Re: How to validate blackhole routes? (Was: trouble letting go of IRR)

Hi.

A short follow-up. I noticed that newer Junos releases allow to
install validation records from a specific RTR session to a designated
named validation database and, for example, this enables a setup where
RTBH prefixes are not rejected if the RTR sessions for RTBH routes are
down.

I modified the script generating the JSON file for RTRTR in a way that
routers always have "0.0.0.0/0-32  ASN 0" and "::/0-128  ASN 0"
validation records besides possible /32 v4 and /128 v6 RTBH validation
records in validation database named "rtbh". The RTBH check in the BGP
import policies list was moved back before the RPKI check. As an
example, the RTBH check for v6 can be seen below:

root@vjr-17> show configuration policy-options policy-statement ipt-rtbh-v6
term reject-blackhole-rpki-invalid {
    from {
        family inet6;
        protocol bgp;
        community blackhole;
        validation-database-instance {
            database-name rtbh;
            state invalid;
        }
    }
    then {
        validation-state invalid;
        reject;
    }
}
term accept-blackhole-rpki-valid {
    from {
        family inet6;
        protocol bgp;
        community blackhole;
        validation-database-instance {
            database-name rtbh;
            state valid;
        }
    }
    then {
        local-preference 170;
        validation-state valid;
        origin igp;
        /* requires accept-remote-nexthop */
        next-hop 100::1;
        accept;
    }
}
/* fallback if RTBH RTR sessions are down */
term accept-blackhole-rpki-unknown {
    from {
        family inet6;
        protocol bgp;
        community blackhole;
        validation-database-instance {
            database-name rtbh;
            state unknown;
        }
        route-filter ::/0 prefix-length-range /128-/128;
    }
    then {
        local-preference 170;
        validation-state unknown;
        origin igp;
        next-hop 100::1;
        accept;
    }
}
term reject-blackhole {
    from {
        family inet6;
        protocol bgp;
        community blackhole;
    }
    then reject;
}
then next policy;

root@vjr-17>


In summary, if the v6 blackhole prefix does not have a /128 entry in
"rtbh" validation database, then it will be rejected thanks to
"::/0-128  ASN 0" VRP. If the validation check is valid or unknown,
then the /128 blackhole prefix is accepted.


I uploaded the configuration files here:
https://gist.github.com/tonusoo/3e3cc16fe2008fcb9b47aa6e4831c73d


Martin
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/C65BRDKOBOWAGX46DQWWIWBH3QBESPRR/