On Mar 14, 2011, at 9:30 AM, Tony wrote: > The fix is as you have already stated.
An even better fix is to use iACLs to keep fragmented packets off the router in the first place (allow them *through* the router to their destination endpoints, but not any addressed *to* the router itself), and to disable the dual misfeatures of the IOS stateful firewall and 'Virtual Fragment Reassembly', both of which add no security value and actually make matters worse. ----------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> The basis of optimism is sheer terror. -- Oscar Wilde _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
