On Mar 10, 2014, at 2:41 AM, redscorpion69 <[email protected]> wrote:
> Filters don't allow BGP sessions to our PE router. You might want to double-check that your iACLs are up-to-date, that you've enabled GTSM, that you've enabled CoPP, etc. What make/model/OS/train/revision/linecard? > By the way, what IS the best way to defend against this huge amount of > traffic? You can't really place policers at the edge of the network, it's > cumbersome and prone to errors. Sure you can. Police down UDP/123 traffic which isn't 76 bytes in size down to a 1mb/sec aggregate or thereabouts, or UDP/123 traffic which is greater than 400 bytes in size down to a 1mb/sec aggregate, or thereabouts. I prefer the former, but YMMV. ----------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
