OK - with 'inbound' I thought you meant from the Internet. bt@ipad
Den 7. jan. 2013 kl. 08:05 skrev joel jaeggli <[email protected]>: > On 1/6/13 10:51 PM, Bjørn Tore wrote: >> Why would you accept any /32s in the first place? > From myself? I accept all sorts of prefix lengths internally that I would > never accept from the internet. > > I accept quite a few pretty long prefixes from my arbor TMS for example, > more in the context of RTBH e.g. RFC 5635 and so on. >> >> Bjørn Tore @ mobil >> >> Den 7. jan. 2013 kl. 06:22 skrev Joel jaeggli <[email protected]>: >> >>> On 1/6/13 20:14 , Richard Gross wrote: >>>> Dear List, >>>> >>>> I am seeking advise. If you wanted to block 800K /32's from your inbound >>>> pipes, how would you do it? >>>> >>>> Would you null route? Put up multiple stanza firewall filters? Which >>>> way has the least amount of hit on router resources? >>> so I'd have a discard route, and I'd inject the prefixes from another >>> box probably quagga with a nexthop of the discard route. I'd expect an >>> re2000 to injest those routes in about 2 minutes >>> >>> I probably wouldn't use flowspec for this at this point. >>> >>>> If you would prefer to reply off-list, that would be super. >>>> >>>> richg >>>> _______________________________________________ >>>> juniper-nsp mailing list [email protected] >>>> https://puck.nether.net/mailman/listinfo/juniper-nsp >>> _______________________________________________ >>> juniper-nsp mailing list [email protected] >>> https://puck.nether.net/mailman/listinfo/juniper-nsp > _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
