At 10:58 AM 11/22/97 -0800, John Bashinski wrote: I was *extremely* unclear in what I sent since I was running out the door. Most cisco routers run by ISPs (here on NANOG) have at least 50 interfaces (subinterfaces) and usually average 100. Each and every interface/subinterface has to be blocked. So it is either create an extended access list with all 100 individual interface addresses blocked (and update it as new customers get connected) or block by subnet, i.e if all interfaces come from a 255.255.255.252 (/30) subnetted block, then block the whole /24. But then the problem I discussed below creeps up. Any recommendations on how to block this by subnet (assuming the router side always has the same bit position in the subnet)? -Hank
-----BEGIN PGP SIGNED MESSAGE-----
Does BGP use TCP or UDP?
TCP.
If TCP then we are in trouble.
I don't think so.
Almost everyone has access to the Internet via BGP. The line IP address is usually made up of a pair of addresses in the same subnet. You can IP spoof block all your internal IP addresses but if you block the IP address of your BGP connection to your BGP peer and BGP uses TCP, then the examples jbash gave out will stop BGP updates as well.
This was my example:
interface ethernet 0 ip address 1.2.3.4 255.255.255.0 ip access-group 101 in ! interface ethernet 1 ip address 5.6.7.8 ip access-group 101 in ! access-list 101 deny tcp 1.2.3.4 0.0.0.0 1.2.3.4 0.0.0.0 access-list 101 deny tcp 5.6.7.8 0.0.0.0 5.6.7.8 0.0.0.0 access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
That only blocks the router talking to itself, not talking to any other host, whether on the same subnet or not. As far as I know, you don't have to have a TCP connection to yourself to run BGP, just to your neighbors.
-- John B.
-----BEGIN PGP SIGNATURE----- Version: None of your beeswax
iQCVAwUBNHcrO3emvD4nAHb9AQHpsAP+OV+xm3uQ+N1Xoc6auDyKfM/j0L9JPqvL n1pKNh73jqZz8vMzMWOkm8wcnGkW9u+JFQ0tSlkEtpkWrAG96f0kmSpXyfC6BRYo RvpkXL4hHT0A+1HSbVNmOjGjfThdEyWOdhcE9jJc35PxzErzarsyFTPnjK6Fl5Rl 8wVsoHAPNYU= =cAK5 -----END PGP SIGNATURE-----