28.06.2014 Views

Discussion

Discussion

Discussion

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

A disadvantage of this method is that you have to log in to each router and no timestamp<br />

information is included, but it is a useful way to supplement your other management<br />

tools.<br />

If you don’t have tools to determine the size and duration of traffic bursts, as a firstorder<br />

approximation you can select a value by multiplying the interface bandwidth<br />

by the burst duration. The maximum value for the burst-size limit is 100 Mbps.<br />

How you select the thresholds at which to start dropping traffic is a function of your<br />

business and network design models. Some factors might include how variable the<br />

traffic flow is, how critical the traffic is or how damaging an excess of it could be,<br />

and how conservative or liberal you want to be about controlling the flow.<br />

You need to define a policer for each type of traffic you want to rate-limit and then<br />

reference the policer in the proper term.<br />

9.15 Protecting the Local Routing Engine<br />

Problem<br />

You want to protect the Routing Engine by ensuring that it accepts traffic only from<br />

trusted network systems.<br />

Solution<br />

Protecting the Routing Engine involves filtering incoming routing protocol traffic on<br />

the router’s lo0 interface. The first step is to create the filter:<br />

[edit firewall]<br />

aviva@RouterF# edit filter protect-RE<br />

This filter contains terms for the different protocols running on the router. The first<br />

terms allow the router to accept routing-protocol traffic from BGP peers and OSPF<br />

neighbors:<br />

[edit firewall filter protect-RE]<br />

aviva@RouterF# edit term bgp-peers<br />

[edit firewall filter protect-RE term bgp-peers]<br />

aviva@RouterF# set from source-address 10.0.8.0/24<br />

aviva@RouterF# set from source-address 10.0.13.0/24<br />

aviva@RouterF# set from destination-port bgp<br />

aviva@RouterF# set then accept<br />

aviva@RouterF# up<br />

[edit firewall filter protect-RE]<br />

aviva@RouterF# edit term ospf-neighbors<br />

[edit firewall filter protect-RE term ospf-neighbors]<br />

aviva@RouterF# set from source-address 10.0.8.0/24<br />

aviva@RouterF# set from source-address 10.0.13.0/24<br />

aviva@RouterF# set from protocol ospf<br />

aviva@RouterF# set then accept<br />

320 | Chapter 9: Routing Policy and Firewall Filters<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!