OMG I shouldn't know this now I'll have nightmares for the rest of my life Ok Lesson learned
adam -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Saku Ytti Sent: Friday, September 21, 2012 4:47 PM To: [email protected] Subject: Re: [c-nsp] ISIS authentication On (2012-09-21 16:36 +0200), Adam Vitkovsky wrote: > I'd like to hear the other's opinion on IGP authentication in the core > in general I would do MD5 for hello and lsp in ISIS. It's not hard to config, as it does not require downtime. Maybe some old link is repurposed as core link and you leave isis config active there or maybe someone pastes isis config in wrong interface. If provisioning is done by hand it's not very far-fetched scenario. And there is one really annoying attack vector in ISIS, reflood all LSPs with bogus information and maximum LSP seq# and your whole network is down. You can't even fix the situation by reloading your boxes. What you need to do is 1) identify the culprit and stop it 2a) reload whole core simultaneously 2b) change each NET address one by one -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
