1

I suspect this is a very basic question, so apologies in advance.

Let's say a hypothetical network is multihomed, with 2 ISPs (A & B).

If you blackhole a /32 host over ISP B, will the user accessing the network from ISP B be able to connect via ISP A? That is, will their routes reconverge once the blackhole is setup?

I ask because we've got two ISPs, one with inline DDoS mitigation and one without. We would like to be able to nullroute DDoS traffic over the unprotected ISP so it is forced over the protected ISP.

EDIT: I'm referring to creating upstream blackholes with BGP communities that our ISPs support.

1

If you blackhole a /32 host over ISP B, will the user accessing the network from ISP B be able to connect via ISP A? That is, will their routes reconverge once the blackhole is setup?

Do you mean a customer of ISP B? If so, then no. If they (ISP B) are black-holing a specific /32 then this prefix will be more specific than any of your other prefixes received (from you or ISP A) and will draw traffic towards it from within ISP B. Blackholing a /32 will generally not propagate beyond an AS, so upstreams of ISP B will still receive your aggregate prefixes. Secondly, ISP B will most likely have a higher Local Preference set on your routes (since you are a customer) than anything they receive from other ISPs, so their customers will always use your link to them, regardless of any AS Path pre-pending you configure. This is purely an economic routing policy.

I ask because we've got two ISPs, one with inline DDoS mitigation and one without. We would like to be able to nullroute DDoS traffic over the unprotected ISP so it is forced over the protected ISP.

The best you will be able to do to guarantee no lost customers is withdraw the entire prefix containing the /32 from ISP B (the one without DDoS protection) so that all traffic is forced to you via ISP A (which will presumably scrub the traffic for you). If you simply null-route the traffic at ISP B, it will still attract the traffic from it's upstreams (and directly attached clients), but then just drop it at it's edge thanks to the null route. AS Prepending will not override any Local Preference configured within ISP B.

  • Exactly, you cannot control the routing policies of another AS, and I doubt you would allow another AS to control your routing policies. You can try to influence them, but, ultimately, you need to come to an agreement with the managers of the other AS. – Ron Maupin Jan 19 '16 at 1:36
1

You have no control over how traffic is routed on the Internet. You can blackhole traffic you receive, but that is your routing decision on your network. You can't change your ISP's routing policies. If you are peering with an ISP via BGP, you can try to influence the ISPs routing with things like MED or AS_PATH prepending, but your ISP is free to ignore you attempts to influence how it routes. I doubt your company would allow your routing policies to be dictated by an outside company.

If you are peering via BGP with the unprotected ISP, you can try using AS_PATH prepending to see if you can make the path through that ISP undesirable. It may or may not work.

  • 1
    You could also withdraw the route from ISP A, forcing all traffic to B. That limits your path redundancy, but when under "attack," it may be worthwhile. – Ron Trunk Jan 18 '16 at 22:22
  • Thanks for the detailed reply. For clarification, we do have access to BGP community tags which allow us to trigger upstream blackholes (RTBH). That's what I was referring to in my original post. – biasedbuffalo Jan 18 '16 at 22:23
  • If you trigger an upstream blackhole, the traffic will be dropped into the blackhole. You would need to work with the ISP to reroute your traffic to a different ISP, rather than simply blackholing it. I think this is a question you need to discuss with the ISP. As I wrote, you can't change your ISPs routing policies, but you may be able to come to an agreement to set up something like this. Your ISP is free to ignore communities unless you have an agreement with the ISP on what to do in the event of receipt of the communities. – Ron Maupin Jan 18 '16 at 22:28
  • You need to speak with your ISP-A to know if AS-PATH prepending are supported, or some another type of routing policies that were supported. Once you get that, you can change your conf, and adapt to that – Orlando Gaetano Jan 18 '16 at 22:34
1

I think, you need to plan withh caution the thing.

  1. Create your blackholing process with your ISP B, eg, communities or something else. With that, your ISP B will continue announcing your routes to the world, and once detect traffic to your /32 attacked network, that traffic will be blackholed.

  2. I think you have some mechanins to announcing your routes to your ISP(i´m supposing your are using BGP). Once your network is under attack, easily you can do some routing policy, to change yoour ISP-A routing. The prepending is a good choice, you select the network prefix, and put it a bigger as-path through ISP-A. With that, world will know the existence of your attacked netwrok across 2 ISP, but BGO will decide to use the "shortest" AS-PATH, ISP-B, where your networrk under attack will be protected and that traffic will be route to a null route.

  • Thanks - prepending and changing the AS-path should do the trick. – biasedbuffalo Jan 18 '16 at 22:24
  • Oh yes, it does, and works very nice – Orlando Gaetano Jan 18 '16 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.