Date: Sat, 22 Jan 2000 12:29:05 +0100 From: Poul-Henning Kamp <phk@critter.freebsd.dk> To: "Dan Seafeldt, AZ.COM System Administrator" <yankee@az.com> Cc: sthaug@nethelp.no, gdonl@tsc.tdk.com, security@FreeBSD.ORG Subject: Re: MAPS effort / CISCO 12.0 Message-ID: <12128.948540545@critter.freebsd.dk> In-Reply-To: Your message of "Sat, 22 Jan 2000 03:22:31 PST." <Pine.BSF.3.91.1000122031405.13757C-100000@gate.az.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <Pine.BSF.3.91.1000122031405.13757C-100000@gate.az.com>, "Dan Seafel dt, AZ.COM System Administrator" writes: > >I have a CISCO router upgraded to pre-release 12.0 and will look at that. >And regarding the mention of MAPS effort, I thought about that but I was >worried about all the ISP's out there who may use one >gateway/router to connect 2 separate upstream netblocks without any use of >BGP. In this case, it is possible that outbound packets will always go >through one upstream ISP even though the returns end up going through 2 >different ISP's For example, a CISCO 2600 series with one Frame Relay >connection and 2 PVCS to two different upsteams, and the gateway set to one >of these PVC's with a different class C coming down each PVC's > >I could see where an egress block enabled by the upstream provider who is >not the gateway would shut down access to that class C. Not all ISP's can >afford to or understand how to implement BGP but want some amount of >redudancy or additional bandwidth via 2 different upstreams. You know, that would be the most lame excuse for not doing anything about this I have heard so far. That ISP, can still put egress filters on both their outgoing PVCs as long as they allow both C classes both ways. But I would be terribly disappointed if their upstream didn't block all but their assigned C class in. -- Poul-Henning Kamp FreeBSD coreteam member phk@FreeBSD.ORG "Real hackers run -current on their laptop." FreeBSD -- It will take a long time before progress goes too far! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?12128.948540545>