MPLS VPN Security

Summary 43

NOTE Recommendation

Disable mpls ip propagate-ttl from the outside of the MPLS core. The keyword “forwarded”

can be used when the feature is required from within the MPLS core but when it should

not be available from outside the MPLS core.

• Unprotected Internet on core routers—Many MPLS backbones provide Internet

services and VPN services on the same core. By default, if the Internet runs on the

global routing table, the core routers are visible to the Internet and can be seen, for

example, with a traceroute. This enables relatively easy mapping of the core network

from the outside. The recommendation is to block by default access from ...