Wanguard 6.2 User Guide
Appendix 3 – BGP Black Hole Guideline for Wanguard Sensor
Black-holing on upstream
The principle of DDoS mitigation using black hole BGP advertisements is to propagate the BH-prefix from the
destination of the attack closest as possible to the source. Most ISPs have defined a public community, based on
which their IBRs take the decision to black hole the traffic destined to the victim by routing it to Null0. In comparison
to redirect announcements, the black-holing announcements have to be advertised to upstream ISPs.
In order to black hole the attack on the upstream provider, the black hole route must be tagged/marked
with an appropriate BGP standard community. This community is provider-specific and has to be requested by each
customer to the provider, or it might be found on IRR ASN details (e.g. RIPE, APNIC, ARIN, etc.).
On IBR there shall be a routing-policy applied to the to-ISP-BGP neighbor (export-direction) which shall
rewrite
the internal BH-community to appropriate ISP’s BH-community.
From a BGP configuration point of view, the Sensor’s configuration is quite similar to Filter’s BGP
configuration explained in Annex 4 on page 114, having one exception in regards to the BGP community that will be
used to mark black hole routes. Considering this, only the IBR’s configuration will be further detailed.
IBR BGP Session with Wanguard Sensor – Cisco Router BGP Configuration
r7500(config)# ip bgp-community new-format
r7500(config)# ip community-list <Wanguard-Sensor-community-name> permit <BH-community>
→
e.g. 65000:66
r7500(config)# route-map
Wanguard-Filter-in
permit 10
r7500(config-route-map)# match community
<Wanguard-Sensor-community-name>
r7500(config-route-map)# set local-preference 200
→ it will assure a higher priority against
redirect-route
r7500(config-route-map)# set ip next-hop 192.168.255.255
→ this target-IP must not be used
on your network
r7500(config-route-map)# exit
r7500(config)# route-map
Wanguard-Sensor-out
deny 10
r7500(config-route-map)# exit
r7500(config)# ip route 192.168.255.255 255.255.255.255 Null0
→ BH route for target-IP
r7500(config)# router bgp
<Router-AS-number>
r7500(config-router)# bgp log-neighbor-changes
r7500(config-router)# neighbor
<Wanguard-Sensor-IP-address>
remote-as
<Wanguard-Sensor-AS-
number>
r7500(config-router)# neighbor
<Wanguard-Sensor-IP-address>
description
<description>
r7500(config-router)# neighbor
<Wanguard-Sensor-IP-address>
soft-reconfiguration-inbound
r7500(config-router)# neighbor
<Wanguard-Sensor-IP-address>
route-map
Wanguard-Sensor-out
out
r7500(config-router)# neighbor
<Wanguard-Sensor-IP-address>
route-map
Wanguard-Sensor-in
in
r7500(config-router)# no synchronization
r7500(config-router)# exit
BGP Session with Two ISPs – Cisco Router BGP Configuration
r7500(config)# route-map
IBR-ISP1-out
permit 5
→ assumes that additional entries are defined
and allow customer-routes
r7500(config-route-map)# match community
<Wanguard-Sensor-community-name>
r7500(config-route-map)# set community
<ISP1-BH-Community>
→ e.g.111:9999
r7500(config-route-map)# exit
r7500(config)# route-map
IBR-ISP2-out
permit 5
→ assumes that additional entries are defined
- 110 -
Summary of Contents for wanguard 6.2
Page 1: ......
