On 21/10/2010, at 2:49 AM, Justin M. Streiner wrote:
> It's my understanding that more IOS-like VTY ACLs are coming NX-OS 5.1,
indeed, NX-OS 5.1 does have VTY ACLs:
ltd-n7010-1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
ltd-n7010-1(config)# line vty
ltd-n7010-1(config-line)# ip access-class ?
WORD List name (Max Size 64)
ltd-n7010-1(config-line)# ip access-class foo ?
in Inbound packets
out Outbound packets
note however that CoPP is still (in many cases) superior as its h/w data plane
providing the protection before the packets get to control plane whereas VTY
ACLs are in software on the control plane itself.
i guess one could provide best-of-both-worlds by using an "established" CoPP
policy with a high rate and a low rate of protection via CoPP for the initial
syn/synack session setup.
>
> which was supposed to be out last month, but wasn't on CCO the last time I
> looked (late last week).
"on time" or "quality". pick one. :)
it will be out before the end of the month.
cheers,
lincoln.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
