Mario, There is a more elegant way. You could use loose mode uRPF on your ingress interfaces. If you want to block a specific source prefix, you just set a route to null0 for that prefix, and uRPF would block it in the most efficient way possible on a Cisco router.
The generic uRPF guide: http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_cfg _unicast_rpf_ps6441_TSD_Products_Configuration_Guide_Chapter.html Loose mode uRPF: http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_uni cast_rpf_loose_ps6441_TSD_Products_Configuration_Guide_Chapter.html The command reference: http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_i3.ht ml#wp1033222 This solution can be integrated together with Remote Triggered Black Holing for a distributed solution using BGP communities: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642 /prod_white_paper0900aecd80313fac.pdf Let me know if you require further info. Arie -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mario Spinthiras Sent: Friday, July 25, 2008 12:21 PM To: [email protected] Subject: [c-nsp] Surviving denial of service from certain IPs Greetings to everyone, I recently looked into the minimal resource usage of a Cisco router in the case of a denial of service attack. In such cases what is the minimal configuration one can apply to a router to make sure that a certain range of IPs attacking you keeps the router alive and uses much less resources. Two things I came up with (one of which everyone probably does on a normal basis) is access lists and another would be a route-map to point all unwanted sources to null0. Would a route-map hurt the router less than an access list plain out ? What I'm referring to is basically PBR pointing matches to null0. An example configuration would be: ! interface FastEthernet0/0 ip policy route-map unwanted ! ! ip access-list extended unwacl deny ip any any permit ip 192.168.1.0 0.0.0.255 any ! ! route-map unwanted permit 10 match ip address unwacl set default interface Null0 ! Is this more optimal than a plain old access list? Is this used in any way? Regards, Mario _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
