Configuring Blackhole

When heavy attack traffic is detected, you can configure a blackhole policy to block the attack traffic on the upstream network for link bandwidth protection. After the blackhole policy is executed, all traffic will be discarded. Exercise caution when you perform this operation.

• Third-Party Blackhole
  When an anti-DDoS device detects that the traffic of a specified IP address exceeds the blackhole threshold, the ATIC notifies the third-party device of executing a blackhole policy on the upstream network.
• Routing Blackhole
  When the blackhole type is set to Routing blackhole and the ATIC performs a blackhole task, the ATIC sends a route with the next hop being NULL 0 to the anti-DDoS device. The anti-DDoS device advertises this route to the upstream blackhole router through BGP, and the upstream router executes the blackhole policy for this IP address.
• LPU Blackhole
  When the blackhole type is set to LPU blackhole and a blackhole task is performed on the ATIC, the ATIC sends an NP blocking policy for a specified IP address to the anti-DDoS cleaning device and discards the traffic destined to the IP address from the LPU directly. The local defense system triggers LPU blackhole and cannot perform link protection on the data center. However, in the carrier scenario, the local defense system can withstand bandwidth attacks and reduce the cost of using blackhole services provided by the carrier on the upstream network.