Hi Julien, This topic may actually be more suited to other mailing lists such as NANOG rather than a Cisco specific list. Anyway, I believe it is more common that ISPs deploy the use of uRPF (unicast reverse path forwarding) rather than ACLs.
At the very least, the use of loose mode RPF ensures that the prefix from which a packet is sourced exists within the routing table. Thus, packets sourced from RFC1918 addresses ought to be blocked since they should not be appearing in the routing tables of most BGP routers. This also applies to packets that you are null routing (such as the bogon prefixes that you have mentioned). In terms of performance, there are specific performance gains if RPF is used rather than a long ACL to block prefixes. The more experienced members on this list may wish to share their opinion and correct me if I'm wrong. Cheers. On Fri, Sep 12, 2008 at 7:20 PM, julien leroiso <[EMAIL PROTECTED]> wrote: > Hi, > > I blocked BGP bogons announces[1] like many other admins (I hope). > > I want to know if it's common that ISP add an ACL to the wan port to block > at least rfc1918 IP addresses. > And in the contrary ACL to prevent outgoing spoofing. > > > [1] http://www.cymru.com/Documents/secure-bgp-template.html > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > -- Ang Kah Yik (bangky) - http://blog.bangky.net _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
