Reverse Path Forwarding is a pretty useful feature common in routers these days; it allows you to drop packets when the route to the source address of the packet is something other than the interface on which the packet arrived. In other words, it's a fancy form of antispoofing that focuses on the source address. You can also do some quick and easy removal of unwanted packets using the destination address.
For the last several years, antispoofing access lists and firewall features have been quite common at the edge of the network and even at the border between the LAN at each site and the WAN. However, this doesn't help you when the problem -- for example, a virus that's spouting lots of garbage in an attempt to find and infect other hosts on your network -- is already on your LAN. What you want to be able to do is drop that traffic at the first opportunity, so that your backbone resources don't become congested. Also keep in mind that it's not just your backbone that suffers; your PCs and servers will also have to process every packet they get, which can slow them considerably.
For those of you with proxy servers, consider putting a static default route to the null0 interface on all your routers. In most cases, all the routers in your network communicate with each other via some routing protocol and know about all the routes in your network. However, if you're using a proxy server, you shouldn't need your default route as all traffic to the Internet will be
Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial Director
passed to the known internal address of the proxy server rather than simply following the default route to the nearest Internet gateway. Your proxy server, of course, will require a valid default route.
The advantage here is that when a virus starts trying to scan your network, any attempts made to connect to IP addresses you haven't actually configured will be routed to the bit bucket, which is in many cases much, much faster than using access lists or higher-layer filtering tools. Thus, you rapidly remove this traffic from the network before it ever touches the WAN.
About the author
Tom Lancaster, CCIE# 8829 CNX# 1105, is a consultant with 15 years of experience in the networking industry and co-author of several books on networking, most recently, CCSP: Secure PIX and Secure VPN Study Guide published by Sybex.
This tip originally appeared on our sister site, SearchNetworking.com.
This was first published in January 2005