🚀 go-pugleaf

In comp.dcom.sys.cisco Bill Johnston <wdj-netconsult@consultant.com> wrote:
> [posted and mailed]

> "jankemi(remove)" <"jankemi(remove)"@mail.com> wrote in news:LqFTa.116237
> $wk6.30285@rwcrnsc52.ops.asp.att.net:

>> Bill Johnston wrote:

>>> [...] certain well-known TCP ports.
>   
>> IP Protocols, not TCP ports.

> Whoa!  Perhaps you should alert the IANA
> as well.  It is almost as if we've all been 
> using the same terminology for the past 
> twenty-five years and we all know what 
> we mean by it.  Perhaps it's a conspiracy?
>  
>> Cisco's alert was revised last week to include specific ACL's that will 
>> stop the attack. Our ACL's went in last Thursday evening.

> The problem with these ACLs - "Transit ACLs", 
> to be precise, is that when applied to edge 
> routers earlier than 75xx or 12xxx series,
> the recommended line:

> access list ### 101 deny 53 any any

> means that DNS requests get blocked, with no
> workaround available.  If you happen to be an 
> organization that handles its own external DNS, 
> this is ungood.  Cisco acks this fact in the 
> advisory:

no that specifies the protocol. not the port.

> http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml

> by noting in italics that:

> "ACLs can have performance impact on certain platforms, 
> so care should be taken when applying the recommended 
> workarounds."

> Further to this, they hint (barely) that the one of the 
> solutions to the problem I cite above is to create 
> something called "Receive ACLs", which are described in:

> http://www.cisco.com/warp/public/707/racl.html

> The problem with racls, which could in principle 
> catch and allow DNS traffic (as well as 55,77, and
> 103) to be handled before this IOS flaw apparently 
> rears its ugly head, is that racls are currently 
> supported on very few platforms (75xx and 12xxx) 
> for only certain IOS versions.

> So once again, merely applying the Transit ACLs 
> given in the Cisco advisory referenced by CERT
> and SANS is not a sufficient solution for an 
> enterprise network.

>> The information exists in Cisco's announcment.

> Not the information that I was asking for, Mike.

> The reason that I ask for information on the 
> Usenet is because I know that I am not the 
> world's greatest expert on networking.  But 
> in addition in asking questions on the net, 
> I have been answering them since 1988.

> Politely, my young man.

> - Bill
> -- 
> Bill Johnston
> Johnston Network Consulting Services
> 14758 Chisholm Landing Way
> Gaithersburg, MD  20878
> 301-717-8894
> wdj-netconsult@consultant.com

-- 
The complexity of a weapon is inversely proportional to the IQ of
the weapon's operator.