Configure the perimeter to block inbound packets with Bogon source addresses.
Step 1: Configure an ACL containing the current Bogon prefixes as shown below:
SW1(config)#ip access-list extended FILTER_PERIMETER
SW1(config-ext-nacl)#deny ip 0.0.0.0 0.255.255.255 any log-inputSW1(config-ext-nacl)#deny ip 10.0.0.0 0.255.255.255 any log-input
SW1(config-ext-nacl)#deny ip 100.64.0.0 0.63.255.255 any log-input
SW1(config-ext-nacl)#deny ip 127.0.0.0 0.255.255.255 any log-input
SW1(config-ext-nacl)#deny ip 169.254.0.0 0.0.255.255 any log-input
SW1(config-ext-nacl)#deny ip 172.16.0.0 0.15.255.255 any log-input
SW1(config-ext-nacl)#deny ip 192.0.0.0 0.0.0.255 any log-input
SW1(config-ext-nacl)#deny ip 192.0.2.0 0.0.0.255 any log-input
SW1(config-ext-nacl)#deny ip 192.168.0.0 0.0.255.255 any log-input
SW1(config-ext-nacl)#deny ip 198.18.0.0 0.1.255.255 any log-input
SW1(config-ext-nacl)#deny ip 198.51.100.0 0.0.0.255 any log-input
SW1(config-ext-nacl)#deny ip 203.0.113.0 0.0.0.255 any log-input
SW1(config-ext-nacl)#deny ip 224.0.0.0 31.255.255.255 any log-input
SW1(config-ext-nacl)#deny ip 240.0.0.0 15.255.255.255 any log-input
SW1(config-ext-nacl)#permit tcp any any established
SW1(config-ext-nacl)#permit tcp host x.12.1.9 host x.12.1.10 eq bgp
SW1(config-ext-nacl)#permit tcp host x.12.1.9 eq bgp host x.12.1.10
SW1(config-ext-nacl)#permit icmp host x.12.1.9 host x.12.1.10 echo
SW1(config-ext-nacl)#permit icmp host x.12.1.9 host x.12.1.10 echo-reply
…
…
…
SW1(config-ext-nacl)#deny ip any any log-input
SW1(config-ext-nacl)#end
Step 2: Apply the ACL inbound on all external interfaces.
SW1(config)#int g0/0
SW1(config-if)#ip access-group FILTER_PERIMETER in
SW1(config-if)#end