1
00:00:00,000 --> 00:00:02,964
[MUSIC PLAYING]

2
00:00:02,964 --> 00:00:07,910

3
00:00:07,910 --> 00:00:10,340
Sometimes, as a
service provider,

4
00:00:10,340 --> 00:00:13,370
it becomes necessary
to filter routes,

5
00:00:13,370 --> 00:00:17,540
often on behalf of the
customers who may be undergoing

6
00:00:17,540 --> 00:00:19,410
some form of an attack.

7
00:00:19,410 --> 00:00:22,100
And in that type of
a situation, it's

8
00:00:22,100 --> 00:00:25,850
going to be a lot easier
to centrally manage

9
00:00:25,850 --> 00:00:28,190
that filtering of the routes.

10
00:00:28,190 --> 00:00:31,130
And this is where we get a
feature called remote triggered

11
00:00:31,130 --> 00:00:35,360
Black Hole filtering, or RTBH.

12
00:00:35,360 --> 00:00:38,360
That's what we're going to
be focusing on in this video.

13
00:00:38,360 --> 00:00:40,250
There are two
different types of it.

14
00:00:40,250 --> 00:00:44,810
We'll be discussing the first
one, destination-based RTBH.

15
00:00:44,810 --> 00:00:48,990
And then in our next video,
we'll be covering source-based.

16
00:00:48,990 --> 00:00:51,920
So let's jump in and talk
about some of its details.

17
00:00:51,920 --> 00:00:54,620
And then as always, we'll
jump on to the command line

18
00:00:54,620 --> 00:00:57,650
and get it working.

19
00:00:57,650 --> 00:01:00,550
So as we did say during
the introduction,

20
00:01:00,550 --> 00:01:04,989
there are two types of Remote
Triggered Black Hole filtering.

21
00:01:04,989 --> 00:01:07,210
There's
destination-based, which,

22
00:01:07,210 --> 00:01:11,050
of course, is filtering traffic
based on the destination that's

23
00:01:11,050 --> 00:01:12,340
going to.

24
00:01:12,340 --> 00:01:16,960
And there's source-based, which
is filtering that traffic based

25
00:01:16,960 --> 00:01:19,880
on the source of that traffic.

26
00:01:19,880 --> 00:01:22,300
So of course, in
this video, we are

27
00:01:22,300 --> 00:01:25,000
focusing on destination-based.

28
00:01:25,000 --> 00:01:27,550
We'll cover source-based next.

29
00:01:27,550 --> 00:01:31,390
Now, destination-based
does have a few things

30
00:01:31,390 --> 00:01:33,250
we need to be aware of.

31
00:01:33,250 --> 00:01:36,460
The way this works
is, it discards

32
00:01:36,460 --> 00:01:42,460
the traffic going to the victim
at the service provider edge.

33
00:01:42,460 --> 00:01:44,290
Now, that does mean
that we're going

34
00:01:44,290 --> 00:01:47,920
to have to know the victim's
IP address, which generally

35
00:01:47,920 --> 00:01:49,660
would be our customer.

36
00:01:49,660 --> 00:01:53,530
And here's the really
downside of this.

37
00:01:53,530 --> 00:01:59,140
Communication between the victim
and the rest of the internet

38
00:01:59,140 --> 00:02:04,390
is going to be lost, which means
we're effectively cutting off

39
00:02:04,390 --> 00:02:05,770
the customer.

40
00:02:05,770 --> 00:02:09,039
And to an extent, that
does help the attacker.

41
00:02:09,039 --> 00:02:11,260
Because at the end
of the day, what

42
00:02:11,260 --> 00:02:16,540
is the point of a distributed
denial of service attack?

43
00:02:16,540 --> 00:02:19,150
It's to cut off the victim.

44
00:02:19,150 --> 00:02:24,730
So to a certain extent, yes,
this is helping the attacker.

45
00:02:24,730 --> 00:02:28,840
But let's move on
with the overall idea.

46
00:02:28,840 --> 00:02:32,530
The idea is we're going to be
conserving service provider

47
00:02:32,530 --> 00:02:34,090
resources.

48
00:02:34,090 --> 00:02:39,040
Then once this is contained,
the service provider

49
00:02:39,040 --> 00:02:41,560
can further
investigate the attack,

50
00:02:41,560 --> 00:02:46,330
design a better solution
to prevent the victim

51
00:02:46,330 --> 00:02:48,760
from further DDoS attacks.

52
00:02:48,760 --> 00:02:51,830
And then once this is
done, we're, of course,

53
00:02:51,830 --> 00:02:54,280
going to stop
discarding the traffic,

54
00:02:54,280 --> 00:02:57,440
bringing the
customer back online.

