Great Circle Associates Firewalls
(November 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Looping TRACERT?
From: chrisp @ optimation . co . nz (Chris Palmer)
Organization: Optimation New Zealand Ltd
Date: Thu, 28 Nov 1996 10:30:35 NZST
To: firewalls @ greatcircle . com
Newsgroups: optim.security.firewalls
References: <199611271259 . HAA15008 @ homeport . org>

In article <199611271259 .
 HAA15008 @
 homeport .
 org> blake @
 security .
 com (Scott 
Blake) writes:
>Russ-
>This behavior occurs when the router has lost its connection (and the
>corresponding route) to the downstream subnet.  So, tpa-max attempts to
>deliver to CHI-Cisco01, which doesn't know what to do with the packet, and
>returns it to tpa-max, which is it's default route.  I've seen this most
>frequently with dedicated modem lines that drop frequently, but I would
>imagine it would happen with other media.  Hope this makes it clearer.

For any (Cisco) routers that have a default route, I always setup static
routes to Null0 for any nets that are normally directly connected. When the
interface is up, the connected route overrides the null route. Easy way to
stop traffic going out the default route when the proper one isn't there. Also
works in various subnetting situations.
(NB. I've only tried this with statically routed configs. I don't know what
the implications might be when running various routing protocols!).
-------------------------------------------------------------------
Chris Palmer                        Phone:  +(64) (4) 472 7218
Optimation New Zealand Ltd          Fax:    +(64) (4) 472 7219
P.O. Box 10616                      Mobile: +(64) (25) 863 243
Wellington, New Zealand             Email:  chrisp @
 optimation .
 co .
 nz


Follow-Ups:
References:
Indexed By Date Previous: Re: Lotus notes through firewall
From: phoenix @ clark . net
Next: RE: Cisco's PIX firewall
From: Ryan Russell/SYBASE <Ryan . Russell @ sybase . com>
Indexed By Thread Previous: Re: Looping TRACERT?
From: blake @ security . com (Scott Blake)
Next: Re: Looping TRACERT?
From: Benedikt Stockebrand <benedikt @ devnull . ruhr . de>

Google
 
Search Internet Search www.greatcircle.com