2

I had a discussion a while ago, related how to stop DDoS. Read this first: BGP null route when DDoS?

Finally, we talked to the ISP, and it agreed on setting up a BGP trigger so the next time a DDoS happens, we can trigger RTBH to null route (DDoS) the target IP address to stop traffic at the PE.

Question: I am not an expert in BGP, so my question is how/what I need to configure on my router, and how can I trigger a null route from my router so it will null traffic at the ISP edge router?

Scenario in GNS:

Here i am trying to trigger RTBH from R2 router to R1 so it will null route 172.16.10.100 at R1 (ISP router), But its not working, what i am missing here?

R1: ISP Router
R2: My Router

I have configured iBGP between this two router and trying to simulate RTBH to understand.

R1:

Do i need to configure anything else on R1 to accept trigger?

R1(config)# router bgp 64520
...
...
R1(config)# ip route 192.0.2.1 255.255.255.255 Null0

R2:

R2(config)# route-map RTBH
R2(config-route-map)# match tag 666
R2(config-route-map)# set ip next-hop 192.0.2.1
R2(config-route-map)# set origin igp
R2(config-route-map)# set community no-export

R2(config)# router bgp 64520
R2(config-router)# redistribute static route-map RTBH

Trying to trigger Null route

R2(config)# ip route 172.16.10.100 255.255.255.255 Null0 tag 666
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 6 '17 at 23:00
4

Most RTBH implementations at ISPs require you to announce a subnet (let it be a /32) with appropriate BGP community (again, at most ISPs it's 666) to trigger RTBH at PE.

It seems like you're on right track. I'd also check for something like set community additive 64520:666 on R2.

  • Thanks! can i do source null route too? if yes then what if i disable other customer source IP too? – Satish Mar 19 '16 at 20:14
  • 2
    In RTBH you only care about destination routes (the ones your ISP should blackhole traffic to). – squirrely Mar 19 '16 at 20:20
  • I've actually seen quite a number of different setups, specific communities being just one of them. Maybe the most common, but I'm not sure. Others include dedicated BGP sessions for blackhole routes and setting specific next-hops. – Teun Vink Mar 19 '16 at 22:20
  • Dedicated BGP sessions are mostly used when you have separate physical link to your ISP specifically to control RTBH and probably for some other purposes. Depending on how bandwidth limiting is configured you might get your link fully saturated during DDoS attack and have difficulty to advertise a tagged route. But yeah, you're right, there sure can be other ways to trigger null routes. – squirrely Mar 19 '16 at 22:51
1

You need to coordinate this with your ISP. Cisco has some documents, such as REMOTELY TRIGGERED BLACK HOLE FILTERING, which may help you understand what you need to coordinate with your ISP, and how to configure what you agree on.

OVERVIEW This section describes RTBH filtering and how it is used for both destination-based and source-based filtering. This section includes the following topics:

  • Benefits of Remotely Triggered Black Hole Filtering
  • Remotely Triggered Black Hole Filtering Within the Service Provider Security Framework
  • Destination-Based
  • Source-Based

and

There are two methods for deploying RTBH filtering. The first, and easier, way is called the next hop method, in which the next hop attribute is set on the trigger and is sent in the route update to its iBGP peers at the edge. The second method is to use BGP communities. In the latter method, the trigger sets the BGP community for a route and sends it to the edge routers using iBGP. The edge routers use a route map to match this community and set attributes locally, such as next hop and other routing metrics.

  • good to see you again, I am trying to create scenario in GNS before talking to ISP. just want to understand basic rules behind RTBH I have updated my scenario but its not working – Satish Mar 17 '16 at 21:04
  • 2
    I said this before in my answer to your previous question, but I'll say it again: you need to talk to your ISP first. You can come up with all sort of scenarios, but they will need to tell you what they have implemented and what they require you to do as trigger. There are a number of ways to implement RTBH, the devil is in the details. – Teun Vink Mar 17 '16 at 21:20
  • 1
    @Satish, to add to what Teun says, how do you have any idea that what you are mocking up is the same thing your ISP wants you to do? You will be wasting your time. Your ISP can tell you what it wants you to do. – Ron Maupin Mar 17 '16 at 21:26
  • Guys!! i am 100% agreed. but atleast i can learn one method right?? I don't care what ISP will suggest.. I am just trying simple scenario which is not working in my GNS. Do you know why? – Satish Mar 17 '16 at 21:33
  • 1
    OK. You changed your question to something different than the original question, which I answered. You should start a new question to ask you specific scenario. You also need to include more of the configurations since you left out all the BGP configurations for R1. Did you even send the static route through BGP to R1? – Ron Maupin Mar 17 '16 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.