Do you mean the prefix that those PTP subnets were in was not advertised globally?
So, those customers couldn’t use their side of the PTP link for internet’s? My problem is I can easily iACL stuff for core interfaces and loopbacks because I have moved that all to specific blocks but for PE-CE internet customers PTP subnets, the PE side is always an attack surface unless we have autogen ACL on every interface with automation? Unless I’m missing a way to deal with this? On Sat, 10 Mar 2018 at 01:39, Saku Ytti <[email protected]> wrote: > On 9 March 2018 at 16:35, <[email protected]> wrote: > > > > Regarding point b) > > That one might be cumbersome as IP for CE-PE links in the Internet VRF > are > > usually allocated from either your own public address space (so you'd > have > > to fragment it and not advertising block used for PE-CE links -creating > more > > state in GRT) or come from PI space which you don't have control over yet > > it's part of your infrastructure. > > In one shop I did /31 or /30 links customer or our pool, but we never > advertised the connected networks. If far-end for some reason needed > routed linknetwork, after we tried to demotivate, we crated /32 static > route for it. So we still didn't have that address as attack surface > on the PE from outside the PE. > > > -- > ++ytti > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > -- Regards, Mark L. Tees _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
