Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19

  • From: Joe Maimon
  • Date: Thu Jan 20 11:20:53 2005



David Barak wrote:

--- Suresh Ramasubramanian <ops.lists@gmail.com>
wrote:


David Barak <thegameiam@yahoo.com> wrote:

While it says that bogon filters change, and

provides

a URL to check it, what percentage of folks who

would

use a feature like "autosecure" would ever update
their filters?

What do they do to update that bogon list anyway -
push a new IOS image?


That's a mighty fine question: the link I referenced
is the most recent I was able to find, and its list of
bogons is thoroughly out-of-date. In the interest of
long-term reachability, I would call on Cisco to
remove the IANA-UNASSIGNED blocks from the autosecure
filters.



I think the last time this was hashed out here, there was a consensus that Cisco should not be promoting a feature that uses a static list for blackholing. The problem is with now-good-bogons bad enough as it is, even with a presumably competent admin responsible for the setup.

Perhaps Cisco could couple this with a scheduled scp to a server of choice, preferably Cisco's, for an update checking feature. At that point I would think perhaps it has a bit more + than - to it.

At any rate it should NOT be tied to IOS images, the vast majority of those never get upgraded. Make ACLS be able to parse their rules from a file stored wherever. Just like that new DHCP static bindings from text file feature.

Joe




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.