On Sun, 10 Mar 2013, Gordon Bryan wrote:
Also, even in a completely private core, a PE still becomes exposed to
the outside world on its PE-to-CE interface when delivering Internet
services. Has anyone developed any proficient methods for locking down
these interfaces and making them unresponsive/secure from the outside?
Put core and PE-to-CE interfaces in a dedicated public range, and then
police/ACL traffic to those IPs at your edge.
Private IPs should never show up in traceroute or send ICMP messages so if
you're going to do that, you have to make sure you have enough
functionality to make ICMP originate from a GUA loopback interface at all
points._______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
