nanog mailing list archives
Re: Finding asymmetric path
From: "Brielle Bruns" <bruns () 2mbit com>
Date: Sat, 28 Nov 2009 21:02:23 +0000
(Forgive the top posting, stupid blackberry can't do inline) If the PoP is connected to a central location, reroute the affected netblock there through the appropriate equipment. If you snag it going both ways before it hits the PoP, you should be good. ------Original Message------ From: Duane Waddle To: nanog () nanog org Subject: Re: Finding asymmetric path Sent: Nov 28, 2009 1:26 PM On Sat, Nov 28, 2009 at 1:41 PM, Brielle Bruns <bruns () 2mbit com> wrote:
My partner Tammy says a PIX could probably accomplish the same task (we have some here for the corp lan stuff, including spares).
Yes, a PIX/ASA would stop this cold. The TCP state tracking would not allow traffic to pass unless the whole 3-way handshake was observed by the box. Only recently did Cisco add features to make tracking the TCP connection state optional. (http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.pdf) The larger ASA-5580 machines can be virtualized into dozens (or more) security contexts as needed. I imagine it would take some effort to figure out how to cleanly integrate such a configuration into a POP. --D -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org
Current thread:
- Re: Finding asymmetric path, (continued)
- Re: Finding asymmetric path William Herrin (Nov 28)
- Re: Finding asymmetric path Brielle Bruns (Nov 28)
- Re: Finding asymmetric path ML (Nov 28)
- Re: Finding asymmetric path Brielle Bruns (Nov 28)
- Re: Finding asymmetric path Duane Waddle (Nov 28)
- Re: Finding asymmetric path Arie Vayner (Nov 29)
- Re: Finding asymmetric path ML (Nov 28)
- Re: Finding asymmetric path William Herrin (Nov 28)
- Re: Finding asymmetric path Suresh Ramasubramanian (Nov 28)
- Re: Finding asymmetric path Randy Bush (Nov 28)
- Re: Finding asymmetric path Jorge Amodio (Nov 28)