[12319] in North American Network Operators' Group
Re: not rewriting next-hop, pointing default, ...
daemon@ATHENA.MIT.EDU (Alex.Bligh)
Fri Sep 12 06:23:15 1997
To: nanog@merit.edu
cc: amb@xara.net
In-reply-to: Your message of "Thu, 11 Sep 1997 16:04:48 PDT."
<970911160448.ZM2285@borg.eos.home.net>
Date: Fri, 12 Sep 1997 11:02:27 +0100
From: "Alex.Bligh" <amb@xara.net>
> > In a world where SSH were available in cisco routers and/or
> > IPsec were more widely deployed, I might have different views.
Failing this, the ability to disable responding to packets (*)
with source route set on the Cisco *host* TCP/IP stack
(and continue to forward them), would allow it to be
easilly enabled in your core, and filtered at borders
with machines and vulnerable equipment attached. IE
you filter out such packets as part of your normal firewalling.
This would prevent the telnet to Cisco with LSR poblem.
Thus traceroute -g would give you the useful information,
then star out if you were tracing to (say) www.uu.net.
(*) - urm, except responding to traceroutes etc. :-)
Alex Bligh
Xara Networks
