Filtering BGP Updates by Matching the AS_PATH PA
To filter routes by matching the AS_PATH PA, Cisco IOS uses AS_PATH filters. The overall configuration structure is very similar to BGP distribute lists and prefix lists, with the matching logic specified in a list, and the logic being applied with a neighbor command. The main two steps are as follows: 1. Configure the AS_PATH filter using the ip as-path access-list number {permit | deny} regex command. 2. Enable the AS_PATH filter using the neighbor neighbor-id filter-lis..
IP forwarding, or IP routing, is simply the process of receiving an IP packet, making a decision of where to send the packet next, and then forwarding the packet. The forwarding process needs to be relatively simple, or at least streamlined, for a router to forward large volumes of packets. Ignoring the details of several Cisco optimizations to the forwarding process for a moment, the internal forwarding logic in a router works basically as shown in Figure 7-1. Figure 7-1 F..
UDLD and Loop Guard: Protecting Trunks
Both UniDirectional Link Detection (UDLD) and Loop Guard protect a switch trunk port from causing loops. Both features prevent switch ports from errantly moving from a blocking to a forwarding state when a unidirectional link exists in the network. Unidirectional links are simply links for which one of the two transmission paths on the link has failed, but not both. This can happen as a result of miscabling, cutting one fiber cable, unplugging one fiber, GBIC problems..
Using Access Lists to Protect SNMP Access
You can use the following commands to restrict which IP source addresses are allowed to access SNMP functions on the router. This is the legacy method: Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#access-list 99 permit 172.25.1.0 0.0.0.255 Router(config)#access-list 99 permit host 10.1.1.1 Router(config)#access-list 99 deny any Router(config)#snmp-server community ORARO ro 99..
Filtering Based on TCP Header Flags
The following ACL blocks several illegal combinations of TCP header flags: Router1#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router1(config)#access-list 161 deny tcp any any ack fin psh rst syn urgRouter1(config)#access-list 161 deny tcp any any rst syn Router1(config)#access-list 161 deny tcp any any rst syn finRouter1(config)#access-list 161 deny tcp any any rst syn fin ackRouter1(config)#access-list 161 deny tcp any any syn fin Rou..
