On Dec 17, 2012, at 5:58 PM, Robert Williams wrote: > The 'attack' traffic entered via the Non-Cisco router, from the internet. Was > delivered to the LAN switch while the NLB was unreachable. Thus the switch > flooded to all ports, which included the 6500.
NLB is a bag of hurt, IMHO. What DDoS mitigation mechanisms have you deployed? S/RTBH is a very useful basic capability which can leverage your existing network infrastructure. Configuring proper iACLs and policy-enforcement ACLs/VACLs/PACLs as noted previously in order to express the situationally-approriate access policies is also recommended. ----------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
