[102985] in North American Network Operators' Group
Re: Customer-facing ACLs
daemon@ATHENA.MIT.EDU (Christopher Morrow)
Tue Mar 11 14:42:40 2008
Date: Tue, 11 Mar 2008 14:41:43 -0400
From: "Christopher Morrow" <christopher.morrow@gmail.com>
To: "Jo Rhett" <jrhett@netconsonance.com>
Cc: "Justin Shore" <justin@justinshore.com>, NANOG <nanog@merit.edu>
In-Reply-To: <47D6264B.4050108@netconsonance.com>
Errors-To: owner-nanog@merit.edu
On Tue, Mar 11, 2008 at 2:27 AM, Jo Rhett <jrhett@netconsonance.com> wrote:
>
> Justin Shore wrote:
> > I'm assuming everyone uses uRPF at all their edges already so that
> > eliminates the need for specific ACEs with ingress/egress network
> > verification checks.
>
> ha. I only wish that was true.
>
> We do filter all customer ports for IPs we believe from them, but darn
> few other providers do. (as based on my conversations with many
> providers when tracking down attacks from their networks)
>
> That said, we filter nothing else.
>
>
> > Frags are explicitly dropped before any permits.
>
> ...? So you have no real, production sites?
actually... depending upon platform the frags probably get through (on
a cisco) if they are associated with another ongoing session... Cisco
acls believe that frags are 'ok' (even if you deny fragments in the
acl) unless the frag can't be put together with an existing session.
Juniper just drops all frags...
