BGP Prefix problem

Answered Question
Feb 9th, 2009
User Badges:

I have what I think is a simple problem:

I have BGP setup between a couple of providers. The provider support blackhole announcements (block traffic to one of my IPs when I announce it to them via BGP using a specific community).

I currently have a /18 that I have the following configuration for:

router bgp XXX1

network XXX.XXX.XXX.XXX mask

neighbor yyy.yyy.yyy.yyy route-map PROVIDER-TRANSIT-INBOUND out

ip route XXX.XXX.XXX.XXX null0

ip prefix-list ISP-BlackedHole seq 1 permit ZZZ.ZZZ.ZZZ.ZZZ/32

ip prefix-list ISP-BlackedHole seq 100 deny le 32

ip prefix-list Transit-00 seq 20 permit XXX.XXX.XXX.XXX/18

route-map PROVIDER-TRANSIT-INBOUND permit 10

match ip address prefix-list ISP-BlackedHole

set community XXXX:YYYY


route-map PROVIDER-TRANSIT-INBOUND permit 20

match ip address prefix-list Transit-00


The intent is to send the IP that is under attack (in this case ZZZ.ZZZ.ZZZ.ZZZ) to the provider via BGP tagged with their community.

After reseting the peering, I noticed that only the /18 was being sent out. When I do a "show ip bgp prefix ISP-BlackHole", nothing was returned. For some reason ZZZ.ZZZ.ZZZ.ZZZ is not being advertised out, only the aggregate is.

What am I doing wrong?

Correct Answer by Harold Ritter about 8 years 5 months ago


That is correct. You could redistribute the /32 selectively using a route-map but it would be safer to use a network statement for that specific /32 though.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Harold Ritter Mon, 02/09/2009 - 11:09
User Badges:
  • Cisco Employee,


How do you originate the /32 prefix. You need to make sure it is in the RIB and that you use a network statement or that you redistribute it in BGP.

Also make sure that you have a "neighbor send-community" if you want the ISP to receive the community that you set in the route-map. The community will not be sent by default.


joemarr_brodart Mon, 02/09/2009 - 11:16
User Badges:

I've tried 2 methods:

* The IP is part of a /XX that is assigned to a port in our network, which is redistributed (and seen by the BGP routers) into our network via OSPF. This is prefered over the next option.

* null routing the IP on the routers doing BGP.

Harold Ritter Mon, 02/09/2009 - 11:23
User Badges:
  • Cisco Employee,


If the /32 is not present in BGP then it cannot be advertised to your ISP.

Do you see the /32 in your BGP table (show ip bgp)?


joemarr_brodart Mon, 02/09/2009 - 11:37
User Badges:


no I only see the /18 :(

So, between the network command and the null route, I'm redistributing the /18 into BGP.

So I would need to some how redistribute the IP into BGP. I assume I dont want to redistribute my entire OSPF table for various reasons, but I could redistribute the /32 using a route-map, yes?


router bgp XXXX

redistribute static route-map static-routes

route-map static-routes permit 10

match ip address prefix-list ISP-Blackhole

Correct Answer
Harold Ritter Mon, 02/09/2009 - 11:40
User Badges:
  • Cisco Employee,


That is correct. You could redistribute the /32 selectively using a route-map but it would be safer to use a network statement for that specific /32 though.


joemarr_brodart Mon, 02/09/2009 - 11:41
User Badges:

I'll give it some thought regarding network statement vs. route-map.

Thanks for the help.

Mohamed Sobair Mon, 02/09/2009 - 11:34
User Badges:
  • Gold, 750 points or more


1- First of all You have to advertise ZZZ Network to ur BGP neighbor, as its not seem to be in the IP routing neither advertised . verify...

2- Ur XXX Network is not advertised but rather dropped due to the Nullo static route which preffered over the BGP AD.

3- U have to send community 2 the neighbor.




This Discussion