The following errata report has been submitted for RFC6192, "Protecting the Router Control Plane".
-------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6192&eid=4851 -------------------------------------- Type: Technical Reported by: Hugo Leonardo Canalli <[email protected]> Section: A.2 Original Text ------------- term ebgp-reply { from { source-prefix-list { EBGP-NEIGHBORS; } protocol tcp; port bgp; } then accept; } Corrected Text -------------- term ebgp-reply { from { source-prefix-list { EBGP-NEIGHBORS; } protocol tcp; tcp-established; source-port bgp; } then accept; } Notes ----- Thare are a security question in that firewall relating to bgp reply. Any neighbor that fake a tcp source port to 179 can access any router port, by example ssh. Need to add the line tcp-established. Would be also better to add source-port bgp since bgp protocol uses the 179 port to destination. Add the fix to all bgps, including ipv6. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6192 (draft-ietf-opsec-protect-control-plane-06) -------------------------------------- Title : Protecting the Router Control Plane Publication Date : March 2011 Author(s) : D. Dugal, C. Pignataro, R. Dunn Category : INFORMATIONAL Source : Operational Security Capabilities for IP Network Infrastructure Area : Operations and Management Stream : IETF Verifying Party : IESG _______________________________________________ OPSEC mailing list [email protected] https://www.ietf.org/mailman/listinfo/opsec
