Incoming SSDP UDP 1900 filtering

Mon Mar 25 16:26:25 UTC 2019

On 3/25/19 9:08 AM, Tom Beecher wrote:
> If your edge ingress ACLs are not 100% in sync all the time, you will 
> inevitably have Really Weird Stuff happen that will end up taking 
> forever to diagnose.
> 
> You will eventually end up closing off a port that something else needs 
> to work properly, and now you have to figure out how to resolve that.
> 
> Packet filtering is more computationally taxing than just routing is. 
> Your edge equipment is likely going to be built for maximum routing 
> efficiency. Trying to bite off too much filtering there increases your 
> risk of legit traffic being tossed on the floor.

Not necessarily disagreeing with your posits here, but, empirically 
speaking, we've had ACLs for stuff like this for years without any 
incidents or consternation.

And we are careful to ensure that any updates are pushed to all edge 
ingresses.

> On Mon, Mar 25, 2019 at 6:41 AM Tom Hill <tom at ninjabadger.net 
> <mailto:tom at ninjabadger.net>> wrote:
> 
>     On 25/03/2019 09:17, Sean Donelan wrote:
>      > Its always a bad idea to do packet filtering at your bgp border.
> 
> 
>     Wild assertion. Why?
> 
>     DoS mitigation, iACLs, BGP security... I can think of lots of very
>     sensible reasons.
> 
>     -- 
>     Tom
> 