I have Cisco basic EVPN fabric configuration in DC with two spine and couple of leafs using OSFP+iBGP for underlay fabric. My border leaf connected to my ISP using Vrf CUST. I want to configure RTBH for DDoS protection. I have RTBH community from my ISP but somehow its not working may be its Vrf issue.

My border-leaf using Cisco 93180YC-EX running nxos 9.3.10 version.

route-map RTBH permit 10
  match tag 666
  set community 1299:666

In BGP configuration I have set redistribute static for RTBH

router bgp 65001
  template peer VXLAN_SPINE
    remote-as 65001
    update-source loopback0
    address-family ipv4 unicast
    address-family l2vpn evpn
      send-community extended
    inherit peer VXLAN_SPINE
    description ** iBGP Peer to Spine-1 **
    no shutdown
    inherit peer VXLAN_SPINE
    description ** iBGP Peer to Spine-2 **
    no shutdown
  vrf CUST1
    address-family ipv4 unicast
      redistribute static route-map RTBH
      aggregate-address summary-only
    neighbor 213.XX.XX.4
      remote-as 1299
      local-as 31028
      description *** eBGP link to ISP ***
      address-family ipv4 unicast
        send-community extended

Now if I add static route to test null route using tag 666 it doesn't do anything. Feels like my static route isn't getting install in vrf CUST1. example like following.

ip route Null0 tag 666

I don't have command like ip route vrf CUST ...blah.. to install route in CUST1 In that case how do I test my BGP RTBH working or not?

As you can see I don't have option vrf in route command.

(config)# ip route ?
  A.B.C.D      IP prefix in format i.i.i.i
  A.B.C.D/LEN  IP prefix and network mask length in format x.x.x.x/m

Edit - 1

vrf context CUST1
  description ** VRF-CUST1 **
  vni 10555
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn

1 Answer 1


ip route vrf ... is the IOS syntax. NX-OS does things a bit different. The routes live under vrf context ...

  • I have edit my question. as per your comment, I have added route in vrf context cust1 but it didn't trigger BGP null route. Do you think I should add under address-family ipv4 unicast ?
    – Satish
    Commented Mar 21 at 3:00
  • In routing table I have noticed that /32 route isn't advertise in neighbor peer. Do you think because of router summarization? my all EVPN routes are /32 and that is why I am using summary to send aggregated route to ISP.
    – Satish
    Commented Mar 21 at 4:07
  • I am reading this doc and its saying you have to configure BGP null route community on remote VTEP also not just border leaf. Am i reading it correct? cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/104x/…
    – Satish
    Commented Mar 21 at 14:43
  • Correct. As long as the prefix is covered by a "summary-only" aggregate, only the aggregate will be announced. As it doesn't match the rule, the null route tag will not be added.
    – Ricky
    Commented Mar 21 at 19:35
  • that is what I am thinking that how does null route will show up in table if I am using summary-only. I have check with my ISP and they also can't see any null route coming toward them. If I remove summary-only then it will blast 500 (/32) IPs in ISP table. Does summary-only and null route doesn't go together?
    – Satish
    Commented Mar 22 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.