-- Hugo cell: 604-617-3133
[email protected]: email, xmpp/jabber PGP fingerprint (B178313E): CF18 15FA 9FE4 0CD1 2319 1D77 9AB1 0FFD B178 313E (also on Signal) On Thu 2016-Jan-14 22:10:46 +0100, Johan Borch <[email protected]> wrote:
Hi! I have implemented RTBH in my small network of 8 routers. DFZ is running in a L3VPN and each router has an multihop ibgp-session with my RTBH-router and it works, but I have one thing that annoys me. If I announce an offending IP to be black holed, only one of the routers will point to the discard route. The other 7 will see the announced route via BGP från the one that got it first I guess and send the traffic to thatone where is is discarded.
Sounds like the router that receives the initial RTBH /32 is re-advertising that to your other peers, i.e.:
- RTBH box announces /32 with a.b.c.d/32 next-hop discard via BGP - RTBH BGP peer #1 receives and installs the route- that discard route on RTBH BGP peer #2 is picked up in its IGP export policy, so it exports it into your IGP - other RTBH BGP peers receive both the original BGP route from the RTBH box as well as the route RTBH BGP peer #1 injected into your IGP - IGP preference beats BGP, therefore remaining RTBH BGP peers prefer the IGP route that peer #1 injected
Check your IGP export policy; you shouldn't be exporting the RTBH route into your IGP.
If I do show extensive on the route it is prefer
because of IGP. I can't figure out how to get each router to prefer the
discard localy. If I do local pref on one router the other 7 will send the
traffic there instead.
Every router has
route a.b.c.d/32 {
discard;
install;
}
And from sending RTBH router, they are announced with next-hop a.b.c.d.
Idéas? :)
Regards
Johan
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
signature.asc
Description: Digital signature
_______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
