Global configuration for flow detection and tracking

You can configure the mode of operation for flow detection and tracking globally for all protocol groups and packet types. In earlier releases, although you enable flow detection and tracking globally, you can configure the behavior only at the individual flow aggregation levels: physical interface, logical interface, or subscriber; you cannot configure the behavior globally. The new the global configuration applies to all packet types in the traffic flow unless it is overridden by the configuration for a protocol group or packet type at the flow aggregation levels.

To configure the global behavior for flow detection, include the flow-detection-mode statement at the [edit system ddos-protection global] hierarchy level and specify one of the following modes:

• automatic-Detect flows only when the policer is being violated. This is the default mode.
• on-Monitor and detect all flows even when no policer is being violated.
• off-Disable flow detection.

To configure the global behavior for how traffic in the detected flow is controlled, include the flow-level-control statement at the [edit system ddos-protection global] hierarchy level and specify one of the following control behaviors:

• drop-Drop all traffic in the flow. This is the default behavior.
• keep-Keep all traffic in the flow.
• police-Police the traffic in the flow to within its allowed bandwidth. Use the show ddos-protection statistics command to display the current global configuration.