|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: not rewriting next-hop, pointing default, ...
> > In a world where SSH were available in cisco routers and/or > > IPsec were more widely deployed, I might have different views. Failing this, the ability to disable responding to packets (*) with source route set on the Cisco *host* TCP/IP stack (and continue to forward them), would allow it to be easilly enabled in your core, and filtered at borders with machines and vulnerable equipment attached. IE you filter out such packets as part of your normal firewalling. This would prevent the telnet to Cisco with LSR poblem. Thus traceroute -g would give you the useful information, then star out if you were tracing to (say) www.uu.net. (*) - urm, except responding to traceroutes etc. :-) Alex Bligh Xara Networks
|