🚀 go-pugleaf

[posted and mailed]

"jankemi(remove)" <"jankemi(remove)"@mail.com> wrote in news:LqFTa.116237
$wk6.30285@rwcrnsc52.ops.asp.att.net:

> Bill Johnston wrote:

>> [...] certain well-known TCP ports.
  
> IP Protocols, not TCP ports.

Whoa!  Perhaps you should alert the IANA
as well.  It is almost as if we've all been 
using the same terminology for the past 
twenty-five years and we all know what 
we mean by it.  Perhaps it's a conspiracy?
 
> Cisco's alert was revised last week to include specific ACL's that will 
> stop the attack. Our ACL's went in last Thursday evening.

The problem with these ACLs - "Transit ACLs", 
to be precise, is that when applied to edge 
routers earlier than 75xx or 12xxx series,
the recommended line:

access list ### 101 deny 53 any any

means that DNS requests get blocked, with no
workaround available.  If you happen to be an 
organization that handles its own external DNS, 
this is ungood.  Cisco acks this fact in the 
advisory:

http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml

by noting in italics that:

"ACLs can have performance impact on certain platforms, 
so care should be taken when applying the recommended 
workarounds."

Further to this, they hint (barely) that the one of the 
solutions to the problem I cite above is to create 
something called "Receive ACLs", which are described in:

http://www.cisco.com/warp/public/707/racl.html

The problem with racls, which could in principle 
catch and allow DNS traffic (as well as 55,77, and
103) to be handled before this IOS flaw apparently 
rears its ugly head, is that racls are currently 
supported on very few platforms (75xx and 12xxx) 
for only certain IOS versions.

So once again, merely applying the Transit ACLs 
given in the Cisco advisory referenced by CERT
and SANS is not a sufficient solution for an 
enterprise network.

> The information exists in Cisco's announcment.

Not the information that I was asking for, Mike.

The reason that I ask for information on the 
Usenet is because I know that I am not the 
world's greatest expert on networking.  But 
in addition in asking questions on the net, 
I have been answering them since 1988.

Politely, my young man.

- Bill
-- 
Bill Johnston
Johnston Network Consulting Services
14758 Chisholm Landing Way
Gaithersburg, MD  20878
301-717-8894
wdj-netconsult@consultant.com