You are asked to protect your company's customers from amplification attacks. In this scenario, what is Juniper's recommended protection method?

BGP Flow Specification (FlowSpec) is Juniper's recommended method for mitigating distributed denial-of-service (DDoS) attacks, including amplification attacks. FlowSpec enables the distribution of traffic filtering rules (flow routes) via BGP to network edge routers. This allows an operator to create highly specific rules that match the attack traffic's characteristics (e.g., source/destination ports, protocol) and apply an action, such as 'discard'. This surgically removes the malicious traffic at the network edge before it can consume the customer's bandwidth, while allowing legitimate traffic to the same destination to pass, thus protecting the customer with minimal service impact.

A. ASN prepending: This is a BGP traffic engineering technique used to influence inbound path selection by making a route less preferred; it is not a security mechanism for filtering attack traffic.

C. destination-based Remote Triggered Black Hole: RTBH is a less granular method that drops all traffic destined for the victim's IP address, causing a complete outage for that host, which is often not the desired outcome.

D. unicast Reverse Path Forwarding: uRPF is an anti-spoofing mechanism. It is ineffective against amplification attacks because the attack traffic originates from legitimate, routable servers (amplifiers), not from spoofed IP addresses.

1. Juniper Networks TechLibrary

"Flow-Specification-Based DDoS Mitigation": This document explicitly states

"You can use BGP flow specification to mitigate the effects of a distributed denial-of-service (DDoS) attack... The primary advantage of this approach is that you can deploy filtering and traffic-redirection policies very quickly..." This directly supports using FlowSpec for DDoS protection.

2. Juniper Networks TechLibrary

"Understanding Unicast RPF": This source details how uRPF works by verifying that a route to the source address exists out of the receiving interface. It clarifies its role in preventing spoofed source IP addresses

which is different from the traffic profile of an amplification attack.

3. Juniper Networks Day One Series

"Deploying BGP FlowSpec": In Chapter 1

"Introduction

" this guide states

"FlowSpec was designed to distribute firewall filter-like rules through BGP to mitigate DDoS attacks... FlowSpec allows for a much more granular approach than what is available with Remotely Triggered Black Hole (RTBH) filtering." This confirms FlowSpec's purpose and its superiority over RTBH for this use case.