> On 16/05/2016, at 21:00, Gert Doering <[email protected]> wrote: > > Hi, > > On Mon, May 16, 2016 at 06:43:59AM +0700, Roland Dobbins wrote: >> I personally don't know of any operator allowing customers to use >> flowspec on PE devices. > > Not having the hardware to do flowspec across our network yet, I haven't > investigated this closely. But I do wonder what sort of filtering options > exist in typical gear - like "standard BGP" prefix filters, I could imagine > something like "flowspec entries learned from customers need to have a > destination in <prefix list>, and are subject to <maxpfx 500>" or such... > > Is that doable on anything?
I see what you’re getting at, and the behaviour to prevent attacks I suspect that you’re thinking of is the default. https://tools.ietf.org/html/rfc5575#section-6 Roughly, you only use flowspec routes from external networks if they are the best path for that prefix. There’s an I-D that updates this to relax it a little so it can be used if you have multiple eBGP peers between two ASNs (which is obviously quite common). -- Nathan Ward _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
