On Sun, 2 Sep 2007, C. Jon Larsen wrote: > Where is the access list that is going to prevent cross talk between the > subnets ? Otherwise rogueware on one tenants computer will attack the > other tenants. Simply splitting each tenant onto its own vlan is ncie but > its a far cry from secure if you tie the subnets into a router that is > happy to pass traffic between the vlans !!
If these tenants are gonna be on the Internet than it also implies the possibility that tenants may want to provide content/access to other tenants. The situation is no different than if each tenant had their own individual router. Ie. you don't want to block traffic between subnets and vlans. What you do want to prevent are tenants attacking other tenants or other sites on the Internet or receiving spoofed traffic from outside their subnet/vlan. And the simplest way to prevent that is to enable unicast rpf checking on all interfaces. You don't need an ACL to do that but if you also want to block martian traffic you can still add an ACL on your border interface. urpf will already block martian traffic generated at your tenants edge so your ACL only needs to cover the martian traffic. Antonio Querubin whois: AQ7-ARIN _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
