This message was deleted.
# citrix-netscalers
Slackbot
04/02/2021, 3:08 PMThis message was deleted.
n
Neal Dolson
04/02/2021, 3:10 PMAs opposed to adding a static route to the entire subnet like 10.10.10.0 255.255.255.0 when I only need to reach one IP in it, is there any reason not to just do a route to the /32 IP like 10.10.10.100 255.255.255.255 and specify the next hop of the gateway for one of my internal directly connected networks?
Neal Dolson
04/02/2021, 3:11 PMOr use a PBR that allows me to specify the single destination IP and also a single TCP port that would be used on that backend server?
Neal Dolson
04/02/2021, 3:13 PMJust looking at it from a “limiting the blast zone of a theoretical compromise” perspective. Anything not matching the pretty specific static route or PBR would just black hole to the DMZ.
Neal Dolson
04/02/2021, 3:14 PMObviously it’s aways a balance of security and complexity, but granularity defined routes seems pretty straight forward
s
Steven Lemonier
04/02/2021, 5:15 PMIn a similar situation, we went static route for /32 IP. FW rules did the security part.
👍 1
2 Views