Julien, Le 19/04/2018 à 09:59, Julien Escario a écrit : > Y'a t'il une bonne pratique en la matière ?
Tout à fait ! Le filtre "relaxed" est : ipv6 prefix-list ipv6-ebgp-relaxed deny 3ffe::/16 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny 2001:db8::/32 le 128 ipv6 prefix-list ipv6-ebgp-relaxed permit 2001::/32 ipv6 prefix-list ipv6-ebgp-relaxed deny 2001::/32 le 128 ipv6 prefix-list ipv6-ebgp-relaxed permit 2002::/16 ipv6 prefix-list ipv6-ebgp-relaxed deny 2002::/16 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny 0000::/8 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny fe00::/9 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny ff00::/8 le 128 ipv6 prefix-list ipv6-ebgp-relaxed permit 2000::/3 le 48 ipv6 prefix-list ipv6-ebgp-relaxed deny 0::/0 le 128 Alors que le "strict" (souvent problématique) est : ipv6 prefix-list ipv6-ebgp-strict deny 3ffe::/16 le 128 ipv6 prefix-list ipv6-ebgp-strict permit 2001:500::/30 ge 48 le 48 ipv6 prefix-list ipv6-ebgp-strict deny 2001:db8::/32 le 128 ipv6 prefix-list ipv6-ebgp-strict permit 2001::/32 ipv6 prefix-list ipv6-ebgp-strict permit 2001::/16 ge 35 le 35 ipv6 prefix-list ipv6-ebgp-strict permit 2001::/16 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2001:0678::/29 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2001:0c00::/23 ge 48 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2001:13c7:6000::/36 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2001:13c7:7000::/36 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2001:43f8::/29 ge 40 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2002::/16 ipv6 prefix-list ipv6-ebgp-strict permit 2003::/16 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2400::/12 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2600::/12 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2610::/23 ge 24 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2620::/23 ge 40 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2800::/12 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2a00::/12 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict permit 2801:0000::/24 le 48 ipv6 prefix-list ipv6-ebgp-strict permit 2c00::/12 ge 19 le 32 ipv6 prefix-list ipv6-ebgp-strict deny 0::/0 le 128 Le strict suit à la lettre les politiques d'allocation des RIR, mais certains opérateurs ne les respectent pas pour autant. Donc il va filtrer de façon excessive en cas de désagrégation, sur les CDN par exemple. source : https://www.space.net/~gert/RIPE/ipv6-filters.html @+ -- Jérôme Nicolle 06 19 31 27 14
signature.asc
Description: OpenPGP digital signature
