1

We have created peer with our ISP and my ISP send community to do backhole but how do i configure that and send community string for blackhole traffic.

ISP said use 64682:0 community for RTBH, I did following config but didn't work

router bgp 100
 bgp log-neighbor-changes
 redistribute static route-map RTBH
 neighbor 71.xxx.xxx.61 remote-as 200
 neighbor 71.xxx.xxx.61 send-community
 network 70.xx.xx.0 mask 255.255.255.0


route-map RTBH permit 10
 match tag 666
 set community 64682:666

route-map RTBH permit 20

I am configured about :0 in community because my router not accepting that.

here i am using route to send null.

ip route 71.x.x.100 255.255.255.255 Null0 tag 666

What i am doing wrong?

EDIT:

I was following this Doc to setup community RTBH http://cenic.org/network/bgp-blackhole-community

Update:

I have modify config with following info but still no luck and no auto-summary is default in BGP

route-map RTBH permit 10
 match tag 666
 set community 64682:0
 set ip next-hop 192.0.2.1
!
route-map RTBH permit 20

Debug info:

When i trigger null route i got following debug debug ip routing logs

R1#
*Jun 20 15:38:23.212: RT: updating static 70.xx.xx.1/32 (0x0)  :
    via 0.0.0.0 Nu0  0 1048578

*Jun 20 15:38:23.212: RT: rib update return code: 17
Improve this question
6
  • I had given you a link to the Cisco document describing RTBH filtering. It explains in detail the options, and it includes configuration examples for the triggering router. Which configuration you use depends on what your ISP requires. If your ISP requires the community 64682:0, then the community in your configuration, 64682:666 will not work.
    – Ron Maupin ♦
    Jun 20, 2016 at 14:00
  • So here i am confused, In all internet docs they use ASN:666 and last 666 is they use for match tag 666 so my question is, Do i need to match my tag and community last number after : ? That is why i use :666
    – Satish
    Jun 20, 2016 at 14:13
  • You need to use the community which your ISP requires. That is the community that the ISP routers are looking for to trigger the black hole on its routers. Documents may use :666 because it has an evil connotation, but you need to use what your ISP requires.
    – Ron Maupin ♦
    Jun 20, 2016 at 14:19
  • One additional comment: please describe the actual problems and provide error messages/debugging output instead of using terms like 'no luck' and 'didn't work'.
    – Teun Vink ♦
    Jun 20, 2016 at 14:58
  • In debug i got this RT: rib update return code: 17 I have updated my question too
    – Satish
    Jun 20, 2016 at 15:33

3 Answers 3

Reset to default
1

The Cisco documents provide a full explanation for the options, and examples of how to configure your router, depending on the ISP requirements. Be sure to read and understand the text. It explains what you need to do, and why you need to do it.

Here is a very good Cisco document, and an example of one way to do this (your ISP may not do it this way):

REMOTELY TRIGGERED BLACK HOLE FILTERING — DESTINATION BASED AND SOURCE BASED

Trigger Router

This section provides a sample configuration listing for the trigger router. In this configuration, peer groups are used because it is the preferred way to configure a large number of BGP peers with similar characteristics. You must set the send-community for all these peers so they receive the noexport community and respect it by not advertising this redistributed route to any of their external peers.

Also, make sure to set no auto-summary so that specific host routes can be black holed. Otherwise BGP will automatically summarize the route based on class boundaries. Static routes are then redistributed into BGP after applying the black hole-trigger route map.

trigger#sh run
Building configuration...
version 12.1
!
hostname trigger
!
ip subnet-zero
!
interface Loopback0
 ip address 192.168.255.245 255.255.255.255
!
interface Null0
 no ip unreachables
!
interface Ethernet0/0
 ip address 192.168.4.3 255.255.255.0
 half-duplex
!
router ospf 100
 log-adjacency-changes
 redistribute connected subnets
 network 192.168.4.0 0.0.0.255 area 0
router bgp 740
 no synchronization
 bgp log-neighbor-changes
 redistribute static route-map black-hole-trigger
 neighbor black-hole peer-group
 neighbor black-hole remote-as 740
 neighbor black-hole update-source Loopback0
 neighbor black-hole send-community
 neighbor 192.168.255.246 remote-as 740
 neighbor 192.168.255.246 update-source Loopback0
 neighbor 192.168.255.253 peer-group black-hole
 no auto-summary 
!
ip route 192.0.2.1 255.255.255.255 Null0
route-map black-hole-trigger permit 10
 match tag 66
 set ip next-hop 192.0.2.1
 set local-preference 200
 set origin igp
 set community no-export
!
route-map black-hole-trigger deny 25
!
no scheduler allocate
end

The last part of this configuration creates a route map to match the route tag 66 and sets route characteristics. A higher value of local preference is desired for choosing a route, so it is set to 200, which is greater than the default value of 100. Also, to make sure that other static routes are not affected by this route map, a deny statement is placed at the end.

Improve this answer
6
  • In your example should i use set community 64682:0 in route-map? and set ip next-hop 192.0.2.1 ?
    – Satish
    Jun 20, 2016 at 14:38
  • The example address, 192.0.1.2, is just an example. You would use the address for your network. I think you really need to read the whole document and understand how this works. This is one example of one way of doing this. There are a couple of way to do it, and you need to do the one which your ISP requires.
    – Ron Maupin ♦
    Jun 20, 2016 at 15:01
  • I did setup whole network in GNS and it was working in GNS lab but i tested without community setting. But now in real world i have this community stuff which is driving me crazy..
    – Satish
    Jun 20, 2016 at 15:10
  • That's because your ISP is using a different method to trigger the black hole than what you tested. The document explains how the community-based RTBH works, and gives you an example configuration. You should understand what the ISP is doing (the document explains that). This will help you understand how you need to configure your side.
    – Ron Maupin ♦
    Jun 20, 2016 at 15:14
  • Problem solved, This is crazy! Currently device attached to Router so i was trying to send null route for Router LAN side interface and they didn't work but as soon as i attached dummy server to router and send host IP address it works! It doesn't mention anywhere in Document
    – Satish
    Jun 20, 2016 at 19:21
1

You should apply your route-map on BGP peer to send community attribute to your ISP by this command:

 neighbor {ip-address| group-name} route-map map-name {in | out}

applying route-map on redistribute is for filtering routes.

EDIT: Look for other answers. They're definitely better than mine. :)

Improve this answer
3
  • but what this 64682:0 community means? is it example or i has to be ASN:NN ?
    – Satish
    Jun 20, 2016 at 2:10
  • It should be defined by your ISP. For BGP, it's just a label to apply certain configuration(e.g. MED) to routes that your ISP router received from your router.
    – Pue-Tsuâ
    Jun 20, 2016 at 4:04
  • Also I'm not sure why your ISP provided that example, maybe it'd work on some routers or switches? However I'm sure that applying BGP community route-map on peer will set attributes properly for your BGP routes.
    – Pue-Tsuâ
    Jun 20, 2016 at 4:11
0

Unless you configure "neighbor send-community" the communities attached to the prefix won't be sent to the neighbor.

Improve this answer
1
  • Hey i have added neighbor send-community command in config but no luck. you can see my updated answer
    – Satish
    Jun 20, 2016 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.