I had a discussion a while ago, related how to stop DDoS. Read this first: BGP null route when DDoS?

Finally, we talked to the ISP, and it agreed on setting up a BGP trigger so the next time a DDoS happens, we can trigger RTBH to null route (DDoS) the target IP address to stop traffic at the PE.

Question: I am not an expert in BGP, so my question is how/what I need to configure on my router, and how can I trigger a null route from my router so it will null traffic at the ISP edge router?

Scenario in GNS:

Here i am trying to trigger RTBH from R2 router to R1 so it will null route at R1 (ISP router), But its not working, what i am missing here?

R1: ISP Router
R2: My Router

I have configured iBGP between this two router and trying to simulate RTBH to understand.


Do i need to configure anything else on R1 to accept trigger?

R1(config)# router bgp 64520
R1(config)# ip route Null0


R2(config)# route-map RTBH
R2(config-route-map)# match tag 666
R2(config-route-map)# set ip next-hop
R2(config-route-map)# set origin igp
R2(config-route-map)# set community no-export

R2(config)# router bgp 64520
R2(config-router)# redistribute static route-map RTBH

Trying to trigger Null route

R2(config)# ip route Null0 tag 666

2 Answers 2


Most RTBH implementations at ISPs require you to announce a subnet (let it be a /32) with appropriate BGP community (again, at most ISPs it's 666) to trigger RTBH at PE.

It seems like you're on right track. I'd also check for something like set community additive 64520:666 on R2.

  • Thanks! can i do source null route too? if yes then what if i disable other customer source IP too?
    – Satish
    Commented Mar 19, 2016 at 20:14
  • 2
    In RTBH you only care about destination routes (the ones your ISP should blackhole traffic to).
    – squirrely
    Commented Mar 19, 2016 at 20:20
  • I've actually seen quite a number of different setups, specific communities being just one of them. Maybe the most common, but I'm not sure. Others include dedicated BGP sessions for blackhole routes and setting specific next-hops.
    – Teun Vink
    Commented Mar 19, 2016 at 22:20
  • Dedicated BGP sessions are mostly used when you have separate physical link to your ISP specifically to control RTBH and probably for some other purposes. Depending on how bandwidth limiting is configured you might get your link fully saturated during DDoS attack and have difficulty to advertise a tagged route. But yeah, you're right, there sure can be other ways to trigger null routes.
    – squirrely
    Commented Mar 19, 2016 at 22:51

You need to coordinate this with your ISP. Cisco has some documents, such as REMOTELY TRIGGERED BLACK HOLE FILTERING, which may help you understand what you need to coordinate with your ISP, and how to configure what you agree on.

OVERVIEW This section describes RTBH filtering and how it is used for both destination-based and source-based filtering. This section includes the following topics:

  • Benefits of Remotely Triggered Black Hole Filtering
  • Remotely Triggered Black Hole Filtering Within the Service Provider Security Framework
  • Destination-Based
  • Source-Based


There are two methods for deploying RTBH filtering. The first, and easier, way is called the next hop method, in which the next hop attribute is set on the trigger and is sent in the route update to its iBGP peers at the edge. The second method is to use BGP communities. In the latter method, the trigger sets the BGP community for a route and sends it to the edge routers using iBGP. The edge routers use a route map to match this community and set attributes locally, such as next hop and other routing metrics.

  • good to see you again, I am trying to create scenario in GNS before talking to ISP. just want to understand basic rules behind RTBH I have updated my scenario but its not working
    – Satish
    Commented Mar 17, 2016 at 21:04
  • 2
    I said this before in my answer to your previous question, but I'll say it again: you need to talk to your ISP first. You can come up with all sort of scenarios, but they will need to tell you what they have implemented and what they require you to do as trigger. There are a number of ways to implement RTBH, the devil is in the details.
    – Teun Vink
    Commented Mar 17, 2016 at 21:20
  • 1
    @Satish, to add to what Teun says, how do you have any idea that what you are mocking up is the same thing your ISP wants you to do? You will be wasting your time. Your ISP can tell you what it wants you to do.
    – Ron Maupin
    Commented Mar 17, 2016 at 21:26
  • Guys!! i am 100% agreed. but atleast i can learn one method right?? I don't care what ISP will suggest.. I am just trying simple scenario which is not working in my GNS. Do you know why?
    – Satish
    Commented Mar 17, 2016 at 21:33
  • 1
    OK. You changed your question to something different than the original question, which I answered. You should start a new question to ask you specific scenario. You also need to include more of the configurations since you left out all the BGP configurations for R1. Did you even send the static route through BGP to R1?
    – Ron Maupin
    Commented Mar 17, 2016 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.