Greetings to everyone,
I recently looked into the minimal resource usage of a Cisco router in the case of a denial of service attack. In such cases what is the minimal configuration one can apply to a router to make sure that a certain range of IPs attacking you keeps the router alive and uses much less resources. Two things I came up with (one of which everyone probably does on a normal basis) is access lists and another would be a route-map to point all unwanted sources to null0. Would a route-map hurt the router less than an access list plain out ? What I'm referring to is basically PBR pointing matches to null0. An example configuration would be: ! interface FastEthernet0/0 ip policy route-map unwanted ! ! ip access-list extended unwacl deny ip any any permit ip 192.168.1.0 0.0.0.255 any ! ! route-map unwanted permit 10 match ip address unwacl set default interface Null0 ! Is this more optimal than a plain old access list? Is this used in any way? Regards, Mario _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
