[j-nsp] Whats the best way to announce an IP range in BGP? Doesn't physically exist anywhere.

[Pavel Lunin]

>> This is exactly what happened. The session table filled up. One of
>> our security guys took down our edge 650 cluster from a single unix
>> box out on the net.
> This is what happens when you use a stateful box for an internet router.
>
> a  router with a covering aggreate and some knowledge of the more
> specifc on the interior would inexpensively discard traffic bound for
> unreachable destinations.

1. First, sorry for writing this once again, but it's just not the case.
Any more or less smart stateful device, whether SRX or anything else,
must not create session states for packets falling under a discard
route. And SRX does not, I checked. Filling up the session table is
caused by either a bug or (rather) a design/config mistake.

2. There is nothing wrong in the idea of using a firewall as a single
border device for both stateful-processing and ASBR in most networks
where a statful edge-device is needed and all external links are
terminated in a single site.

3. This particular problem has nothing to do with BGP or any other
routing. Even if Morgan had an MX at the edge and SRX behind it, this
same thing would happen as well. He would use, say, /27 as a source NAT
pool on SRX and announce it to the MX via IGP or iBGP, using actually
the same means to create the route itself (static discard, aggregate,
whatever). What will happen if an external host initiates a session
towards an IP in this prefix? If the firewall creates sessions for such
packets, what the firewall is needed at all?