Remote trigger blackhole filtering

[sherif_sec]

i have some points in RTBF with BGP that i can't understand it , it confuse me

first thats a part of config.

route-map black-hole-trigger permit 10
match tag 66
set ip next-hop 192.0.2.1
set local-preference 200
set origin igp
set community no-export
route-map black-hole-trigger deny 20

why we need the last 4 lines , also in some configuration i found that that in the last line there is PERMIT instead od DENY , why ?

another question , is i must know bgp details for ccie sec lab or just overview would be enough ?

[Roman Rodichev · Accepted solution]

set local-preference 200

this is needed to ensure that if we receive the same route from some other AS (default local pref 100), all BGP routers in our AS will use our local trigger route with local-pref 200

set origin igp

by default static routes redistributed into BGP will have origin incomplete, and this command will set it to origin IGP. IGP wins over incomplete. This plays similar role as the one above.

set community no-export

this is pretty straight forward. We don't want to advertise our trigger route to other AS'es.

route-map black-hole-trigger deny 20

this depends on the situation. Do you have more routes without tag 66 that you want to inject? If yes, do permit, if not, use deny (or rely on implicit deny)

[sherif_sec]

thank you for your help

but is i must know bgp details for ccie sec lab or just overview would be enough ?