{"id":11680,"date":"2021-09-24T12:15:00","date_gmt":"2021-09-24T15:15:00","guid":{"rendered":"https:\/\/made4it.com.br\/blackholejuniper\/"},"modified":"2023-03-08T14:58:12","modified_gmt":"2023-03-08T17:58:12","slug":"blackholejuniper","status":"publish","type":"post","link":"https:\/\/made4it.com.br\/en\/blackholejuniper\/","title":{"rendered":"Blackhole BGP \u2013 Juniper (Juniper MX5\/10\/40\/80\/104, MX204, MX240\/480\/960)"},"content":{"rendered":"\n

Now that you know it’s a blackhole (if you still know, check out our article on RTBH – Blackhole). Now it’s time to configure it and be able to protect yourself from DDoS attacks.<\/p>\n\n

To summarize the Blackhole, it is a technique of sending a route to the \u201cblack hole\u201d or simply making the router discard packets directed to that IP. With the blackhole you can also announce these attacked IPs to your suppliers\/upstreams and thus stop the attacks.<\/p>\n\n

Now that I know what, now comes the question how to blackhole my router? In today’s article we will show you how to configure Blackhole on Juniper RoutersTo do the Blackhole manually we have some steps that are:<\/p>\n\n

  1. Identify the attacked IP<\/li>
  2. Create route to blackhole<\/li>
  3. Advertise this blackhole route via BGP to your carriers\/upstreams<\/li><\/ol>\n\n

    You can automate all of this with Made4Flow, already closing a direct session and not having to do manual work.If you want to know how to automate everything with Made4Flow, check out our next article.<\/p>\n\n

    \n Let’s go to the settings then<\/strong>\n <\/p>\n\n

    \n 1 \u2013 Identify the attacked IP<\/strong>\n <\/p>\n\n

    You can do this through Netflow analysis, as in Made4Flow, through the graphs and identify through the Raw Data Report, which IP has the most traffic and possibly being the victim of the attack.Within Made4Flow, access for example the Interface Graph by Application and then, clicking on the most used port, you can identify which IP is being attacked<\/p>\n\n

    Or through Made4Flow, simply by accessing the Anti-DDoS module -> Active Anomalies<\/p>\n\n

    \"\"<\/a><\/figure>\n\n

    The attacked IP was: 200.189.56.55 (Example)<\/p>\n\n

    \n 2) Create a route to Discard (Blackhole)<\/strong>\n <\/p>\n\n

    After identifying the attacked IP via Made4Flow it is now time to create the route in your Juniper Router to effectively play the IP to Blackhole or Discard<\/p>\n\n

    Let’s assume that the attacked IP is 200.200.200.1, let’s create the route as follows<\/p>\n\n

    \"\"<\/a><\/figure>\n\n

    Applied commands:<\/p>\n\n

    configureset routing-options static route 200.200.200.1\/32 discardcommit and-quit<\/p>\n\n

    After applying the route pointing to Discard that IP will STOP WORKING!<\/strong><\/p>\n\n

    You can check the route using the show command:<\/p>\n\n

    \"\"<\/a><\/figure>\n\n

    If the route is showing as Discard, you are already sending it to Blackhole<\/p>\n\n

    \n 3 – Announce the IP in blackhole via BGP to your operators\/upstreams<\/strong>\n <\/p>\n\n

    After identifying and blackhole the route you need to advertise via BGP to your operators\/upstreams.<\/p>\n\n

    Before configuration, it is always recommended to talk to your Operator\/Upstream to find out which Blackhole BGP community is.The BGP session with your carrier needs to be established.<\/p>\n\n

    For this we have a few steps:<\/p>\n\n

    1. \n Configure your Carrier\/Upstream Blackhole Community<\/strong>\n <\/li><\/ol>\n\n

      To configure the blackhole community so that it can be used later, we need to run the following command:<\/p>\n\n

      \"\"<\/a><\/figure>\n\n

      Command:set policy-options community cm_blackhole_operadora_XPTO members 666:666commit and-quit<\/p>\n\n

      If it is necessary to add more communities, apply the same command changing the community name and number<\/p>\n\n

      Tip<\/strong>: Talk to your operator to find out which BGP blackhole community they use<\/p>\n\n

      1. \n Configure the policy-statement to Accept Blackole<\/strong>\n <\/li><\/ol>\n\n

        To configure the sending of Blackhole in the policy-statement, you must first identify the policy used in the BGP session with the Operator and then configure to accept the Blackhole Route within a term<\/p>\n\n

        In our example, where the IP 200.200.200.1\/32 is attacked, we will use the following command:Edit the policy:<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        Create a new term already with the attacked IP:<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        Next step is to accept the route within this term<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        Next step is to add the previously created community<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        Next step is to change the order of the policy, so that the term containing the blackhole route is at the top as possible, we will use the insert command<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        We can validate with the show command that the configuration is correct:<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        All commands used:<\/p>\n\n

        configure exclusiveedit policy-options policy-statement OPERADORA-XPTO-OUTset term IP-ATACADO from route-filter 200.200.200.1\/32 exactset term IP-ATACADO then acceptset term IP-ATACADO then community set cm_blackhole_operadora_XPTOinsert term IP-ATACADO before term MEU-BLOCOcommit and-quit<\/p>\n\n

        You can validate if you are advertising the route using the command show route advertising-protocol bgp 192.168.100.1<\/p>\n\n

        \"\"<\/a><\/figure>\n\n

        Once this is done, the IP will remain in blackhole and announced to your operator, the attack will cease if it goes to this single IP.The complete configuration looked like this:routing-options { static { route 200.200.200.0\/22 discard; route 200.200.200.1\/32 discard; } autonomous-system 65000;}protocols { bgp { group OPERADORA-XPTO { export OPERADORA-XPTO-OUT; neighbor 192.168.100.1 { description OPERADORA-XPTO; peer-as 64700; } } }}policy-options { policy-statement OPERADORA-XPTO-OUT { term IP-ATACADO { from { route-filter 200.200.200.1\/32 exact; } then { community set cm_blackhole_operadora_XPTO; accept; } } term MEU-BLOCO { from { route-filter 200.200.200.0\/22 exact; } then accept; } then reject; } community cm_blackhole_operadora_XPTO members 666:666; }<\/p>\n\n

        \n Automating with Made4Flow<\/strong>\n <\/p>\n\n

        With Made4Flow it is possible to automate the blackhole announcement process of attacked IPs.For that we need:<\/p>\n\n