I have a Cisco Nexus 7000 and have configured static routes to reach my internal networks on the Nexus 7000. During a DDOS attack, the Nexus 7000 receives a more specific route via IBGP to re-route the traffic to another device, which cleans up this traffic and sends the cleaned traffic back to the Nexus 7000.

Now this cleaned up traffic needs to be forwarded to the destination which is known via the less specific static route.

But since there is a more specific prefix known via IBGP, there is a routing loop. How can I solve this issue?


  • 3
    You need to include a simpel topology drawing and the configuration of your Nexus 7000 for us to give a more precise answer. Remember to clean the configuration of any passwords etc.
    – user36472
    Feb 20, 2018 at 11:46
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 21:05

1 Answer 1


AIUI this is an application for vrfs. You have a "clean" vrf that faces the inside and a "dirty" vrf that reaches the outside. So effectively you would have two virtual routers one behind the other.

You would then arrange the filters on your routing protocol such that the "scrubbing" routes only get installed into the "dirty" vrf. The packets coming out of the scrubber would then be directed to the "clean" vrf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.