Ingress filtering on edge routers and performance concerns

Question

The RFC 4778 cover the Operational Security Practices in ISPs Environments back on 2007.

Among the best practices, a common one is Ingress Filtering on edge routers. In the above RFC, the author says the following:

Lack of consistency regarding the ability to filter, especially with respect to performance issues, cause some ISPs not to implement BCP38 and BCP84 guidelines for ingress filtering. One such example is at edge boxes, where up to 1000 T1s connecting into a router with an OC-12 (Optical Carrier) uplink. Some deployed devices experience a large performance impact with filtering, which is unacceptable for passing customer traffic through, though ingress filtering (uRPF) might be applicable at the devices that are connecting these aggregation routers. Where performance is not an issue, the ISPs make a tradeoff between management versus risk.

Is the impact on performance nowadays a concern among network operators to not deploy ingress filtering on their networks? Is there anything else to worry about? Can you provide some kind of evidence to support your argument?

Thank you all for the answers.

Answer 1

A lot depends on the particular router model. Most newer, high performance routers can filter in hardware - meaning they can filter at line rate. So there's no performance impact. But a lot of ISPs (and other places too) use older equipment (even from 2007) because "why change if it works?"

For management risk, every ISP decides, consciously or unconsciously, how much risk is involved in maintaining those access lists -- how often they need to change, how they test, what is the impact of making a mistake, etc.