BGP TTL security & TTL expiry attack mitigation query

[mvsheik123]

Hi,

On our perimeter routers with eBGP peering, we have ttl-security (1) enabled. Now, we are planning to enable TTL expiry attack mitigation related config on the ACL (with ttl <6 deny). My understanding is this config should not break eBGP connections  (ttl-security 1 sets ttl to 254) but wanted to check with experts here.

Thank you in advance ,

MS

[John Blakley · Accepted solution]

Your session should stay up. After applying the config, do a "show ip bgp neigh | inc Minimum" and you should see the minimum ttl allowed.

HTH,

John