On Apr 4, 2014, at 4:13 PM, Dobbins, Roland <[email protected]> wrote:
> If customers are running older resolver code which sources queries from > UDP/53, then this ACL will cause problems for them; utilizing flow telemetry > to determine the likelihood of these corner-cases arising is very important, > along with plans to proactively handle them without breaking the Internet for > these customers. If this is a significant problem, here're revised tACL stanzas which *must* be tested and piloted prior to general deployment. Using flow-telemetry to determine whether the attack-source queries are sourced from high ports or from UDP/53 is strongly advised. ----- access-list 101 remark Apply these stanzas inbound on coreward customer aggregation gateway interfaces. access-list 101 remark Deny inbound traffic to UDP/53 on broadband customer networks. access-list 101 remark Allow UDP/53-UDP/53 traffic for older customer resolver code. access-list 101 permit udp any eq 53 172.19.25.0 0.0.0.255 eq 53 access-list 101 deny udp any 172.19.25.0 0.0.0.255 eq 53 access-list 101 remark Allow all other IP traffic to customer nodes - VERY important! access-list 101 permit ip any 172.19.25.0 0.0.0.255 ----- ----------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton _______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
