It’s nice to be able to hide the MPLS cloud with “/mpls set propagate-ttl=no”, but it’s also nice to be able to use traceroute for trouble shooting the cloud. At the moment, TTL propagation is basically an all-or-nothing decision, but it would be nice if it were a bit more flexible.
What I envision is be a system whereby packets involving an IP address outside my network (as either source or destination) would not have it’s TTL propagated (thus hiding the cloud), while packets that have both source and destination within my network would have their TTLs propagated. If it were flexible enough, arbitrary criteria could be used.
I can imagine this as being implemented in something like /ip firewall mangle, somewhat like this:
/ip firewall mangle add chain=ENTERING-MPLS src-address-list=MY-IPS dst-address-list=MY-IPS action=PROPAGATE-TTL passthrough=no
/ip firewall mangle add chain=ENTERING-MPLS action=DO-NOT-PROPAGATE-TTL passthrough=no
/ip firewall mangle add chain=EXITING-MPLS src-address-list=MY-IPS dst-address-list=MY-IPS action=PROPAGATE-TTL passthrough=no
/ip firewall mangle add chain=EXITING-MPLS action=DO-NOT-PROPAGATE-TTL passthrough=no
Just a thought,
–Eric