Date: Sat, 22 Jan 2000 17:42:41 -0800 (PST) From: "Dan Seafeldt, AZ.COM System Administrator" <yankee@az.com> To: Poul-Henning Kamp <phk@critter.freebsd.dk> Cc: sthaug@nethelp.no, gdonl@tsc.tdk.com, security@FreeBSD.ORG Subject: Re: MAPS effort Message-ID: <Pine.BSF.3.91.1000122173155.13757G-100000@gate.az.com> In-Reply-To: <12128.948540545@critter.freebsd.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
If ISP Z has 2 frame relay PVCS on a serial connection using a say a cisco 2501 and uses upstream ISP A and ISP B and ISP A is on PVC #16 and routing 199.199.199.x and big ISP B is on PVC #17 and routing 200.200.200.x and then ISP Z decides to use PVC #16 as the default gateway then all source packets, even the ones from machines on the 200.200.200.x segment would go out the 199.199.199.x gateway. Now if the upstream ISP A chose to block 200.200.200.x on the egress it would cut off ISP Z's machines that used the 200 addresses (packets can come in on PVC #17 but can't go out PVC #16 and then get through the upstream egress block) and of course the opposite would be true if the ISP Z decided to make PVC #17 the default gateway and ISP B blocked the 199 addresses on the egress router. On Sat, 22 Jan 2000, Poul-Henning Kamp wrote: > In message <Pine.BSF.3.91.1000122031405.13757C-100000@gate.az.com>, "Dan Seafel > dt, AZ.COM System Administrator" writes: > > > >I have a CISCO router upgraded to pre-release 12.0 and will look at that. > >And regarding the mention of MAPS effort, I thought about that but I was > >worried about all the ISP's out there who may use one > >gateway/router to connect 2 separate upstream netblocks without any use of > >BGP. In this case, it is possible that outbound packets will always go > >through one upstream ISP even though the returns end up going through 2 > >different ISP's For example, a CISCO 2600 series with one Frame Relay > >connection and 2 PVCS to two different upsteams, and the gateway set to one > >of these PVC's with a different class C coming down each PVC's > > > >I could see where an egress block enabled by the upstream provider who is > >not the gateway would shut down access to that class C. Not all ISP's can > >afford to or understand how to implement BGP but want some amount of > >redudancy or additional bandwidth via 2 different upstreams. > > You know, that would be the most lame excuse for not doing anything > about this I have heard so far. > > That ISP, can still put egress filters on both their outgoing PVCs > as long as they allow both C classes both ways. > > But I would be terribly disappointed if their upstream didn't block > all but their assigned C class in. > > -- > Poul-Henning Kamp FreeBSD coreteam member > phk@FreeBSD.ORG "Real hackers run -current on their laptop." > FreeBSD -- It will take a long time before progress goes too far! > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.91.1000122173155.13757G-100000>