Re: [c-nsp] ACL to block udp/0?

On Dec 6, 2023, at 04:45, Gert Doering via cisco-nsp <[email protected]> wrote:

deny ipv4 any any fragments

This is approach is generally contraindicated, as it tends to break EDNS0, & DNSSEC along with it.

If the target is a broadband access network, you can use flow telemetry to measure normal rates of non-initial fragments destined for it (said rates are generally minimal). You can then implements a QoS policy to police down non-initial fragments in excess of the rate you’ve decided upon, ensuring that you leave some headroom for normal variations in traffic rates.

It would be a good idea to exempt the well-known, well-run open resolvers like Google DNS, Quad9, OpenDNS, et. al. from this policy, as well as your own on-net resolvers.

If the target is a downstream transit customer, something sitting in an IDC, etc., more research & nuance in terms of tACLs, policies, & rates is likely necessary.

--------------------------------------------

Roland Dobbins <[email protected]>

_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/