Re:ip route Null 0 concept

[ambivert skill]

Hi,

What is the purpose of giving ip route------ null 0 command in address like this one

ip route 10.221.224.75 255.255.255.255 Null0

I need to clear the concept because in the following thread https://supportforums.cisco.com/thread/24582  it was mention that you can you it for route summarization but here we have given the particular IP so what is purpose of using null 0 with it.

Thanks

[blau grana]

Hi

Null 0 interface is used to discard traffic destinated to paritcular network. It also help to summarize network prefix as you said.

It is good practice to add theese routes internet facing router ->

ip route 10.0.0.0 255.0.0.0 Null0

ip route 172.16.0.0 255.240.0.0 Null0

ip route 192.168.0.0 255.255.0.0 Null0

Theese routes do not allow route packets with private addresses in destination field of IP header to internet.

To be honest I do not see any logic to route host prefix to Null0 interface, but it depends on topology design, maybe it makes sense for administrator

Best Regards

Please rate helpful posts

[arvind_data]

In some cases where NNI network aslo use to avoid the loop.

[ramanathan.gunaseelan]

ip route 10.0.0.0 255.0.0.0 Null0 we have configured and in bgp we have config the redistribute static but 10.0.0.0 segment showing in advertise routes how to avoid on this without removing null 0 route

[Jose Jara]

Hi,

Normally is used with summarization as said to avoid forwarding loops. Other common use is for security doing black hole routing with BGP.

For example, let's say that router A is a CE doing summarization, configuring manually 10.1.1.0 255.255.255.0 null 0 and advertising this prefix to the PE. On the other hand is receiving the default route from the PE. Let's suppose that the CE is receiving the specifics routes of this aggregate via an IGP and suddenly it stops receiving one of them, the 10.1.1.0/25. Other site try to communicate with host 10.1.1.10, as the CE does not know how to reach the packet via the specifics routes received from the LAN, it chooses the 10.1.1.0/24 and it drops the packet. You may see that without configuring the route pointing to null 0, just configuring the same route pointing to the next hop of the LAN, the CE would choose the default route received from the PE and this one will choose the 10.1.1.0/24 towards the CE, then the CE does the same choosing the default and so on, and the forwarding loop will exist until the TTL expires.

Routing protocols OSPF, BGP and EIGRP, will install by default a discard route automatically when they do summarization via area x range/summary address in OSPF, aggregate-address in BGP and ip summary-address in EIGRP.

So, basically route to null 0 is used to avoid the election of less specific route.

Hope this helps,

Jose.

[paul driver]

Hello,

Basically any ip address not matched within the null interface statement gets blacked holed instead of being loop around the network until the ttl expires. - I would say a very useful command to use.

res

Paul

Please don't forget to rate this post if it has been helpful.

[tony.henry_2]

As i understood it.

A route packet sent to loopback will end up sending a ICMP unreachable from the router to the transmitting host. Whereas a packet sent to null interface will not send anything back to the transmitting host. This had security applications where you don't necessarily want to advertise what your networking infrastructure looks like, and you have reason to route stuff to null eg and ISP who wants to be a good netcitizen and routes RFC 1918 addresses to null.

HTH

Tony 

[Richard Burts · Accepted solution]

As others in this thread have mentioned there are several uses of a static route to null 0. It can be used as part of summarization (though that does not seem to be the case here). And it can be used to be sure that an entry is in the routing table so that it will be advertised by protocols such as BGP (though that does not seem to be the case here). And it can be used to silently discard traffic (which might be the case here).

Think about a situation in which you have detected that a host (perhaps 10.221.224.75) is probing your network or is generating unwelcome traffic into your network. You want to prevent traffic from being returned to that host. One alternative would be to configure access list filtering to deny traffic to that host. But configuring access list filtering introduces complexity into the configuration and overhead into the operation of the router. You could configure the static route as you mention and it would achieve the same result - no traffic is sent to 10.221.224.75. There is not complexity in the configuration and there is not extra overhead in evaluating the access list.

HTH

Rick

10.221.224.75#sthash.tgNfdTWc.dpuf

[hermanwjacobsen]

I've been working at an Internet Service Provider, where they actully used null routes to temporarily block customers from accessing the internet by creating a null route on the customers ip address and discarding the traffic.

[Richard Burts]

Thanks for confirming my explanation by supplying a real world experience of it. Discarding traffic by using a static route to null 0 is simpler and less overhead than having to configure an access list and apply the access list to interface(s).

HTH

Rick

[jawad-mukhtar]

Very Nice Explanation by Richard. Thanks..

[ambivert skill]

Thanks to all of you for clearing the concept, I really appreciate for helping me.

Regards

Ambivert