BGP Peer Selection

RouterOS Forwarding Protocols
1

Hello,

We have recently bought a ddos protection from a company. They require a GRE tunnel and a BGP peer connected to them.
Right now we have two Mikrotik routers each with a BGP connection to our ISP.
The problem is that i want incoming traffic to pass through the ddos service provider ( new BGP peer ) and outgoing to go through regular ISP BGP peer.
Since i don’t know much about BGP my question is how to accomplish this. Do i just stop announcing the prefix lets say x.x.x.x/24 to our ISP BGP peer that i want to be protected by DDOS and only announce it to our DDOS BGP Peer ? I don’t know if this is the right solution.
Furthermore, since I have two Mikrotik routers (VRRP enabled for redudancy) and I want the same /24 network prefix to be announced from both, i need to change metric of the BGP path?
I’m new to BGP so any help will be really appreciated.

2

It sounds right, but why not ask your DDOS provider?

3

Did that, but they are not providing any good explanation on how the settings should work.

4

In most situations where an upstream provider is handling DDoS and BGP, this is correct. You will advertise the prefixes to the DDoS provider and then you might consider modifying the advertisement to the upstream to ensure it is ready if the GRE tunnel fails but force it to be less preferred using BGP communities or prepend if communities aren’t available.