Internet2 Network Security SIG

[Michael Hare <>]

> -----Original Message-----
> From: 
> 
>  [
> ]
>  On Behalf Of Karl Newell
> Sent: Wednesday, August 16, 2017 4:30 PM
> To: 
> 
> Subject: Re: [Security-WG] Internet2 border anti-spoofing
> 
>  ...
> 
> Your example is one of the reasons we don’t implement uRPF.  We also
> transit traffic for sources that we don’t have a route for (e.g., an 
> organization
> is not a member of I2 but their upstream is a connector and the best route 
> to
> AWS is through us).  But is that the right thing to do?

Yes, it is the right thing to do, and it's what every other provider of 
providers has to do.

Alternative; programmatically build firewall filters from RADB [and accept 
the performance/cost implications of doing so], convince --> all <-- of your 
connectors (peers, customers) to keep said RADB up to date --> without fail 
<-- , develop flow tools to log the inevitable exceptions and be willing to 
operate on said exceptions.

-Michael

> 
> Karl
> 
> --
> Karl Newell
> Cyberinfrastructure Security Engineer
> Internet2
> 520-344-0459