> What was happening is that, about a week ago, another provider got a
> request from a customer to route them a single /24 from the middle of
> our (non-portable) block. Because there was no IGP route for that customer,
> but a network line was in place, the other provider was, every 5-20 minutes,
> announcing the route for about 30 seconds, and then withdrawing it.
> but a network line was in place, the other provider was, every 5-20 minutes,
> announcing the route for about 30 seconds, and then withdrawing it.
>
> We peer with that provider directly, and can also see them via our transit
> provider
The assumption here is that the advertisement from the BGP peer in
question
was being rec'd by you and installed in the routing table, ie: you
accepted
a BGP advertisement in your own address space from another (untrusted)
peer?
I hate to state the obvious, but don't you filter your own blocks from
your other BGP peers? Inbound, I mean. Very simple:
router bgp 1
neighbor 10.1.1.1 remote-as 2
neighbor 10.1.1.1 filter-list 99 in
as-path access-list 99 deny ^$
as-path access-list 99 deny ^1_
[etc -- however you want to set it up]
Isn't this akin to wearing a condom nowadays in the 'net BGP routing
warz.
Before I left my last job, I was on my way to installing anal as-path
access
lists for our own customers who did BGP to prevent the above and also
prevent another Florida fiasco. The idea was that we would only accept
explicit addresses from those BGP peers. All that was need was to add a
list for each peer:
neighbor 10.1.1.1 distribute-list 10 in
access-list 10 permit 172.16.0.0
or even worse, enforce CIDR/prevent subnets by only accpeting the
specific
block advertisement:
distribute-list 101 permit 172.16.0.0 0.0.0.0 255.255.0.0 0.0.0.0
Just good practice to me :) Hopefully everybody else is doing the
same???
Rob Gutierrez / 3Com - GIS Internet Security
