Title: RE: Source addresses, DDoS prevention and ingress filtering

Mike,

 Usually when routing policy is set up to do assymetric routing, the special subnet exceptions are handled as part of any filtering on the first hop - are they not?

On your note, why would this need to be done in IPv6 if filtering is mandated on the first hop.

--------previous excerpt ---------
Note that RPF checks aren't foolproof; asymmetric
routes can cause them to kill off traffic that
shouldn't be killed. My best guess of why RPF
checks have become popular is that they're really
trivial for routers to perform and enforce (just a
FIB lookup). The same protection could be provided
via L3+ filtering, though the configuration and
performance is more problematic (though not overly
so, IMO).


Just as a note: RPF needs to be done at the edges
of the trust boundary, not the first hop router.

            

Reply via email to