topic Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools in Firewall & Security Management

Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 11:50:05 GMT

Hi all,

We're currently converting our network from static to dynamic routing with BGP. I use a firewall for many site-to-site VPN's we have, so i need to advertise networks that are not in the routing table.

I cannot use Routing Injection Mechanism, because for this i need permanent tunnels and they're only available between two Check Point gateways.

I thought of using NAT-Pools as they're available to redistribute and able to be added to a route map. However I also see that it's possible to create static blackhole routes and redistribute them the same way.

What would be the benefit of using one over the other? The only thing i see is that you cannot do route aggregation with NAT-Pools.

Will the site-to-site VPN's remain to work when i add a blackhole route for that network? What has precedence? A blackhole route, or a VPN community?

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 15:01:31 GMT

When labbing, creating a static blackhole route (even when it's less specific than the encryption domain), traffic doesn't pass. So it seems that a static blackhole route is not an option, and the only option i have is creating NAT Pools.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Fri, 23 Jan 2026 15:13:11 GMT

Hey Joe,

Do you have anything configured as per below?

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 15:40:00 GMT

My configuration is below (left out all the snippets that are not relevant):

set nat-pool 172.16.160.0/21
set nat-pool 172.16.160.0/21 comment "Customer support client VPN range"

set routemap export_all_to_bgp id 1 on
set routemap export_all_to_bgp id 1 match protocol nat-pool
set routemap export_all_to_bgp id 1 match protocol direct

set bgp external remote-as 65000.3 export-routemap export_all_to_bgp preference 1 on

Output of "show route" (you see, there's no entry for the 172.16.160.0/21 network, as this is remote access VPN as example):

FW3> show route Codes: C - Connected, S - Static, R - RIP, B - BGP (D - Default), O - OSPF IntraArea (IA - InterArea, E - External, N - NSSA), IS - IS-IS (L1 - Level 1, L2 - Level 2, IA - InterArea, E - External), A - Aggregate, K - Kernel Remnant, H - Hidden, P - Suppressed, NP - NAT Pool, U - Unreachable, i - Inactive S 0.0.0.0/0 via x.x.x.x, bond1, cost 0, age 20839158 S 10.0.0.0/8 via 172.16.1.31, bond2, cost 0, age 4353068 S 10.5.0.0/16 via 172.16.1.40, bond2, cost 0, age 4353068 S 10.100.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.101.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.102.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.103.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.104.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.105.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.106.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.107.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.108.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.109.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 S 10.110.0.0/16 via 172.16.1.40, bond2, cost 0, age 4353068 S 10.111.0.0/16 via 172.16.1.40, bond2, cost 0, age 4353068 S 10.112.0.0/16 via 172.16.1.40, bond2, cost 0, age 4353068 S 10.116.0.0/16 via 172.16.1.34, bond2, cost 0, age 4353068 C 127.0.0.0/8 is directly connected, lo S 172.16.0.0/12 via 172.16.1.31, bond2, cost 0, age 4353068 C 172.16.1.0/24 is directly connected, bond2 LAN C 172.16.7.16/30 is directly connected, bond0 Sync S 172.16.23.0/24 via 172.16.1.34, bond2, cost 0, age 4353068 S 172.16.25.0/24 via 172.16.1.34, bond2, cost 0, age 4353068 S 192.168.0.0/16 via 172.16.1.31, bond2, cost 0, age 4353068

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Fri, 23 Jan 2026 15:37:22 GMT

I dont believe you need this line:

set routemap export_all_to_bgp id 1 match protocol nat-pool

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 15:39:31 GMT

Yes that is needed, because i actually need to inject this network into BGP (or any dynamic protocol for that matter). I cannot redistribute this network from any other protocol as a route simply doesn't exist for this network.

See also my "show route" output i provided as update on earlier post.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Fri, 23 Jan 2026 15:39:50 GMT

Give me few mins, will send you an example my colleague and I did for a large customer few years ago that worked fine.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 15:44:06 GMT

I can redistribute from NAT pool or a route map, that really doesn't matter for the challenge ahead. It's more the question if there's any other possibility that I've overlooked 😀

Redistributing from a route map because then for every other BGP peer i only have to redistribute from that routemap, and not select all protocols for each peer.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

Bob_Zimmerman — Fri, 23 Jan 2026 15:51:56 GMT

Yeah, blackhole routes eat the traffic between I and o.

Why not just add static routes sending the traffic out to your default gateway? Then the route would exist, and you could redistribute it from static into BGP.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Fri, 23 Jan 2026 15:53:38 GMT

Example, as promised:

set routemap ospf-to-bgp-100 id 10 match prefix-list VOIP_PL_OUT preference 10 on
set routemap ospf-to-bgp-100 id 10 match protocol ospf2
set routemap ospf-to-bgp-100 id 10 action localpref 100
set routemap ospf-to-bgp-100 id 20 on
set routemap ospf-to-bgp-100 id 20 allow
set routemap ospf-to-bgp-100 id 20 match prefix-list VOIP_PL_OUT preference 10 on
set routemap ospf-to-bgp-100 id 20 match protocol ospf2ase

*********************

set prefix-list VOIP_PL_OUT sequence-number 10 prefix x.x.x.0/24 all
set prefix-list VOIP_PL_OUT sequence-number 20 prefix x.x.x.0/24 exact
set prefix-list VOIP_PL_OUT sequence-number 30 prefix 172.27.0.0/16 all
set prefix-list VOIP_PL_OUT sequence-number 40 prefix x.x.x.x.0/24 exact
set prefix-list VOIP_PL_OUT sequence-number 50 prefix x.x.x.x.0/24 exact
set prefix-list VOIP_PL_OUT sequence-number 80 prefix 10.224.1.0/24 all
set prefix-list VOIP_PL_OUT sequence-number 90 prefix 10.224.98.0/24 all
set prefix-list VOIP_PL_OUT sequence-number 100 prefix 10.224.99.0/24 all
set prefix-list VOIP_PL_OUT sequence-number 110 prefix 172.17.10.0/24 all

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 16:00:22 GMT

That would also be a very cool idea that I've not yet thought of. Thanks for the insights.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Fri, 23 Jan 2026 16:01:26 GMT

Will lab this to see if a network that is not connected but is inside of a prefix list get's redistributed, thanks for the insights!

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Fri, 23 Jan 2026 16:02:34 GMT

Great! If you need any more info, let me know.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

CheckPointerXL — Sat, 24 Jan 2026 07:50:07 GMT

nat pools

https://support.checkpoint.com/results/sk/sk179549

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Sat, 24 Jan 2026 09:35:46 GMT

That might be it.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

the_rock — Sun, 25 Jan 2026 22:30:28 GMT

Looks like link @CheckPointerXL sent is definitely related.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Mon, 26 Jan 2026 11:45:34 GMT

That was also what i was referring to in my original post. Haven't linked the SK though.

Re: Advertising non existing networks (encryption domain) into BGP - Blackhole Route or NAT-Pools

joerivang — Mon, 26 Jan 2026 11:46:08 GMT

Thanks, that was also what i was referring to in my post, haven't seen the SK yet so thanks for that!