Remote Triggered Black Hole(RTBH) configuration

ViktorG · Created Feb 19, 2020 05:46:53

Hello @ManuM !
The BGP Remote Triggered Black Hole is a security technique used to divert undesirable
traffic from Customers routers to an appropriate point in the network (Inernet Border)
where it can be black holed/droped. This technique is accomplished by using a trigger router.
The trigger router (in Huawei can be AntiDDoS solution - kind of smart security device) will generate a BGP /32 advertisement towards all other routers and serves as a black hole for undesirable traffic.
This concept may be used to create black hole for traffic to mitigate a DoS attacks
in BGP AS Borders. In the first step a static route destined to NULL0 interface
must be created. The IP Address used for static route is 192.168.255.255 and
for IPv6 is 100::192.168.255.255. This IP Addresses are not routable in the public Internet space.
The route-policy will
check if there is any prefix with mask /32 and community marked XXX:666
If this prefix exists then the route-policy will change NEXT_HOP address to 192.168.255.255/32
or 100::192.168.255.255, which is destined to NULL0 interface.

route-policy RP_FROM_RTBH permit node 10 // import policy from trigger router
description BH_:666
if-match ip-prefix GREATER24 // Prefix list should be defined
if-match community-filter BH //community-filter should be defined
apply ip-address next-hop 192.168.255.255
#

route-policy RP_FROM_RTBH permit node 30
if-match ip-prefix GREATER24

ManuM · Created Feb 21, 2020 04:07:59

Hi,

I would like to implement the RTBH method in Huawei NE40E edge router and my application is URL filtering. Firewall will be RTBH trigger router and I wanted to inject the null route from the firewall to the edge router based on black listed ULRs. So the firewall can perform the URL filtering while in offline mode.

Please share your suggessions.

Regards,

Manu M

ViktorG · Created Feb 21, 2020 06:57:54

Good day, @ManuM !

Usualy, we have two choices on the edge to block the DDoS traffic that targetting the client.
- The first one is the described above with accepting the routes with 666 community and redirect to next-hop - widely used.
- The second one is to create BGP FlowSpec session, where we need to establish new bgp SAFI ipv4-family flow - and it will be more granular filtering control on the edge up to port level - kind of complicated approach - need to cooperate with other vendors for their BGP FlowSpec details.

Please, see the links for the Huawei and other Vendors interoperability.

https://ripe74.ripe.net/presentations/93-20170512-ripe74-flowspec-interop.pdf

https://www.nextlayer.at/wp-content/uploads/2018/06/loibl-bacher-bgp-flowspec-interop-012017.pdf

Thank you and have a great day!
Viktor

victorDa · Created Jun 14, 2020 23:12:09

very useful

victorDa · Created Jun 14, 2020 23:12:17

thanks for share it with us!

FrankWu · Created Jun 2, 2021 00:17:32

Posted by ViktorG at 2020-02-19 05:46 Hello @ManuM !The BGP Remote Triggered Black Hole is a security technique used to divert undesirable ...

Hello Viktor,

Appreciate your explanation for RTBH. Is there restriction on the "trigger router"? Can an eBGP speaker with direct connection trigger the RTBH?

I am triggering BH for 100.100.100.100/32 from an ASBR to another ASBR, the sink-hole address(NH) is 192.168.255.255.

From what I can see, the eBGP next_hop has changed to 192.168.255.255, but the prefix is "invalid for nexthop route unreachable". It looks like a recursive lookup issue on Huawei.

<SINCR0>disp ip routing-table 192.168.255.255
Route Flags: R - relay, D - download to fib, T - to vpn-instance, B - black hole route
------------------------------------------------------------------------------
Routing Table : _public_
Summary Count : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface

192.168.255.255/32 Static 1 0 DB 0.0.0.0 NULL0

<SINCR0>disp bgp routing-table 100.100.100.100

BGP local router ID : 172.25.4.67
Local AS number : 5511
Paths: 1 available, 0 best, 0 select, 0 best-external, 0 add-path
BGP routing table entry information of 100.100.100.100/32:
From: 10.251.87.29 (10.10.20.55)
Route Duration: 0d00h22m36s
Direct Out-interface:
Original nexthop: 192.168.255.255
Qos information : 0x0
Community: <5511:0>, no-export
AS-path 801, origin incomplete, MED 500, localpref 140, pref-val 0, external, pre 255, validation not-found, invalid for nexthop route unreachable
Not advertised to any peer yet

This is a NE40E running V800R010C10SPC500. Any comment ?

Frank

FrankWu · Created Jun 2, 2021 00:26:03

Posted by FrankWu at 2021-06-02 00:17 Hello Viktor,Appreciate your explanation for RTBH. Is there restriction on the "trigger router"? C ...

@ViktorG, this question is for you. thanks.

FrankWu · Created Jun 2, 2021 01:37:57

Posted by FrankWu at 2021-06-02 00:17 Hello Viktor,Appreciate your explanation for RTBH. Is there restriction on the "trigger router"? C ...

OK I am answering my own question.

I need "ebgp-max-hop".

An eBGP peer expects to have the direct inter-co IP@ as the next-hop. When we change it to anything else, it’s not in the same subnet anymore and the router will see it as unreachable. (Cisco is different in that sense)

I need to fool the eBGP peer session into thinking this is NOT a direct peer, ebgp multihop will do the trick. This is the same behavior on Huawei and on Juniper.

On Huawei, I need ebgp-max-hop’
On Juniper, I need “accept-remote-nexthop"

Frank

andersoncf1 · Created Jun 5, 2021 17:06:34

Great explanation from the friend of the community.

Remote Triggered Black Hole(RTBH) configuration

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

Remote Triggered Black Hole(RTBH) configuration

Third Party’s Trade Secret

My Followers