On Mon, 26 Jan 2009, Pete Templin wrote:
FWIW, loose mode for multi-homed customers is basically useless. It
probably mainly drops their leaking RFC1918 address space but that's it.
You really should filter the multihomed customers for real.
Speak up then. What filtering method do you propose?
If the multihomed customers have so messy advertisements that you
can't use strict, you should probably use manually configured ACLs
instead.
It is possible to get strict uRPF to work with multihomed customers
though, but this requires some tuning. With some vendors (e.g.
Juniper with 'feasible-paths' feature) this is easier. I'm not sure
if IOS implements this kind of knobs. We use feasible-paths strict
uRPF on our all multihomed customers without major hassle.
RFC 3704 (esp S 2.3) talks a bit about this on a general level,
http://tools.ietf.org/html/draft-savola-bcp84-urpf-experiences may
also be useful.
--
Pekka Savola "You each name yourselves king, yet the
Netcore Oy kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
