2014-04-15 18:42 GMT+02:00 Laurent Caron (Mobile) <lca...@unix-scripts.info> :
> On 14 avril 2014 17:57:53 CEST, Tristan PILAT <tristan.pi...@gmail.com> > wrote: > >match from any community 64514:888 set nexthop blackhole > > > > Hi, > > Make sure you dont accept from any but eg from group customers, make sure > the address *does* belong to your customers space (to avoid a customer > installing a blackhole route on a route you advertise). > Make sure you do strip 64514:888 from other peers. > ... > > >And what about the client side ? Which command should he enter if he > >wishes > >to blackhole ip 1.2.3.4 eg > > > >Is it something like that ? bgpctl network add 1.2.3.4/32 community > >64514:888 > > Exactly. > > Hi, Thanks for your reply ! I just tested this in my lab and it's working like a charm but only if I set "allow from any inet prefixlen 8 - 32" and this is annoying. Is there a way to make this work with "allow from any inet prefixlen 8 - 24" to accept /32 only for the blackhole ? -- Tristan
