Re: What am I seeing?

From: Mike Lewinski (mike@rockynet.com)
Date: 10/23/01 

Message-ID: <009101c15bdd$f5048a20$e25f753f@domain.com>
From: "Mike Lewinski" <mike@rockynet.com>
To: <incidents@securityfocus.com>
Subject: Re: What am I seeing?
Date: Tue, 23 Oct 2001 10:15:39 -0600

> problem is...looks like, to me, that it is not coming from outside...thus
> the ingress filtering will not stop it. Or am I missing something?

Yes. You need to create an ACL to prohibit your own networks from entering
any outside router interfaces.

1) Create an ACL to deny your network as the source:

access-list 100 deny ip 64.8.0.0 0.0.0.255 any
access-list 100 permit ip any any

2) Apply it to an *external* router interface with keyword "in".

interface Serial0
ip access-group 100 in

3) Check to see what it's catching:

Border# sh ip access 100

Optimally this is best done upstream so you're not having to pay for dropped
packets on the metered side of a link.

Mike

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: Pix 506e, PPTP problem
    ... The 10.0.0.10 is the first address in my pptp pool I setup on the pix. ... >:> Have you used a sysopt connection command to bypass ACL checking? ... > the name after the word 'access-group' is the name of the existing ACL ... > network-object 10.0.0.10 255.255.255.254 ...
    (comp.dcom.sys.cisco)
  • Re: ACL 2 access groups on 1 interface
    ... When I have just one access group applied everything ... ip access-group 101 out ... access-list 100 permit tcp any any eq smtp ... the end of each ACL, and since your rules are completely different, ...
    (comp.dcom.sys.cisco)
  • Re: ACL 2 access groups on 1 interface
    ... have most of the router configured correctly but I am having trouble ... ip access-group 101 out ... access-list 100 permit tcp any any eq smtp ... the end of each ACL, and since your rules are completely different, ...
    (comp.dcom.sys.cisco)
  • Re: ACL 2 access groups on 1 interface
    ... When I have just one access group applied everything ... ip access-group 101 out ... access-list 100 permit tcp any any eq smtp ... the end of each ACL, and since your rules are completely different, ...
    (comp.dcom.sys.cisco)
  • Re: ACL 2 access groups on 1 interface
    ... When I have just one access group applied everything ... ip access-group 101 out ... access-list 100 permit tcp any any eq smtp ... the end of each ACL, and since your rules are completely different, ...
    (comp.dcom.sys.cisco)