BGP Prefix problem

Answered Question
Feb 9th, 2009

I have what I think is a simple problem:

I have BGP setup between a couple of providers. The provider support blackhole announcements (block traffic to one of my IPs when I announce it to them via BGP using a specific community).

I currently have a /18 that I have the following configuration for:

router bgp XXX1

network XXX.XXX.XXX.XXX mask 255.255.192.0

neighbor yyy.yyy.yyy.yyy route-map PROVIDER-TRANSIT-INBOUND out

ip route XXX.XXX.XXX.XXX 255.255.192.0 null0

ip prefix-list ISP-BlackedHole seq 1 permit ZZZ.ZZZ.ZZZ.ZZZ/32

ip prefix-list ISP-BlackedHole seq 100 deny 0.0.0.0/0 le 32

ip prefix-list Transit-00 seq 20 permit XXX.XXX.XXX.XXX/18

route-map PROVIDER-TRANSIT-INBOUND permit 10

match ip address prefix-list ISP-BlackedHole

set community XXXX:YYYY

!

route-map PROVIDER-TRANSIT-INBOUND permit 20

match ip address prefix-list Transit-00

!

The intent is to send the IP that is under attack (in this case ZZZ.ZZZ.ZZZ.ZZZ) to the provider via BGP tagged with their community.

After reseting the peering, I noticed that only the /18 was being sent out. When I do a "show ip bgp prefix ISP-BlackHole", nothing was returned. For some reason ZZZ.ZZZ.ZZZ.ZZZ is not being advertised out, only the aggregate is.

What am I doing wrong?

I have this problem too.
0 votes
Correct Answer by Harold Ritter about 7 years 9 months ago

Joe,

That is correct. You could redistribute the /32 selectively using a route-map but it would be safer to use a network statement for that specific /32 though.

Regards

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Harold Ritter Mon, 02/09/2009 - 11:09

Joe,

How do you originate the /32 prefix. You need to make sure it is in the RIB and that you use a network statement or that you redistribute it in BGP.

Also make sure that you have a "neighbor send-community" if you want the ISP to receive the community that you set in the route-map. The community will not be sent by default.

Regards

joemarr_brodart Mon, 02/09/2009 - 11:16

I've tried 2 methods:

* The IP is part of a /XX that is assigned to a port in our network, which is redistributed (and seen by the BGP routers) into our network via OSPF. This is prefered over the next option.

* null routing the IP on the routers doing BGP.

Harold Ritter Mon, 02/09/2009 - 11:23

Joe,

If the /32 is not present in BGP then it cannot be advertised to your ISP.

Do you see the /32 in your BGP table (show ip bgp)?

Regards

joemarr_brodart Mon, 02/09/2009 - 11:37

duh,

no I only see the /18 :(

So, between the network command and the null route, I'm redistributing the /18 into BGP.

So I would need to some how redistribute the IP into BGP. I assume I dont want to redistribute my entire OSPF table for various reasons, but I could redistribute the /32 using a route-map, yes?

say

router bgp XXXX

redistribute static route-map static-routes

route-map static-routes permit 10

match ip address prefix-list ISP-Blackhole

Correct Answer
Harold Ritter Mon, 02/09/2009 - 11:40

Joe,

That is correct. You could redistribute the /32 selectively using a route-map but it would be safer to use a network statement for that specific /32 though.

Regards

joemarr_brodart Mon, 02/09/2009 - 11:41

I'll give it some thought regarding network statement vs. route-map.

Thanks for the help.

Mohamed Sobair Mon, 02/09/2009 - 11:34

Hi,

1- First of all You have to advertise ZZZ Network to ur BGP neighbor, as its not seem to be in the IP routing neither advertised . verify...

2- Ur XXX Network is not advertised but rather dropped due to the Nullo static route which preffered over the BGP AD.

3- U have to send community 2 the neighbor.

HTH

Mohamed

Actions

This Discussion