Sam,

This will cause traffic to that /24 to be sent to null0 rather than on the Ethernet interface as it is more specific than the /16 configured on the Ethernet interface.

My question to the original poster would be why not configure the ethernet interface as a /24.

Regards,

Harold,

I stand corrected, but would adding AD 200 to null static route avoid this ?

Sam

Sam,

No. The AD would only come into play for two routes with the same prefix length.

Regards,

Harold,

Thanks for pointing this out, I missed one of the basic routing rules.

I am back to the drawing board.

Regards

Sam

Wow, seven replys, you people must love BGP.

To answer the question about why a 16 bit mask.

We have servers that are using the SVI on the switch that this router is connected to and the SVI is 16 bit mask.

The servers are 10.10.50.0/16, the SVI is 10.10.10.254/16.

There is also a bridged connection to our DR side using this subnet.

Was it determined that I could not use the null route and if not then this will work?:

ip prefix-list abc permit 10.10.0.0/16 le 24

Wilson,

Configuring the /24 static route to null0 will definitely not work.

Why couldn't you just advertise the /16?

Regards,

It's cos you started a good thread !

no, Null0 not only wont work, but it woudl cause an outage. Apologies for misinfo.

The challenge here is to create a longer prefix ( /24) without affecting ur setup.

2 options:

1-why not advertise the whole /16 and block subnet you wish to secure.

2-"a shot from the hip"...are you able to split /16 and use secondary IP addresses under ethernet. so you create one line for teh /24 you need and few more using summarization to cover the remaining part of /16.

I hope there will be more input from other Netpros regarding option 2

Cause an outage huh, is that bad? It sounds kind of bad.

I could advertise the whole 16 bit mask, it just seemed to be better not to.

In reality, I will only be receiving SIP and RTP traffic from Verizon's SBC router, so I should be able to clamp it down pretty well.

I appreciate all the replys.

What about "redistribute connected", will this do the same thing as adding the "network" statement under BGP?

Wilson,

Another way would be to have the following configuration, which is kind of a hack.

interface Ethernet0/0

ip address 10.10.10.253 255.255.255.0 secondary

ip address 10.10.10.254 255.255.0.0

This way you could have a network statement for the /24 and it would be advertised as such.

I still prefer advertising the entire /16 though.

Regards,

Thanks hritter,

What about "redistribute connected", will this do the same thing as adding the "network" statement under BGP?

Wilson,

"redistribute connected" without any filter would redistribute all of the connected subnets on the box. I generally prefer to use the network statement in a case where you only have that one specific subnet to advertise.

Regards,