• Setting a maximum prefix amount: With the size of Internet routing tables these days lots of CPU horsepower and memory are required to handle them. Depending on the situation route summarization can be used to cut down on the hardware requirements. In a situation like this there is always the possibility of an attacker injecting a large number of valid more specific routes into the router causing it to slow down and or crash completely due to lack of available resources. If you already know the amount of routes that your upstream neighbor will be sending you via BGP you can use the maximum-prefix command in your neighbor statement to thwart this type of attack. In this example we will set the maximum amount of prefixes that our neighboring peer can send to us at 3000.

• BGP route dampening: Route flapping can severely degrade network convergence times, specifically on heavily burdened routers. DoS attacks on neighboring networks can lead to this type of route flapping. Route dampening can be used to limit route instability throughout your network by means of suppressing flapping routes. There are many methods to apply route dampening in BGP. It can be done with default global settings, specific global settings or tied to route maps. Below are the options for the route-dampening command and a simple example of turning on route dampening with the default settings:

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        neighbor 132.45.78.3 log-neighbor-changes
        neighbor 132.45.78.3 maximum-prefix 3000
        bgp dampening
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

Note: All of these methods can be right for some networks and wrong for others. You should never implement security enhancements without a good understanding of the protocol operation first.

Note: All addressing and autonomous system numbers used in this document have no relevancy to the subject specifically and are only used purely as examples.