Re: Juniper DOS/Blackhole question

2011-10-23 Thread Jack Bates
On 10/23/2011 2:18 AM, Saku Ytti wrote: EBGP multihop is kludge to kill this check, but also kludge to kill convergence of your BGP session, due to disabling This is what I was worried about. fall over on linkdown. Proper way to disable this check is JunOS 'accept-remote-nexthop' or IOS 'disa

Re: Juniper DOS/Blackhole question

2011-10-23 Thread Saku Ytti
On (2011-10-22 20:38 -0500), Jack Bates wrote: > the route. This seems strange to me. Any idea why a route would be > rejected unless multihop was enabled? RFC4271 states: -- - By default (if none of the above conditions apply), the BGP speaker SHOULD use the IP address of the interface tha

Re: Juniper DOS/Blackhole question

2011-10-22 Thread Christopher Morrow
On Sat, Oct 22, 2011 at 11:26 PM, Jack Bates wrote: > On 10/22/2011 10:14 PM, Stefan Fouant wrote: >> Not sure about the PPS limitations... The PFE ASICs should be able to >> handle a 750Mbps / 1.5 Mpps DoS pretty easy... > > That's what I'm thinking. My m120 shows 0 problems with the load, but 2

Re: Juniper DOS/Blackhole question

2011-10-22 Thread Jack Bates
On 10/22/2011 10:14 PM, Stefan Fouant wrote: Enabling BGP multi-hop is a very common approach with DDoS Mitigation services and also variations of Remote-Triggered Black Holes where the discard route isn't localized on the edge router. This is not because the customer router will be greater t

Re: Juniper DOS/Blackhole question

2011-10-22 Thread Stefan Fouant
Enabling BGP multi-hop is a very common approach with DDoS Mitigation services and also variations of Remote-Triggered Black Holes where the discard route isn't localized on the edge router. This is not because the customer router will be greater than one hop away, but because enabling multi-ho