> From: Saku Ytti [mailto:[email protected]] > Sent: Friday, March 09, 2018 2:39 PM > > On 9 March 2018 at 16:35, <[email protected]> wrote: > > > > Regarding point b) > > That one might be cumbersome as IP for CE-PE links in the Internet VRF > > are usually allocated from either your own public address space (so > > you'd have to fragment it and not advertising block used for PE-CE > > links -creating more state in GRT) or come from PI space which you > > don't have control over yet it's part of your infrastructure. > > In one shop I did /31 or /30 links customer or our pool, but we never > advertised the connected networks. If far-end for some reason needed > routed linknetwork, after we tried to demotivate, we crated /32 static route > for it. So we still didn't have that address as attack surface on the PE from > outside the PE. > > Ooh yes sure, this would also be taken care of by proper iACLs as well. But I was actually referring to the very appealing idea you proposed in b) to not to even advertise the range -so the DDoS traffic would not even end up at your doorstep as simply the Internet would not have route for any of your p2p links.
adam netconsultings.com ::carrier-class solutions for the telecommunications industry:: _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
