If addresses in a NAT address pool are on a different network segment from the IP address of the NGFW WAN interface, configure a blackhole route to prevent loops between the NGFW and the Internet.
The NGFW uses a blackhole route to implement the following functions:
Prevents loops between the NGFW and a routing device connected to the Internet.
As shown in Figure 11-1, when intranet users initiate connections to the Internet, the NGFW translates private addresses of the users into public addresses in an address pool. When Internet users send packets to the addresses in the address pool, the NGFW cannot find matching server-map entries for the packets. Therefore, the NGFW loops the packets to the router based on the routing table. The router then forwards the received packets to the NGFW again. As a result, the packets loop between the NGFW and router. After the time to live (TTL) values in packets decrease to 0, the packets are discarded. If malicious Internet users initiate a large number of connections to addresses in the address pool, the performance of both the NGFW and router deteriorates.
Figure 1-1 Routing loops
To prevent the routing loops, you can configure a 32-bit-mask blackhole route bound for addresses in the address pool on the NGFW. The NGFW discards packets whose destination addresses match the blackhole route.
The 32-bit-mask blackhole route is needed when static mapping is enabled on the NGFW.
Allows a dynamic routing protocol to import and advertise the blackhole route so that a router connecting the NGFW to the Internet can learn the blackhole route destined for addresses in an address pool.
Although the NGFW and its upstream router run a dynamic routing protocol, for example, Open Shortest Path First (OSPF), OSPF cannot automatically learn the routes destined for these addresses in the address pool.
To resolve the problem, configure a 32-bit-mask blackhole route destined for addresses in the address pool. OSPF can import the blackhole route and advertises it within a routing area. Routers in the routing area can learn the blackhole route to the addresses in the address pool.
