On (2012-09-21 16:36 +0200), Adam Vitkovsky wrote: > I'd like to hear the other's opinion on IGP authentication in the core in > general
I would do MD5 for hello and lsp in ISIS. It's not hard to config, as it does not require downtime. Maybe some old link is repurposed as core link and you leave isis config active there or maybe someone pastes isis config in wrong interface. If provisioning is done by hand it's not very far-fetched scenario. And there is one really annoying attack vector in ISIS, reflood all LSPs with bogus information and maximum LSP seq# and your whole network is down. You can't even fix the situation by reloading your boxes. What you need to do is 1) identify the culprit and stop it 2a) reload whole core simultaneously 2b) change each NET address one by one -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
