On 9/Apr/20 15:24, Tom Hill wrote:
Short answer: filter 100.64.0.0/10 from your upstreams, as you would 192.168.0.0/16 or 10.0.0.0/8.
I was trying to remind myself what we did back in the day. Looks like that's been in on our end for yonks: tinka@all.boxes-re0# show firewall family inet filter filter-incoming term 10 { from { source-address { 10.0.0.0/8; 100.64.0.0/10; 127.0.0.0/8; 169.254.0.0/16; 172.16.0.0/12; 192.0.2.0/24; 192.42.172.0/24; 192.168.0.0/16; 198.18.0.0/15; 198.51.100.0/24; 203.0.113.0/24; 41.87.96.0/19; 41.206.96.0/19; 41.217.212.0/22; 105.16.0.0/12; } destination-address { 0.0.0.0/0; } } then { count filter-incoming-anti-spoofing-counter; syslog; discard; } } term 65535 { then { policy-map UPSTREAM-TRAFFIC-INBOUND; forwarding-class best-effort; accept; } } {master}[edit] tinka@all.boxes-re0#
Longer answers will no doubt be available. :)
As the Afrikaaners say, "Finish & Klaar" :-). Mark.