RTBH no_export

Thu Jan 31 19:28:11 UTC 2019

Hello NANOG,

To minimize the impact of DDoS, I have setup RTBH.
For our own customers, we can set the RTBH community ourselves towards our
transit suppliers and this works well.

For our BGP customers the problem is more complex. Our BGP customers can
send us the RTBH community, and we will drop the traffic at our borders.
Since we're only running a small network, we don't have the capacity to
deal with large attacks. If we would be able to forward (and maybe alter
it) this RTBH community towards our upstream providers, the impact on our
network would be limited. However, the RFC states that an announcement
tagged with the blackhole community should get the no_advertise or
no_export community.

What is your opinion on this ?

Thanks in advance
Roel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20190131/bda3ef54/attachment.html>