Well, the good part is that the customers network being unusable took away any heat from your device being unusable. Unless of course you had multiple customers off that one router. You could front-end the router with a hardware L3 switch (3550 or so) that can police stuff at wire-rate. That should save you. I don't think anything on the software-based router can itself.
Chuck -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Malitsky Sent: Tuesday, November 06, 2007 10:05 AM To: [email protected] Subject: Re: [c-nsp] Broadcast storm control I have some customers connected to a 6500, and already run stormcontrol and portfast. I'll look into bpduguard as well, thanks. However, most of my customers are connected to "router" platforms (the one specifically affected is a 7200). As far as I know none of the actual L2 features apply there. I tried setting up a control-plane policy to limit the stream of ARP requests, but it looks like it just can't drop the packets fast enough. Michael > Message: 2 > Date: Tue, 6 Nov 2007 04:06:57 +0200 > From: Saku Ytti <[EMAIL PROTECTED]> > Subject: Re: [c-nsp] Broadcast storm control > To: Michael Malitsky <[EMAIL PROTECTED]> > Cc: [email protected] > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset=us-ascii > > On (2007-11-05 18:08 -0600), Michael Malitsky wrote: > > > Last week one of my customers DoS'd me - they managed to > create a wire > > loop between their switches, with no STP. The resulting > broadcast storm > > killed the CPU on my access router (their default gateway). > Does anyone > > have any pointers or best practices on how I can protect the router > > without having access to the switches beyond it? > > I run broadcast stormcontrol, porfast (Edge port) and bpdguard > automatically on in all edge ports. But I do not run bpdufilter, > this way accidentally created loops should be visible by receiving > our own BPDU back and port going to errdisable because of that, and > all other cases, we'll have to hope that stormcontrol catches it. > In my opinion cisco is lacking some elementary L2 security features, > like not being able to limit MAC addresses per port, without also > having port-security on and also ability to limit unknown > unicast per port. > > -- > ++ytti > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
