Date: Sat, 30 Sep 2000 10:32:49 -0600 (MDT) From: Nick Rogness <nick@rapidnet.com> To: "Chutima S." <chutima_s@zdnetonebox.com> Cc: freebsd-net@FreeBSD.ORG Subject: Re: How to connect to Internet with 2 ISP. Message-ID: <Pine.BSF.4.21.0009301003570.52582-100000@rapidnet.com> In-Reply-To: <20000930140341.DASZ321.mta03.onebox.com@onebox.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 30 Sep 2000, Chutima S. wrote: > Hi > hello. > > How should I arrange about IP address, routing, DNS, security? Where > should I find these information? The only way to answer this question is to determine your needs. Is redundancy the only concern? Do you want load balancing? One thing is for sure, your probably want to look at some type of dynamic routing protocol. gated can accompish most of your needs (/usr/ports/net/gated), including BGP, which is what most people (99.9%) of people use to peer with other AS's. You will have to work with your ISP's to determine which type of routing options they have available and then building gated to work with that setup (www.gated.org). If, however, your upstreams do not want to do some type of routing, you will be stuck with just using static routes. DNS is pretty straight forward. Have the ISP delegate authority for the reverses (in-addr.arpa) to your DNS server. Get a good naming scheme setup. Designing IP address scheme's is quite involved and is out of scope for this mail. Let your routing decisions play a role in that. Security is such a broad topic, lets look at 2 different areas. The first being network security, have a good firewall (acl) in place to prevent spoofing, route filtering (Don't announce networks you don't own). Determine filtering on your edge (access) layer but minimize on your core...etc,etc. Develop a solid architecture. The Core-Distribution-Access model is used quite often throughout the internet. The second being systems security. Put in place a good Intrusion Detection System. The best in the business right now (IMHO) is snort (www.snort.org) which can do all, if not more, then most of the commercial IDS systems, like ISS,etc...and it takes little load to run a big ruleset (hence the light-weight part of it). Use encryption wherever (or whenever) possible. Little or weak encryption is STILL better than none at all ;-) Buy some books, do some research (Case studies). Nick Rogness - Drive defensively. Buy a tank. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0009301003570.52582-100000>