55
00:02:57,440 --> 00:03:04,090
Now, the way we do this is we
implement a next hop of null

56
00:03:04,090 --> 00:03:07,720
for the traffic going to that
victim, which means we're

57
00:03:07,720 --> 00:03:10,150
essentially routing
the traffic to what's

58
00:03:10,150 --> 00:03:11,710
known as the Bitbucket.

59
00:03:11,710 --> 00:03:13,870
It's being discarded.

60
00:03:13,870 --> 00:03:16,420
So in order to
implement this, there

61
00:03:16,420 --> 00:03:18,560
are a few steps
that we have to do.

62
00:03:18,560 --> 00:03:22,150
The first is we have to
choose a network where we're

63
00:03:22,150 --> 00:03:24,310
going to be sending
this traffic that's

64
00:03:24,310 --> 00:03:26,650
going to go to null zero.

65
00:03:26,650 --> 00:03:34,210
Very common thing to do is
to use this 192.0.2.0/24.

66
00:03:34,210 --> 00:03:38,860
This is designated as a
test network in RFC 6890.

67
00:03:38,860 --> 00:03:41,990
So that's what we'll
use here as well.

68
00:03:41,990 --> 00:03:45,670
Then we configure all
of our edge routers

69
00:03:45,670 --> 00:03:49,450
with a static route going
to the chosen blackhole

70
00:03:49,450 --> 00:03:51,910
network, which is the
network we chose up here.

71
00:03:51,910 --> 00:03:55,630
And it's going to have
a next hop of null zero.

72
00:03:55,630 --> 00:03:58,690
That's what's going to cause
the traffic to be discarded.

73
00:03:58,690 --> 00:04:03,970
Then we configure one router
as our Signaling Router.

74
00:04:03,970 --> 00:04:06,250
And what this is
going to do is it's

75
00:04:06,250 --> 00:04:10,660
going to be configured to
redistribute static routes

76
00:04:10,660 --> 00:04:15,520
with a specific tag into BGP.

77
00:04:15,520 --> 00:04:19,720
These static routes will
have a next hop that's

78
00:04:19,720 --> 00:04:21,529
on the blackhole network.

79
00:04:21,529 --> 00:04:23,380
So again, we're talking
about this network

80
00:04:23,380 --> 00:04:24,880
up here that we chose.

81
00:04:24,880 --> 00:04:26,980
That's what's going
to be the next hop.

82
00:04:26,980 --> 00:04:30,100
The edges, of course, will
then route that to null zero,

83
00:04:30,100 --> 00:04:32,273
as we said in step two.

84
00:04:32,273 --> 00:04:33,940
We're also going to
make sure that these

85
00:04:33,940 --> 00:04:37,960
have a high local
preference, and no export--

86
00:04:37,960 --> 00:04:40,150
because, number one,
we want to make sure

87
00:04:40,150 --> 00:04:42,670
these routes are actually
used in our environment.

88
00:04:42,670 --> 00:04:44,980
And number two,
for the no export,

89
00:04:44,980 --> 00:04:47,710
we want to make sure that
they don't leave the service

90
00:04:47,710 --> 00:04:49,610
provider environment.

91
00:04:49,610 --> 00:04:52,480
So the final step, once
this is all set up,

92
00:04:52,480 --> 00:04:55,750
is once we've detected
that attack, we then

93
00:04:55,750 --> 00:04:58,840
create a static route
with that proper tag

94
00:04:58,840 --> 00:05:01,010
that we chose up above.

95
00:05:01,010 --> 00:05:06,040
So using this tag, we configure
this on the Signaling Router.

96
00:05:06,040 --> 00:05:08,290
Then using all the
mechanisms above,

97
00:05:08,290 --> 00:05:11,440
that static route is
redistributed into BGP.

98
00:05:11,440 --> 00:05:13,180
That is sent to all
the edge routers.

99
00:05:13,180 --> 00:05:16,270
And the edge routers start
routing all of that traffic

100
00:05:16,270 --> 00:05:18,220
to null zero.

101
00:05:18,220 --> 00:05:22,160
So this is where we're going
to jump in and configure.

102
00:05:22,160 --> 00:05:24,010
So what we're going
to do, we're going

103
00:05:24,010 --> 00:05:27,330
to configure this in AS 100.

104
00:05:27,330 --> 00:05:31,890
And we will use Router 1
as our Signaling Router.

105
00:05:31,890 --> 00:05:34,840
So let's go ahead and jump
into the command line.

106
00:05:34,840 --> 00:05:39,340
Of course, we'll start
by configuring Router 1.

