On Jan 15, 2014, at 11:41 AM, Patrick W. Gilmore <patr...@ianai.net> wrote:
> I repeat: NEVER EVER EVER put an IX prefix into BGP, IGP, or even static > route. An IXP LAN should not be reachable from any device except those > directly attached to that LAN. Period. +1 Again, folks, this isn't theoretical. When the particular attacks cited in this thread were taking place, I was astonished that the IXP infrastructure routes were even being advertised outside of the IXP network, because of these very issues. IXPs are not the problem when it comes to breaking PMTU-D. The problem is largely with enterprise networks, and with 'security' vendors who've propagated the myth that simply blocking all ICMP somehow increases 'security'. ----------------------------------------------------------------------- Roland Dobbins <rdobb...@arbor.net> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton
signature.asc
Description: Message signed with OpenPGP using GPGMail
