On 5 May 2017 at 00:48, Nikos Leontsinis <[email protected]> wrote:
Hey, > you still need to have a way to leak between 2 routing domains. No. The dirty side of scubber is in VRF and destination for default route in VRF. Clean side of scrubber is normal INET interface. So scrubber is 'bridging' the domains. Network itself has clean separation of VRF and INET, other than cherry picking traffic to VRF in INET interfaces based on BGP community. > Let alone the problems that you will have with flowspec... This is matter of taste. I prefer DCU, because I view flowspec as more complicated and there easily could be security implications, particularly if you speak flowspec to your customers. But overall this is same design as my proposed DCU one. -- ++ytti _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
