topic BGP shold be using tcp/179 in Network Security

iACL Usage

zekebashi — Fri, 21 Feb 2020 14:04:18 GMT

Hello,

We have a NX7K with two connections(e5/9 and e6/9) to our ISP. We use eBGP peering the two interfaces with the ISP. We tried to implement an iACL to deny ssh and snmp ingress traffic from out ISP to the NX7K but after implementing the iACL we experienced an Internet outage. It seems that the implementation of this iACLs broke the BGP peering for some reason. Here's the iACL we implemented:

IP access list DENY_ACCESS

statistics per-entry

10 deny tcp any any eq 22 log

15 deny udp any any eq snmp log

20 permit tcp any any

interface Ethernet5/9

ip access-group DENY_ACCESS in

exit

interface Ethernet6/9

ip access-group DENY_ACCESS in

exit

Can anyone see why this iACL would cause the bgp peering to break?

Thanks in advance.

~zK

BGP shold be using tcp/179

Marvin Rhoads — Wed, 03 May 2017 05:28:29 GMT

BGP should be using tcp/179 and I would expect the neighbor relationship to be unaffected.

I would however change the last line to "20 permit ip any any". Otherwise you will be blocking udp and icmp implicitly.

Thanks, Marvin!

zekebashi — Wed, 03 May 2017 14:31:02 GMT

Thanks, Marvin!

Yes, tcp 179 is allowed in this case and so bgp ingress traffic should be allowed. I'm still puzzled by why bgp was affected by this iAC and still researching to find answer.

I'll change statement "20", good idea!

Thanks, ~zK

Are you sure that BGP was

Richard Burts — Thu, 04 May 2017 15:09:09 GMT

Are you sure that BGP was affected? Based on what you have told us so far your access list would not have allowed DNS packets. And if DNS is not working then your users would report that Internet access is broken. It might feel like there was a routing problem such as BGP not working. But the issue is DNS and not routing.

HTH

Rick

Hi Rick,

zekebashi — Thu, 11 May 2017 18:27:58 GMT

Hi Rick,

Sorry for the delayed response. I honestly don't think that the BGP peering dropped because when I checked the bgp neighbor status the connection status "drop" didn't show that the connection dropped.

I see what you're saying. So, since the ACL is denying udp services, DNS/UDP is being denied and that's why we experienced the Internet outage? Is that an accurate analysis?

Best, ~zK

Yes that is an accurate

Richard Burts — Thu, 11 May 2017 18:36:03 GMT

Yes that is an accurate analysis.

HTH

Rick

Thanks much, Rick!

zekebashi — Thu, 11 May 2017 18:41:15 GMT

Thanks much, Rick!

Best, ~sK

You are welcome. I am glad

Richard Burts — Thu, 11 May 2017 18:48:42 GMT

You are welcome. I am glad that our answers have been helpful.

HTH

Rick