Can you move the ACL to a beefier device and/or closer to the source? The 7200 (nonVXR) Isn’t exactly bleeding edge.
On Mar 2, 2014, at 2:05 PM, Mike <[email protected]> wrote: > On 03/02/2014 09:33 AM, Nick Hilliard wrote: >> On 28/02/2014 18:35, Mike wrote: >>> So my question is, can I optimize this to reduce router load? Oh, I >>> have this on 7201. >> It may help if you enable "access-list compiled" in global config mode - >> google for "Turbo ACLs" for information on how this works. If this doesn't >> help, then you're gonna need a bigger boat. >> >> That's one seriously aggressive ACL you have. I'm glad I'm not at the >> receiving end of it. >> > > I should have said I do have access-list compiled already, I was just > wondering if there was something else like ordering of the rules or > expressions that might improve it a bit. > > As fas as the aggressiveness of the acl, yep you are right, but keep in mind > this only is blocking inbound requests made TO customer CPE, such as dns > queries, snmp, web management interface, and so forth. On the plus side, any > customer can request an opt-out and I'll happily remove it for them (its just > a radius group they are a member of). The necessity of having to do this in > the first place is that customer CPE are under attack and have been hijacked > en-mass resulting in massive support calls from folks who are just as > ignorant as their equipment manufacturer and who are dissastified with having > to bring the device to us so it can be reset, reprogrammed, and secured > (update fw or alternate fw like dd-wrt or such). > > Thanks. > > Mike- > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
