[cisco-bba] ACLs on Virtual-Access templates

[Arie Vayner]

Frank,

So, just to be sure - if you remove the ACL, does uRPF work as it should?
I would assume (I don't have the time right now to make sure) that the ACL
is evaluated before as it is part of the ingress packet processing, while
uRPF is done later (close to the time when you also do a route lookup).
Therefore, it would make sense for the ACL to take precedence.

With regards to the log message, can you show me some example of what you
actually get? I can then try and see if we can file an enhancement request.

Thanks
Arie

On Sun, Feb 1, 2009 at 6:58 AM, Frank Bulk <frnkblk at iname.com> wrote:

>  Just to add to that, is there a way that the Virtual-interface that's
> doing the spoofing can be identified?  The log entries for the ACL hits
> don't show anything but the spoofed IP, but I don't know which connection is
> doing it.  Perhaps it's one PPPoA/E connection that's generating those
> spoofed packets…
>
>
>
> Frank
>
>
>
> *From:* Arie Vayner [mailto:arievayner at gmail.com]
> *Sent:* Saturday, January 31, 2009 3:49 PM
> *To:* Frank Bulk
> *Cc:* cisco-bba at puck.nether.net
> *Subject:* Re: [cisco-bba] ACLs on Virtual-Access templates
>
>
>
> Frank,
>
>
> uRFP should be the right way to block packets from the client as a
> source...
> After you connect, do you see the uRPF feature enabled on the
> Virtual-Access (show run interface and show ip interface)?
>
> Arie
>
> On Sat, Jan 31, 2009 at 11:35 PM, Frank Bulk <frnkblk at iname.com> wrote:
>
> Is there a way to build an ACL on a Virtual-Access template such that the
> connection can only use the IP address given to it by IPCP?
>
> I applied strict uRPF to the Virtual-Access template, but that didn't stop
> this kind of traffic:
>
> Jan 31 15:23:21 a.b.c.d 38279: Jan 31 15:23:20.964 CST:
> %SEC-6-IPACCESSLOGP:
> list 125 denied udp 80.212.149.228(55190) -> 192.168.0.0(19427), 1 packet
> Jan 31 15:23:32 a.b.c.d 38287: Jan 31 15:23:31.476 CST:
> %SEC-6-IPACCESSLOGP:
> list 125 denied tcp 222.172.244.3(2047) -> 192.168.0.0(19427), 1 packet
> Jan 31 15:23:33 a.b.c.d 38288: Jan 31 15:23:32.784 CST:
> %SEC-6-IPACCESSLOGP:
> list 125 denied udp 151.48.173.200(25235) -> 192.168.0.0(19427), 1 packet
> Jan 31 15:23:36 a.b.c.d 38290: Jan 31 15:23:34.884 CST:
> %SEC-6-IPACCESSLOGP:
> list 125 denied udp 58.108.93.71(13502) -> 192.168.0.0(19427), 1 packet
>
> Those source IPs aren't mine, and are targeting an RFC1918 address.  I'm
> blocking traffic originating from my PPPoA/E customers that use a source IP
> address outside my netblock or are targeting an RFC198 address using an
> inbound ACL on the Virtual-Access template, but it doesn't stop a a
> customer
> from spoofing their neighbor's IP address.
>
> I've had a basic ACL in place on our internet-facing Ethernet port (Cisco
> 7206VXR with NPE-400) for a long time, but I didn't having anything in
> place
> to block RFC 1918 addresses.  I could have applied the rules to the ACL on
> the Ethernet interface, but I've been told to apply an ACL as close as
> possible to the source of the traffic.
>
> To further complicate matters, I also use this router to route RFC 1918
> space for corporate needs.  I keep that "separate" by using source-based
> routing, but that didn't prevent PPPoA/E customers from sending a packet to
> the RFC 1918 space, even if the return packet never got back to them.
> Perhaps I should use a VRF for handling corporate, traffic, except that
> I've
> never done that before and I would need to spend some time learning.
>
> Frank
>
> _______________________________________________
> cisco-bba mailing list
> cisco-bba at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-bba
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-bba/attachments/20090201/39a8de27/attachment.html>