North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: Customer-facing ACLs

  • From: Frank Bulk - iNAME
  • Date: Tue Mar 11 01:12:01 2008

We have a two-dozen line long ACL applied to our CMTS and BRAS blocking
Windows and "virus" ports and have never had a complaint or a problem.  We
do have a more sophisticated residential or large-biz customers ask, but
only once has our ACL been the source of a problem and it's only because the
OEM version of the software didn't implement communications the same way as
their branded version.


-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Sean
Sent: Monday, March 10, 2008 2:30 PM
To: Scott Weeks
Cc: [email protected]
Subject: Re: Customer-facing ACLs

On Mon, 10 Mar 2008, Scott Weeks wrote:
> The hard part is I now always take over networks that have been in
> operation a long time and enabling these policies can be very painful
> after the fact.  Establishing them when the network is new is a
> different story.

Whatever you decide, whether you know what the policies are or not, there
are always have a set of default network policies.

The question is do you explain to you customers just as carefully what
your default policy doesn't do, as well as what it does.  Do you take
just as much time to carefully explain the risks and what may break to
your customers of allowing that traffic as you would of not allowing that

It seems to be very painful whatever decision is made.