107
00:05:39,340 --> 00:05:43,670
So the first thing we need to
configure is that static route.

108
00:05:43,670 --> 00:05:48,190
So let's go into router static
for the address family IPv4

109
00:05:48,190 --> 00:05:49,660
unicast.

110
00:05:49,660 --> 00:05:54,070
And we'll set up a route
to that 192.0.2 network.

111
00:05:54,070 --> 00:05:57,430
And we'll just make it a /24.

112
00:05:57,430 --> 00:06:01,240
And we'll say to route
that to null zero.

113
00:06:01,240 --> 00:06:04,240
Next, let's configure
our route policy.

114
00:06:04,240 --> 00:06:07,660
And we'll just call
it RP underscore RTBH.

115
00:06:07,660 --> 00:06:09,260
And here's what we want to do.

116
00:06:09,260 --> 00:06:12,530
We want to match on that
tag we talked about.

117
00:06:12,530 --> 00:06:16,540
So we'll say, if the tag is--

118
00:06:16,540 --> 00:06:18,250
and we can use any
tag we want here.

119
00:06:18,250 --> 00:06:20,530
I'll just use 999.

120
00:06:20,530 --> 00:06:23,980
Then what do we want
to do with the route?

121
00:06:23,980 --> 00:06:25,900
Well, the first
thing we want to do

122
00:06:25,900 --> 00:06:32,650
is set the next hop
to be 192.0.2 dot--

123
00:06:32,650 --> 00:06:33,970
something on that network.

124
00:06:33,970 --> 00:06:35,530
It doesn't really matter what.

125
00:06:35,530 --> 00:06:39,280
Since we're doing a /24,
we'll just say dot 1.

126
00:06:39,280 --> 00:06:42,157
Either way, it's getting
routed to null zero.

127
00:06:42,157 --> 00:06:43,990
Then, of course, we
want to do the other two

128
00:06:43,990 --> 00:06:45,950
things we mentioned.

129
00:06:45,950 --> 00:06:47,830
We want to set the community.

130
00:06:47,830 --> 00:06:50,350
And we'll set it to no export.

131
00:06:50,350 --> 00:06:51,970
And we'll set the
local preference

132
00:06:51,970 --> 00:06:53,980
to something really high.

133
00:06:53,980 --> 00:06:56,560
Like, say, for example, 2000.

134
00:06:56,560 --> 00:06:58,570
We'll end our if statement.

135
00:06:58,570 --> 00:07:00,580
And we'll end our policy.

136
00:07:00,580 --> 00:07:06,100
Next, we go into router BGP
100, into our address family.

137
00:07:06,100 --> 00:07:10,090
And we're going to say to
redistribute static routes

138
00:07:10,090 --> 00:07:12,520
using the route policy.

139
00:07:12,520 --> 00:07:14,500
And put in our name.

140
00:07:14,500 --> 00:07:19,020
We'll commit our changes,
and exit configuration.

141
00:07:19,020 --> 00:07:22,280
Now, Routers 2, 3,
and 4 simply need

142
00:07:22,280 --> 00:07:24,650
that static route to null zero.

143
00:07:24,650 --> 00:07:26,990
So we'll just copy
and paste that in,

144
00:07:26,990 --> 00:07:29,340
rather than sitting
here and typing it.

145
00:07:29,340 --> 00:07:31,700
So we'll start on Router 2.

146
00:07:31,700 --> 00:07:33,590
Then Router 3.

147
00:07:33,590 --> 00:07:35,600
And finally, Router 4.

148
00:07:35,600 --> 00:07:38,900
Now to actually make this work,
let's go back over to Router 1,

149
00:07:38,900 --> 00:07:41,180
since that's our
Signaling Router.

150
00:07:41,180 --> 00:07:44,180
Let's start with a show IP BGP.

151
00:07:44,180 --> 00:07:46,370
Looking at this
output, let's just

152
00:07:46,370 --> 00:07:48,480
choose a customer's network.

153
00:07:48,480 --> 00:07:55,130
So let's say, for example,
the 37.18.12.0/24 was being

154
00:07:55,130 --> 00:07:56,197
attacked.

155
00:07:56,197 --> 00:07:58,280
So let's take a look at
that entry in a little bit

156
00:07:58,280 --> 00:08:00,000
more detail.

157
00:08:00,000 --> 00:08:04,190
So we'll say to
look at 37.18.12.0.

158
00:08:04,190 --> 00:08:09,860
And we see at this point, this
is a fairly standard BGP entry.

159
00:08:09,860 --> 00:08:13,820
Now, it does have one path here
with an inaccessible next hop,

160
00:08:13,820 --> 00:08:16,010
going over towards Router 7.

