Hi Gert, Thanks for the pointers. I do now recall you giving this advice before but for the life of me I couldnt find the related thread in the archives. Can I ask what your thoughts are on core IP addressing? Do you have specified global ranges for this purpose with matching iACLs or do you use another method altogether. I'm really looking for the best of both worlds - a nice scure core that isn't easy to attack while at the same time not annoying customers by denying them important diagnostic information. Thanks Gordon
________________________________ From: Gert Doering <[email protected]> To: Gordon Bryan <[email protected]> Cc: Cisco NSP <[email protected]> Sent: Monday, 11 March 2013, 8:17 Subject: Re: [c-nsp] Private IP in SP Core Hi, On Sun, Mar 10, 2013 at 09:44:12PM +0000, Gordon Bryan wrote: > I like the concept of private addressing (core hiding being one) but having > never seen it deployed in anger I'm concerned that it might not be as simple > as it seems and may break other things. I've read that traceroute and PMTUD > are at risk in such a scenario. I've said it before and I'll say it again - by "core hiding" you take away important diagnostic tools (traceroute/mtr) from your customers. So *if* you do that, make sure your monitoring and first-level support is fully up to speed should you ever have LSP black-holes or packet loss in your network. We terminated our contract with Global Crossing because they regularily had issues in their network (packet loss, high latency, black holes), traceroute hiding gave us no way to pinpoint the issue, and their support stuck to the "we can't see anything so there is no problem" mantra. This combination is completely unacceptable. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [email protected] fax: +49-89-35655025 [email protected] _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
