I have a routing policy named rtbh configured as an ingress policy for a BGP peer:

root@PE3> show configuration policy-options policy-statement rtbh term ipv4 | display inheritance no-comments
from {
    family inet;
    community BLACKHOLE;
    route-filter prefix-length-range /32-/32;
then {
    local-preference 170;
    origin igp;


As seen above, it matches a /32 prefix if it has a specific BGP community attached and then rewrites the next-hop to and accepts the prefix. The route for exists:

root@PE3> show route detail

inet.0: 17 destinations, 18 routes (16 active, 0 holddown, 1 hidden) (1 entry, 1 announced)
        *Static Preference: 5
                Next hop type: Discard, Next hop index: 0
                Address: 0xa1de64c
                Next-hop reference count: 2
                State: <Active NoReadvrt Int Ext>
                Local AS: 65005
                Age: 1
                Validation State: unverified
                Task: RT
                Announcement bits (2): 0-KRT 4-Resolve tree 1
                AS path: I


root@PE3> ...configuration routing-options rib inet.0 | display inheritance no-comments
static {
    route {
martians { exact allow;


However, when I receive a matching prefix for the rtbh policy, then it stays hidden:

root@PE3> show route receive-protocol bgp extensive hidden

inet.0: 17 destinations, 18 routes (16 active, 0 holddown, 1 hidden) (1 entry, 0 announced)
     AS path: 65004 I
     Communities: 65005:666

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)


When I delete the next-hop statement in the rtbh policy, then the becomes active. What's causing this behavior?

1 Answer 1


The problem is lack of accept-remote-nexthop configuration on the BGP neighbor. Junos is applying your ingress policy-statement, then doing a validation check. This probably isn't how it should work but it's a Juniper-ism. The documentation of this "feature" is bad but here's the link.

If you prefer not to configure accept-remote-nexthop an alternate method to implement RTBH is to use a forwarding-table export policy to match RTBH routes (e.g. by community) and rewrite the next-hop to discard upon installing those routes into the FIB.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.