[..]
The source and destination address must be the configured tunnel
addresses. The source address does matter, but it is possible to spoof
it. The destination address cannot be any address on the box, it must be
the configured destination address. However, you must take into account
that the source address could be spoofed.
Now *this* is certainly good news. Since the devices in question (which
can't easily be upgraded to 12.4) only have a single tunnel with a
tunnel destination that is inside our network, anti-spoofing ACLs to
"peers and upstreams" are already in place, and customers get uRPF
anyway.
So we're just not upgrading, and when the hardware breaks, we'll decide
what to buy as a replacement.
gert
I've read this passage multiple times and I want to clear this up.
The malicious packet *must* contain the actual tunnel source and
destination address. Anything else and the attack is ineffective.
-ML
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
