From owner-freebsd-security Sat Jan 22 17:42:48 2000 Delivered-To: freebsd-security@freebsd.org Received: from gate.az.com (gate.az.com [216.145.8.252]) by hub.freebsd.org (Postfix) with ESMTP id 226761502B for ; Sat, 22 Jan 2000 17:42:45 -0800 (PST) (envelope-from yankee@gate.az.com) Received: (from yankee@localhost) by gate.az.com (8.8.5/8.8.5) id RAA02885; Sat, 22 Jan 2000 17:42:42 -0800 (PST) Date: Sat, 22 Jan 2000 17:42:41 -0800 (PST) From: "Dan Seafeldt, AZ.COM System Administrator" To: Poul-Henning Kamp Cc: sthaug@nethelp.no, gdonl@tsc.tdk.com, security@FreeBSD.ORG Subject: Re: MAPS effort In-Reply-To: <12128.948540545@critter.freebsd.dk> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org If ISP Z has 2 frame relay PVCS on a serial connection using a say a cisco 2501 and uses upstream ISP A and ISP B and ISP A is on PVC #16 and routing 199.199.199.x and big ISP B is on PVC #17 and routing 200.200.200.x and then ISP Z decides to use PVC #16 as the default gateway then all source packets, even the ones from machines on the 200.200.200.x segment would go out the 199.199.199.x gateway. Now if the upstream ISP A chose to block 200.200.200.x on the egress it would cut off ISP Z's machines that used the 200 addresses (packets can come in on PVC #17 but can't go out PVC #16 and then get through the upstream egress block) and of course the opposite would be true if the ISP Z decided to make PVC #17 the default gateway and ISP B blocked the 199 addresses on the egress router. On Sat, 22 Jan 2000, Poul-Henning Kamp wrote: > In message , "Dan Seafel > dt, AZ.COM System Administrator" writes: > > > >I have a CISCO router upgraded to pre-release 12.0 and will look at that. > >And regarding the mention of MAPS effort, I thought about that but I was > >worried about all the ISP's out there who may use one > >gateway/router to connect 2 separate upstream netblocks without any use of > >BGP. In this case, it is possible that outbound packets will always go > >through one upstream ISP even though the returns end up going through 2 > >different ISP's For example, a CISCO 2600 series with one Frame Relay > >connection and 2 PVCS to two different upsteams, and the gateway set to one > >of these PVC's with a different class C coming down each PVC's > > > >I could see where an egress block enabled by the upstream provider who is > >not the gateway would shut down access to that class C. Not all ISP's can > >afford to or understand how to implement BGP but want some amount of > >redudancy or additional bandwidth via 2 different upstreams. > > You know, that would be the most lame excuse for not doing anything > about this I have heard so far. > > That ISP, can still put egress filters on both their outgoing PVCs > as long as they allow both C classes both ways. > > But I would be terribly disappointed if their upstream didn't block > all but their assigned C class in. > > -- > Poul-Henning Kamp FreeBSD coreteam member > phk@FreeBSD.ORG "Real hackers run -current on their laptop." > FreeBSD -- It will take a long time before progress goes too far! > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message