H2+ Variation in Section 4.1

**Nobita** · 04-15-2018, 04:48 AM

I just got a message from my friend, he took exam in last week and got H2+, he said with me in section 4.1, Cisco was asked as below:

Configure the network as per the following requirements:
• Protect R17’s control-plane from TTL expiry attacks so that match IP packets with a TTL of 0 or 1 are dropped before the CPU processes them.
• Legit packets include expected control protocols running on the link.
• Not allowed to configure “deny” statement.

Any I deal about this situation? Please share.

**Robin** · 04-15-2018, 04:55 AM

Originally Posted by Nobita

I just got a message from my friend, he took exam in last week and got H2+, he said with me in section 4.1, Cisco was asked as below:

Configure the network as per the following requirements:
• Protect R17’s control-plane from TTL expiry attacks so that match IP packets with a TTL of 0 or 1 are dropped before the CPU processes them.
• Legit packets include expected control protocols running on the link.
• Not allowed to configure “deny” statement.

Any I deal about this situation? Please share.

That is my solution for this variation

**Hidden Content: Thanks to see the content**

**Nobita** · 04-15-2018, 07:46 AM

Originally Posted by Robin

That is my solution for this variation

***Hidden content cannot be quoted.***

Thanks, any ideals if Cisco ask: Not allowed to configure “permit” statement

**Robin** · 04-15-2018, 07:48 AM

Originally Posted by Nobita

Thanks, any ideals if Cisco ask: Not allowed to configure “permit” statement

some guys just mentioned about this statement. but from my view, I don't think: there is a solution for this statement. anyone have ideal about this case?

**yiya** · 04-15-2018, 02:12 PM

Thanks for sharing

**freebsd321** · 08-22-2018, 09:22 AM

Originally Posted by Robin

That is my solution for this variation

***Hidden content cannot be quoted.***

Thanks for solution.

**BGP123** · 10-19-2018, 10:18 AM

thanks for sharing

**ASN373** · 02-17-2019, 07:00 AM

you need to add the following in TTL1

permit udp any any

otherwise the any traceroute from the spokes (R19,20,21) to the rest of the network will show the following in the traceroute output

1. * * *

**johnspain** · 04-20-2019, 07:29 AM

i think it is more accurate to add the port range:
ip access-list extended PASS-TTL
permit ospf any any
permit tcp any any eq bgp
permit tcp any eq bgp any
permit pim any any
permit esp any any
permit gre any any
permit udp any any eq 500
permit udp any any eq 4500
perm udp any any ra 33434 33534 <-- for traceroute
!

**mrlee** · 02-18-2019, 06:37 AM

thanks for sharing

Thread: H2+ Variation in Section 4.1

Thread Tools

Display

Hybrid View

H2+ Variation in Section 4.1

The Following 12 Users Say Thank You to Nobita For This Useful Post:

Re: H2+ Variation in Section 4.1

The Following 215 Users Say Thank You to Robin For This Useful Post:

Re: H2+ Variation in Section 4.1

The Following 12 Users Say Thank You to Nobita For This Useful Post:

Re: H2+ Variation in Section 4.1

The Following 2 Users Say Thank You to Robin For This Useful Post:

Re: H2+ Variation in Section 4.1

Re: H2+ Variation in Section 4.1

The Following 6 Users Say Thank You to freebsd321 For This Useful Post:

Re: H2+ Variation in Section 4.1

Re: H2+ Variation in Section 4.1

Re: H2+ Variation in Section 4.1

Re: H2+ Variation in Section 4.1

The Following User Says Thank You to mrlee For This Useful Post:

Posting Permissions