This is obviously better then nothing, and probably the most practical
solution, but most networks have holes in their allocated blocks.
Wouldn't some sort of authentication scheme (RADIUS/TACACS
or maybe Kerbros) be a better solution? More complicated for sure.
The idea would be to check the connection request to the outgoing router
against some sort of database, then expiring the token after it's use. The
real trick to this is checking only the initial request. Something more in the
realm of switching authentication...
Anyone have any ideas how something as large as a class B with say 30% address
utilization on scattered addresses (non-contigeous) could be rapidly verified
without checking every packet?
Thanks for your indulgance,
Chris Cook
Network Engineer