Wanguard 6.2 User Guide
Appendix 3 – BGP Black Hole Guideline for Wanguard Sensor
and allow customer-routes
r7500(config-route-map)# match community
<Wanguard-Sensor-community-name>
r7500(config-route-map)# set community
<ISP1-BH-Community>
→ e.g.222:9999
r7500(config-route-map)# exit
r7500(config)# router bgp
<Router-AS-number>
r7500(config-router)# neighbor
<IPS1-IP-address>
remote-as
<ISP1-AS-number>
r7500(config-router)# neighbor
<IPS1-IP-address>
route-map
IBR-ISP1-out out
r7500(config-router)# neighbor
<IPS2-IP-address>
remote-as
<ISP2-AS-number>
r7500(config-router)# neighbor
<IPS2-IP-address>
route-map
IBR-ISP2-out out
r7500(config-router)# no synchronization
r7500(config-router)# exit
When multiple ISPs and IBRs exist, it makes sense to have different BH communities, one for each IBR. In this
way you may isolate the source of the attack so that the whole traffic directed to the victim would not be black-
holed.
Interaction with traffic diversion / Wanguard Filter
It might be the case when:
•
Filter advertises redirect BGP route to IBR (initially)
•
Sensor advertises a black-hole BGP route to IBR (afterward)
The priority shall be on the black-hole advertisement, rather than redirect. This can be achieved easily by
using a routing-policy which sets a higher priority on black hole route (e.g. set Local-Preference at 200 for BH-route).
The direction and place where BGP routing-policy has to be implemented are strongly dependent on:
•
What role plays on the network the Sensor’s peer-router (e.g. IBR, Route-Reflector, etc.)
•
Type of BGP relation between Sensor and the peer-router (e.g. iBGP or eBGP)
In order to distinguish between a black hole and a redirect announcement, it is recommended to use
different BGP communities on each type of announcement.
The action shall be like on the table below:
Type of BGP announcement (community)
Route to (next-hop)
Propagated to ISP
Redirect (e.g. 65000:99)
Wanguard Filter
No
Black-hole (e.g. 65000:66)
Null0
Yes
Table 1 – BGP Communities and actions
In the special case when the peer-router of Sensor is the Route-Reflector, then the black-hole action still
has to be implemented on IBR. To achieve this, the above sample router configuration has to be adapted and
applied to IBR BGP-import policy in relation to the Route-Reflector. No action has to be implemented on RR,
while its purpose is route-signaling rather than routing traffic.
To use a single bgpd / peer router for both redirect and black-hole, define
bgp multiple-instance
in bgpd.conf
and use two BGP Connectors configured with distinct AS views. For the second AS view assign a different IP for
bgp
router-id
and make sure the IP (sub-interface) can reach the router.
- 111 -
Summary of Contents for wanguard 6.2
Page 1: ......
