One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by blackholing the target, however, my customer is looking for a solution to blackhole based on the source address so the target of the attack won't be taken offline.
Building a blackhole solution based on the target address isn't that hard: just have the customer announce the target as a more specific route via a seperate BGP session or have him tag it with a specific community, then use a routing policy to set the next-hop to some discard interface.
Building a blackhole solution where sources of the attack (which are not within the customer's IP-space) are blackholed seems to be a bit harder. If I'd use the same solution as for filtering destinations my problem is that I only want to discard traffic from specific sources towards this specific customer, so inserting discard routes into my routing table isn't acceptable anymore since it would affect other customers as well. So I need some way to create a filter which only applies to this specific customer.
The first solution I was thinking about was to use BGPFlowspec. Unfortunately, this won't work for this specific customer since his equipment doesn't support it.
So what I've been looking for is a way to create a dynamic firewall filter based on some routing property, most likely a community set either by our customer or by us when receiving a specific route via a dedicated BGP blackhole session. This filter then can be applied on the customer's interfaces to block unwanted traffic. Unfortunately, I haven't found an easy way to create a firewall filter (or prefix-list) this way.
I did find http://thomas.mangin.com/posts/bgp-firewall.html, which 'misuses' SCU/DCU to more or less achieve what I'm looking for, but it does sound like a bit of a hack.
One of the other solutions I can think of is to create some static filter on our routes and build an interface which allows our customer to modify the prefix-list used by this filter. However, pushing configuration changes on my routers every time the customer wants to add a blackhole isn't really what I want. Some solution using BGP would be preferred.
On our side routing is done on Juniper, for a solution I'd prefer to have something which can be used on a variety of platforms, so it basically should just us BGP via a separate session or tagging routes via a specific community. This way I can use it for other customers as well.
I'm really interested if anyone has a nice solution for this (other than the SCU/DCU one).
