RE: [nsp] icmp blocking

• Next message: Mehta, Phoram: "Strange connectivity problem!"
• Previous message: Hank Nussbacher: "Re: Subnet Mask"
• Maybe in reply to: Birsen Ozturk: "[nsp] icmp blocking"
• Next in thread: Tejal Shah: "[nsp] Access-list for SNMP"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Mail actions: [ respond to this message ] [ mail a new topic ]

According to Cisco, there's service impact if the rate-limit is enabled.
"The performance impact of CAR is dependent on the number of CAR rules
applied. The performance impact is also greated on engine 1 linecards, then
engine 0 linecards"

So I worry about if this rate-limit is feasible. Yes, there's service impact
as well if I totally block the ICMP. So anybody has some experience to share
for the NSP/ISP network?

Thanks,
-ns

-----Original Message-----
From: Gert Doering [mailto:gert@greenie.muc.de]
Sent: 28 March 2002 12:12 PM
To: Shi, Ning; 'Rob Thomas'; Cisco List
Subject: Re: [nsp] icmp blocking

Hi,

On Thu, Mar 28, 2002 at 12:02:43PM -0500, Shi, Ning wrote:
> I guess this is OK for enterprise network. Any good idea for ISP?

Permit ICMP (with rate-limiting). Really.

It sucks so much if you can't do traceroute/ping to figure out why your
customers can't reach some web server hosted at some other ISP because
they have broken network diagnostics on purpose (read: deny ICMP).

gert

-- 
USENET is *not* the non-clickable part of WWW!
 
//www.muc.de/~gert/
Gert Doering - Munich, Germany
gert@greenie.muc.de
fax: +49-89-35655025
gert.doering@physik.tu-muenchen.de

• Next message: Mehta, Phoram: "Strange connectivity problem!"
• Previous message: Hank Nussbacher: "Re: Subnet Mask"
• Maybe in reply to: Birsen Ozturk: "[nsp] icmp blocking"
• Next in thread: Tejal Shah: "[nsp] Access-list for SNMP"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Mail actions: [ respond to this message ] [ mail a new topic ]

This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:39 EDT