On (2007-06-29 09:28 +0200), Peter Basquiat wrote: > with rate-limit, MQC or CoPP if supported?
I use MQC+ACL in AS border, to drop everything except rate-limited ICMP and UDP 'traceroute port range' to core links and core loops. (I don't advertise PE side of the customer point-to-points so they are unattackable outside the PE, I'd argue that it's probably most difficult to protect attack points in your network). Of course there are few 'holes' in the iACL, eg. to connected eBGP speakers to talk to each other. I use CoPP to protect from attacks inside my AS#. However in Cisco world there are quite many catches in CoPP, eg. it's mostly not done in hardware, except in 7600 and IOS-XR boxes (GSR+IOS does not do it in hardware). Mostly it does not work in conjunction with MPLS explicit null (except in 7600). IPv6 support is non-existing. Luckily though CoPP is not nearly as important as proper MQC+ACL in AS borders, as that's really the most common place to get abuse from. On slightly related issue, while compiling iACL, remember to block any traffic originating from your own PA blocks that are coming in from other AS#'s. I wouldn't recommend blocking unassigned nets, unless you can guarantee that your network won't be running in auto-pilot after you've left the company. > Whats your guys approach and what do you recommend? > Would be nice to discuss this a little bit and hear good strategie to make > the whole internet > more safe :-) > > PS: I know there are many documents on this, but hearing about actual > approachs on a dynamic > mailling list is much more instructive. > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
