
Hiding the Core Infrastructure
55
Following these recommendations, the PE will exclusively accept packets on the port for
the routing protocol. This can also be secured, as explained in detail in Chapter 5. Any other
packet destined to the PE will be dropped by the ACLs.
For overall security, of course all of the interfaces into the core need to be considered. Up
to here we have covered the PE-CE interfaces. Another important point to control is the
access to the Internet, and the question is whether an MPLS core or its VPNs can be
attacked from the Internet.
If Internet access is provided in a VRF as if it were just another VPN, then all ...