I am using FastNetMon / ExaBGP to detect and assist in mitigating DDoS attacks on my network. FastNetMon is working as expected flagging traffic and sending the information to ExaBGP. ExaBGP is configured to utilize an internal ASN (65001) and is advertising the proper network (1.2.3.4/32) and community (65001:666) to my peering routers via BGP. When I check the routing tables I am showing the expected results so everything seems good here. On the routing filter I have applied to my upstream peers the first rule is a passthrough rule that looks for /32 networks tagged with 65001:666 and changes the BGP community to the proper RTBH community depending on who the provider is. This also is working as expected as long as I manually add the /32 under /bgp networks. How can I get this to work without having to add the /32 to the networks section?
You shouldn’t have to add it as a network. Networks are there to originate prefixes when they exist in the IP routing table. When your router learns the prefix from the exabgp host, that should go directly into the BGP table and get advertised per your out-filters described in your original post…
… unless you’re using two BGP instances.
You COULD use “redistribute other BGP” to get the blackhole prefixes copied over automatically…
… but I would say that you should just include the exabgp host directly in your main ASN (peered directly with your route reflector if you have one).
Send no routes to the exabgp server, and allow only /32 routes of your IP range from the exabgp peer. (I’d also make a list of critical “never blackhole these addresses” so that nothing could automatically blackhole something that’s critical)
Thank you both for your assistance. I did have a second instance running so that has been removed and it also will only redistribute if it is coming from the same ASN. All seems well now and is working as expected.