On 7 August 2016 at 20:10, Adam Vitkovsky <[email protected]> wrote:
> If the policer is tight you should be fine, but still one needs to consider > who can talk NTP to his box (iACL). The policer is there to stop volumetric dos, but it would not help in this wedged interface case, or any security issue at all. But I fully agree iACL is must also. > Good point, yeah there's always the collateral damage problem. That particular issue can and should be solved, and for example Juniper has solved it (well actually it's pretty much carbon copy from unisphere guys). Essentially lo0 is used to determine what to punt, then ddos-protection is used to limit its rate. You can limit on many level, aggregate, ifd, ifl, sub (session). Usually IFL is more than sufficient, if one IFL is misbehaving, BGP in that IFL gets its own policer, automatically, and all other BGP sessions are safe. You could today do this manually as well, as JunOS finally got PPS policers, but you probably don't want to configure lo0 filter manually with unique policer for every eBGP. > Are you sure about this? > I would have thought that CP traffic injected to the wire is bypassing all > the QOS but not the received CP traffic. Yeah, but only because that dog bit me. I was getting ICMPv6 from customer, causing all other IPv6 customers sharing same NPU to be down. Initial reaction (after even finding out what is the problem, which requires stopping the NPU for capture), was to policer this customer' ICMPv6, did nothing, ACL fixed it. Subsequence TAC case confirmed it is expected, MQC will not see punted traffic. -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
