On Sep 30, 2014, at 4:08 PM, redscorpion69 <[email protected]> wrote:
> 2. BCP 38 looks like ok solution, but it does look like burden to manage > since it has to be updated every time new prefix is announced... So it looks > like it would break stuff. You should perform anti-spoofing at your downstream customer edges, IDC edges, et. al. via uRPF or ACLs or other mechanisms, and you should perform egress anti-spoofing at your peering/upstream edges via the same mechanisms, whatever works topologically. With regards to peering, you've already received sound advice. If you use ACLs, you must update them. Surely you have automation in place to update ACLs when necessary, yes? ---------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> Equo ne credite, Teucri. -- Laocoön _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
