane DDoS protection is enabled by default for supported protocols using aggregate policers for all packet types within a protocol group or, where supported, policers for specific packet types in a protocol group. On some products you can disable control plane DDoS protection or change default policer parameters for a protocol group or packet type using the CLI.

Supported protocols and packet types differ across products and Junos OS Releases, and might include (but are not limited to) the following:

• L3 protocols and above - BFD, BFDv6, Multi-hop BFD, BGP, DHCP v4/v6, Diameter, DTCP, EGPv6, DNS, FTP, GRE, ICMP, IGMP v4/v6, LDP, LDP-Hello, Martian-address, MLD, MSDP, NDP, NTP, OSPF, OSPF-Hello, PIM-Ctrl, PIM-Data, PTP, RADIUS, RSVP, RIP, SSH, SNMP, TACACS, TELNET, VRRP
• L2 protocols - ARP, Ethernet OAM (OAM-CFM, OAM-LFM), Frame Relay, IEEE 802.1X, ISIS, L2PT, L2TP, LACP, LLDP, Multicast snooping (IGMP snooping, MLD snooping), PPP, PVST, STP, TCC (ETH-TCC, ISO-TCC)