Step 2

Prior to the attack, configure inbound route-maps on all edge BGP speakers (R2 through R4 in Black Hole Routing Using BGP).

These inbound policies modify the next-hop of specifically marked BGP network layer reach-ability information (NLRIs) to point to the chosen black hole next-hop. We use BGP community or extended-community attributes to identify NLRIs that need to be black holed (ones whose next-hops have to be modified). The community values that are chosen should be reserved for this purpose within the provider network.

In the following example, a community of 666:0 is chosen for identifying blackhole routes. The next-hop of BGP NLRIs with that community attribute is modified to use the blackhole next-hop.

R3.1 # edit policy BH_policy_NH
entry bh-nhset {
		if match any {
			community 666:0;
			nlri any/32 ;
		} then {
			next-hop 192.168.2.66 ;
			permit ;
		}
}
entry bh-default {
		if match any {
		} then {
			permit ;
		}
}