Ingress filtering on transits, peers, and IX ports

Thu Oct 15 10:11:42 UTC 2020

Hey,

> All stub autonomous systems should have a simple egress ACL allowing only PI of their customers and their own PAs -it’s a simple ACL at each AS-Exit points (towards transits/peers), that’s it.
>
> -not sure why this isn’t the first sentence in every BCP and “security bulletin”…

I will venture a guess.

  1) it's very specific scenario to be stubby and have downstream PI
  2) it won't address customers spoofing each other arbitrarily and
customer1 spoofing as customer2 on the internet, giving large chunk of
the utility of spoofing even with protection in place

How do you maintain that ACL? Why doesn't that same mechanism allow
ingress ACL on the customer port? Your proposal looks low utility for
work needed.

-- 
  ++ytti