Null Route
An alternative to access lists is the null route command. This is actually a static route that directs packets to the null interface. The null interface, also known as the bit bucket, simply drops packets instead of forwarding them to the next hop.
Using this command has a number of advantages. The first is that very few CPU cycles are required to implement this method. Unlike an access list, which can consume an unacceptable number of CPU cycles, using the null route command consumes no more cycles than any other static route. The next advantage is that a single entry can be used to control access to both inbound and outbound packets. The third advantage is that a null route can be redistributed, and therefore, a single entry can drop data destined for any given network as soon as that data attempts to traverse a router.
A drawback to using the null route command for security purposes is that using it does not prevent packets originating at the designated network from entering your company's network. However, responses destined to the designated network are dropped.
A null route is entered as a static route with the next-hop router entered as null. For example, if you wish to deny access to the 184.15.10.0/24 network, use the following:
ip route 184.15.10.0 255.255.255.0 null 0
This forwards all packets destined for the 184.15.10.0/24 network to the null bit bucket. In other words, the router throws away all packets destined for this network. Redistributing this static route allows all routers on the network to drop these packets.
Look at Figure 5-4 to see an example of how a null route operates. After the null route is added to a single router and redistributed, all routers know to throw away packets destined for the 184.15.10.0/24 network. This method prevents wasting bandwidth within the network for packages that are ultimately destined to be dropped.
Figure 5-4. Null Route with Redistribution
Figure 5-4. Null Route with Redistribution
In the Figure5-4 example, if Host A tries to send information to the 182.15.10.0/24 network, the first router drops this packet. Likewise, if Host B tries to send data to the 182.15.10.0/24 network, the first router drops the packet.
Post a comment