On 23 May 2017 at 12:00, <[email protected]> wrote: Hey,
> Regarding OSPF, > Best security is to use it solely for routing PE loopbacks (i.e. no > connectivity outside the core). But because it's IP, you might receive spooffed packet further down the line and believe you received it from far-end. So OP's question about TTL-security is valid one, and I'd support that. I'd also run MD5 auth. But of course if you have good iACL, stopping internet from sending other than ICMP, UDP highports to links and loops, you should be pretty safe. ISIS and OSPF have quite interesting properties, ISIS is more secure out-of-the-box, but in many cases you cannot stop box from punting CLNS packets, so any edge-interface may reach control-plane by crafted CLNS packets (without ISIS being configured on the interface). Where-as OSPF out-of-the-box is less secure due to IP, but pretty much every box supports ACLs, allowing you to consistently protect box.' -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
