Destination-Based RTBH (VRF Provider-triggered)
Topology: ine-spv4
Load rtbh.vrf.init.cfg
R1, XR2, R7 and R8 are all dual-stacked internet peers in an INET VRF. Configure destination-based RTBH within the core so that traffic destined for 1.1.1.1/32 and 2001:1::1/128 is dropped. Use R4 as the signaling server, using communities for triggering the RTBH.
Answer
Explanation
When using RTBH in a VRF, we must apply the route-policies/route-maps to the VPNv4/VPNv6 BGP AFIs.
On IOS-XR, we can simply set the next-hop to discard. We apply this policy to routes received from the RR. On IOS-XR, we are already sending both communities to iBGP neighbors as well, so we don’t need to worry about that. (This router is not the trigger router anyways, so it doesn’t actually matter for this particular lab).
On IOS-XE, we have some additional steps to take. First, we need to make sure we are sending both communities. By default, for VPNv4/v6, only extended communities are sent.
Next, we define the community and match VPNv4/v6 routes with this community, setting the nexthop to a dummy nexthop, which recurses to a null0 route. Unfortunately, IOS-XE does not have a “set ip next-hop discard” option. Instead, we use an IPv4 test prefix as the dummy null0 route. Notice that this route exists in the global RIB. This is because the global RIB is used to resolve VPNv4/v6 nexthops. (These are usually PE loopback addresses in the global RIB). For VPNv6, we use an IPv4-mapped IPv6 address so that a single IPv4 null0 route can be used for both VPNv4 and VPNv6.
Finally, the trigger router, R4, injects the prefixes into the INET VRF setting the community to 100:666 and no-export. It is important to set no-export so that the prefix is not leaked to INET peers.
Verification
All PEs should be dropping traffic destined for 1.1.1.1/32 or 2001:1::1/128 in the INET vrf. The quickest way to check this is to check the VRF FIB.
A traceroute from any CE to 1.1.1.1 and 2001:1::1 should be dropped at the first PE:
Also, none of the PEs should see the /32 or /128 route because of the no-export community.
Last updated