Matt meant "reserve/assign a /64 for each PtP link, but only configure the
first */127* of the link", as that's the only way to fully mitigate the
scanning-type attacks (with a /126, there is still the possibility of
ping-pong on a p-t-p interface) w/o using extensive ACLs..
Anyways, that's what worked for us, and, as always, YMMV...
That's still relying on the fact that your vendor won't implement
subnet-router anycast address and turn it on by default. That would
mess up the first address of the link. But I suppose those would be
pretty big ifs.