161
00:08:16,010 --> 00:08:17,510
But that doesn't
really affect what

162
00:08:17,510 --> 00:08:18,950
we're looking at right now.

163
00:08:18,950 --> 00:08:23,670
We can see that it does in fact
have other usable paths here.

164
00:08:23,670 --> 00:08:28,580
In fact, if we were to do a show
IP cef for the same network,

165
00:08:28,580 --> 00:08:30,830
we would see that
it currently has

166
00:08:30,830 --> 00:08:39,530
a next hop of 50.0.167.7, which
is going over towards Router 7.

167
00:08:39,530 --> 00:08:41,960
So now let's configure
our blackhole.

168
00:08:41,960 --> 00:08:44,810
So we'll go back into
configuration mode,

169
00:08:44,810 --> 00:08:49,280
back into router static,
into our address family.

170
00:08:49,280 --> 00:08:55,220
Then we'll put in the
customer route, 37.18.12.0/24.

171
00:08:55,220 --> 00:08:57,350
We'll route that to null zero.

172
00:08:57,350 --> 00:09:02,420
But most importantly,
we'll set the tag to 999

173
00:09:02,420 --> 00:09:05,990
so that it gets picked
up for redistribution.

174
00:09:05,990 --> 00:09:07,970
We'll commit the changes.

175
00:09:07,970 --> 00:09:10,160
Exit configuration.

176
00:09:10,160 --> 00:09:12,240
And then we'll verify.

177
00:09:12,240 --> 00:09:15,470
So first, on the output of
the cef for that destination

178
00:09:15,470 --> 00:09:17,630
network, we see, of
course, that it's

179
00:09:17,630 --> 00:09:21,530
using that null zero because we
put that in as a static route.

180
00:09:21,530 --> 00:09:24,230
And if we look at
the BGP entry, we

181
00:09:24,230 --> 00:09:29,720
can see here that it's using
that route to 192.0.2.1,

182
00:09:29,720 --> 00:09:34,580
injected locally with that
local preference of 2000.

183
00:09:34,580 --> 00:09:38,370
We also see the community
set to no export.

184
00:09:38,370 --> 00:09:43,160
So we see that it is in fact
putting this route into BGP.

185
00:09:43,160 --> 00:09:46,380
Now let's go verify it
on the other routers.

186
00:09:46,380 --> 00:09:49,700
So let's look at the cef
entry here on Router 2.

187
00:09:49,700 --> 00:09:51,950
And we see, of course,
for that entry,

188
00:09:51,950 --> 00:09:55,850
it is going to the
192.0.2.1, which

189
00:09:55,850 --> 00:09:58,820
we know is going to
null zero because we

190
00:09:58,820 --> 00:10:00,660
have the static route.

191
00:10:00,660 --> 00:10:04,360
We can check this on
three and four as well.

192
00:10:04,360 --> 00:10:09,030
This is also correctly
pointing to the 192.0.2.1.

193
00:10:09,030 --> 00:10:11,400
And finally, Router 4.

194
00:10:11,400 --> 00:10:14,350
We see that this is doing
the same thing as well.

195
00:10:14,350 --> 00:10:21,390
So this would be routing any
traffic going to the 37.18.12.0

196
00:10:21,390 --> 00:10:26,400
into the Bitbucket or null zero.

197
00:10:26,400 --> 00:10:29,550
In this video, we
saw how to configure

198
00:10:29,550 --> 00:10:34,300
destination-based Remote
Triggered Black Hole filtering.

199
00:10:34,300 --> 00:10:36,990
Now, again, the big
downside to this

200
00:10:36,990 --> 00:10:40,360
is, yes, we're preventing
the denial of service attack.

201
00:10:40,360 --> 00:10:44,040
But at the same time, we are
cutting off the customer.

202
00:10:44,040 --> 00:10:46,710
Any traffic going to
this customer's network

203
00:10:46,710 --> 00:10:48,250
is now being dropped.

204
00:10:48,250 --> 00:10:51,720
So we would, of course, still
have to fix the problem.

205
00:10:51,720 --> 00:10:56,560
And possibly to fix that
problem is our next solution,

206
00:10:56,560 --> 00:11:00,780
which is source-based Remote
Triggered Black Hole filtering

207
00:11:00,780 --> 00:11:02,950
that we're going to cover next.

208
00:11:02,950 --> 00:11:06,240
Until then, I hope this has
been informative for you,

209
00:11:06,240 --> 00:11:09,380
and I'd like to thank
you for viewing.

210
00:11:09,380 --> 00:11:13,000