Sure but eventually you run out of transit links and reach edge/host networks
;o)
Address "plans" in enterprise networks tend to contain decades of legacy that
make aggregating the router IP addresses infeasible. They're usually firewalled
of course but that doesn't help you if something inside the firewall scans your
entire /16.
This is why so many people rely on CPP I'd wager. Sticking a (different) 2517
ACE ACL on every edge interface is not something I'd feel entirely safe about...
Fwiw all our transit nets internally and onwards to other customers are indeed
numbered from dedicated blocks. We have a few miscreant customers who nat to
that address and whose practice predates anything we might refer to as internet
security ("but we use that IP to talk to a space probe launched in 1986!”) but
those blocks are in the main unreachable.
--
Sent from my phone with, please excuse brevity and typos
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
