Internet2 Network Security SIG

[David Farmer <>]

 

On Tue, Jan 8, 2019 at 4:28 PM Dale W. Carder <> wrote:

It looks like our filters largely match this list (minus multicast) and
of course we have explicit bcp38 filters for downstream networks to only
allow their prefixes.

Do you permit any packets not source from their assigned blocks?  Like maybe for IPv4 192.0.0.9 or 192.88.99.1, or for IPv6 2002:a.b.c.0/40 or larger, where a.b.c.0/24 are their IPv4 prefixes?

 

https://www.team-cymru.org/Services/Bogons/bogon-bn-nonagg.txt

That is basis for our IPv4 Bongon filters.  Note: Multicast 224.0.0.0/4 is an invalid source but a valid destination. Also, you might not want to block 192.0.0.0/24, as at least 192.0.0.9 is a valid source address for packets on the Internet, there could be valid ICMPv4 packets notifying a real IPv4 destination of a dropped packet in a 4rd tunnel, see RFC7600.

Two other handy reference links, not everything on the lists are bogons, but all the bogons are listed;

https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml

https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml 

 

For v6 we drop non 2000::/3 space and the documentation prefix.  That
could probably be expanded to include 2001:0002::/48
Are there others?

Just curious, how do you implement that?  And, do you allow link-local on the external facing router ports?

Deny 0000::/3 any

Deny 4000::/2 any

Deny 8000::/1 any

Deny any 0000::/3

Deny any 4000::/2

Deny any 8000::/1

Deny 2001:db8::/32 any

Deny 2001:0002::/48 any

Deny any 2001:db8::/32

Deny any 2001:0002::/48

Pemit any any

Or;

Deny 2001:db8::/32 any

Deny 2001:0002::/48 any

Deny any 2001:db8::/32

Deny any 2001:0002::/48

Permit 2000::/3 2000::/3

Deny any any

Thanks

--

===============================================
David Farmer              
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota  
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================