Security concern in configuring dynamic Routing protocol on Firewall

[yogendra.trivedi]

Hi,

I've always read we should not configure dynamic routing protocols on Firewall. Why?

We can control routing updates using route filters and allow what updates should be allowed bet rouer/fw then what is the harm in configuring it.?

Can someone please justify with links to best practices for it from cisco/SANS etc.

reg.

YT

[#2]

Static routing provides the best security. Because If malicious / incorrect routing updates are injected into the PIX, then that

can affect overall operation of the PIX

[yogendra.trivedi]

Agree with your reply and that is waht we have always followed for, But can you point me to some links on cisco/SANS site where this info is documented.

Reg.

YT