If you make a policy to only turn it off in certain locations, I could
certainly see how it would potentially cause issues. MLPPP or not...
Saying you don't need PMTU discovery is not really a good policy to have at
a high level regardless of internal or external. But, it's your network you
can run it as you wish.
I would hope that you would not recommend doing that to others though as it
may cause others problems...especially if they don't understand the
ramifications.
tv
----- Original Message -----
From: "Michael Malitsky" <[email protected]>
To: <[email protected]>
Sent: Thursday, January 15, 2009 5:24 PM
Subject: Re: [c-nsp] Per packet load balancing with low latency
PMTUD is certainly not the panacea it's made out to be. It doesn't work
more often than not (yes, due to some device in the path not supporting
it). Given the questionable usefulness, I still support it on
Internet-facing links. However, private infrastructure, where MLPPP is
frequently used, is far more deterministic and usually does not require
PMTUD. BCP says if you don't need it, turn it off. Besides,
considering that MLPPP is often a low-budget solution (as opposed to a
larger link), so procuring additional security product may not be in the
cards either (even if technologically possible).
The above is my experience.
Sincerely,
Michael Malitsky
Date: Thu, 15 Jan 2009 14:10:48 -0600
From: "Tony Varriale" <[email protected]>
Subject: Re: [c-nsp] Per packet load balancing with low latency
To: <[email protected]>
Message-ID: <77d9873d48ba45ddab65a10b74710...@flamdt01>
Content-Type: text/plain; format=flowed; charset="iso-8859-1";
reply-type=original
Unfortuantely, not everything Cisco recommends translates well into
real world implementations.
Feel free to read RFC 1191. That should explain everything. BCP says
don't turn off for this reason.
As for the security aspect, there have been a few vulnerabilities that
were not really exploited and then fixed. The pros of leaving this on
far
out way any potential, never really attacked, security issue.
And, if you do get seriously attacked by this method somehow, there
are
products on the market that can effectively mitigate it (as well as
many others).
tv
----- Original Message -----
From: "Michael Malitsky" <[email protected]>
To: <[email protected]>
Sent: Thursday, January 15, 2009 1:42 PM
Subject: Re: [c-nsp] Per packet load balancing with low latency
> Tony,
>
> I'll agree with the comments on uRPF and queuing - you should know
> why you want these changes before making them.
>
> However, disabling IP Unreachables is now one of the baseline
> measures for infrastructure protection, and recommended as such by
Cisco.
> I'll agree in advance that there may be situations where IP
unreachables
> are desired, or situations where infrastructure protection is not
> important, but by and large disabling it seems to be a good step.
If you
> disagree, I'd appreciate an explanation.
>
> Sincerely,
> Michael Malitsky
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
