Lukas,
Thanks, I am looking configuration like if my Internet bandwidth usage
go 50% or (PPS go higher than average) i want to apply ACL to start
dropping Fragmentation packet. like juniper has following option. Does
cisco has config like following apply ACL base on criteria
firewall {
policer IP-FRAG-Policer {
filter-specific;
if-exceeding {
bandwidth-limit 8k;
burst-size-limit 1500;
}
then discard;
}
family inet {
filter DOS-Protect {
:
: /* Term ip-fragments-limit: Rate limit IP fragment packets. */
term ip-fragments-limit-1 {
from first-fragment;
then policer IP-FRAG-Policer;
} term ip-fragments-limit-2 {
from fragment-offset 64-65535;
then policer IP-FRAG-Policer;
}
:
:
}
}
}
On Tue, Apr 26, 2016 at 1:19 PM, Lukas Tribus <[email protected]> wrote:
>> I am just looking some kind of 3rd option which can give us relief. I
>> just wanted to know what exactly ACL fragments option does?
>
> Roland already provided you a link to the ACL documentation specific
> to IP fragments.
>
> Do you have a specific question about that or do you just want us to
> read that document for you and then give you a brief summary?
>
>
>
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
