May 1998 - NANOG - lists.nanog.org

RE: CiscoSecure NT vs CS UNIX
by jeyers＠ialn.com 08 May '98

08 May '98

Depends on the size of your network. "Scaleability and stability" and NT rarely go together... Jerry > -----Original Message----- > From: Martin, Christian [SMTP:CMartin@mercury.balink.com] > Sent: Thursday, May 07, 1998 8:48 PM > To: 'nanog(a)merit.edu' > Subject: CiscoSecure NT vs CS UNIX > > All Ye NANOG readers, > > Does anyone use CiscoSecure ACS for NT to control router access? If > so, > has anyone used the UNIX one and done a comparison? I need to > evaluate > these tools as a replacement for the TACACS+ daemon available from > Cisco. Any info would be appreciated, particularly scalability and > stability. > > Regards, > Christian

1 0

Re: Core router bakeoff?
by kbrown＠primelink.com 08 May '98

08 May '98

In working on a project for Sprint on which we were dealing with Max 4004's dropping the PRIs and failing to cycle them in the event of a line failure... they asked for an Ascend technician to come on-site, as I am not nearly as well versed in Ascend boxes. The Ascend support center flat out said they don't have technicians to send out on-site and that standard protocol is to call an IBM SE to come out. If this doesn't say enough about their support structure...nothing does. Personally...they fail. Especially since my company IS an IBM Business Partner and I work with 2210 routers daily... "Jason L. Weisberger" <jweis(a)softaware.com> on 05/07/98 08:45:46 PM To: Karl Denninger <karl(a)mcs.net> cc: nanog(a)merit.edu (bcc: Kevin Brown/Huber & Associates) Subject: Re: Core router bakeoff? On Thu, 7 May 1998, Karl Denninger wrote: > Well, the GRF has its good and bad points. I've tested one rather > extensively, although I admit it was some time (~8-9 months) ago. I've been rather upset with Ascend over their lack of reaction to the bug in the Pipe 150 that had it publishing ARP statments for every ip address that went by its ethernet interface. Have you found their other products to be better supported and safer to fire and forget? jlw -- Jason Weisberger Chief Technology Officer SoftAware, Inc. - 310/305-0275 "Let us cross over the river, and rest under the shade of the trees." -Thomas Jonathan "Stonewall" Jackson Kevin Brown - Networking Technologies kbrown(a)primelink.com Huber & Associates, Inc. http://www.primelink.com/haa 573-634-5000 (phone) 573-634-5500 (fax)

1 0

CiscoSecure NT vs CS UNIX
by Martin, Christian 08 May '98

08 May '98

All Ye NANOG readers, Does anyone use CiscoSecure ACS for NT to control router access? If so, has anyone used the UNIX one and done a comparison? I need to evaluate these tools as a replacement for the TACACS+ daemon available from Cisco. Any info would be appreciated, particularly scalability and stability. Regards, Christian

1 0

Re: Core router bakeoff?
by agirsch＠OASysGroup.com 07 May '98

07 May '98

> > They just released some announcement that major companies and campuses are > > using their equipment for new backbones. > > That sounds like salesspeak. I've used lots of cabletron hubs and such > over the years, but they never seemed to have real routers. They just released in Las Vegas their new line of "SmartSwitch Routers" ... I recently read an independant comparison, and they were "faster" than Cisco. I don't know about reliability, functionalities, etc ... I haven't had much experience with these. Arnaud. -- Arnaud C. Girsch -+- The OASys Group, Inc. agirsch(a)OASysGroup.com -+- Tel: 408-872-0203 Fax: 408-872-0210 - Saratoga, CA

1 0

Re: Core router bakeoff?
by Randy Bush 07 May '98

07 May '98

> Wait.. a Bay BCN will push 1 Gb/s through the box, problem is to WHERE they will push those bits. yes, bay makes nice hardware. unfortunately, routers are really software. and real routers move a bunch of that software to asics. randy

1 0

Re: NANOG 13 Logistics Update
by Howard C. Berkowitz 07 May '98

07 May '98

DHCP - you bet. Interstingly enough, there was a recommendation at one point to have DHCP address assignment free, but charge $3 for a piece of paper with a static IP address. Then someone else suggested a competitive market model was needed, with multiple static-IP-address-on-paper vendors to allow the market to produce the most efficient paper static address producers. A fraction of the $3/address would then go into an allocation fund. This allocation fund (until congress gets involved) would be then be used to lower the cost of cookies at NANOG. Bill At 04:07 PM 5/7/98 -0400, Paul Ferguson wrote: >At 03:18 PM 5/7/98 -0400, William B. Norton wrote: > >> >>Connectivity at NANOG 13 >>------------------------ >>Bring your laptops and cables! We will have over 400 ports available plus >>wireless connectivity including 40 wired tables. If you need to configure >>your firewalls in advance... >> What lookup algorithm do the tables use? Cisco's new trie? If a hash, corned beef, roast beef, red flannel, or what? As to Jamie Rishaw's comment, >Please fill out the isp-ip-cookie-template.txt located at http://rs.arnc.net. >The American Registry for Nanog Cookies is a non-profit organization. > >from http://rs.arnc.net/feeschedule.html : >Your Cookie Fee will be based on the total allocation of cookies received >at the previous NANOG. Users receiving cookies for the first time will be >charged a fee based on the number of chocolate chips in your initial cookie. >The cookie allocation fee will include inverse addressing (toilet-paper) >service, updates and maintenance. Are we having a problem of competitive registries for NANOG cookies, magic cookies, and browser cookies?

1 0

Re: NANOG 13 Logistics Update
by William B. Norton 07 May '98

07 May '98

DHCP - you bet. Interstingly enough, there was a recommendation at one point to have DHCP address assignment free, but charge $3 for a piece of paper with a static IP address. Then someone else suggested a competitive market model was needed, with multiple static-IP-address-on-paper vendors to allow the market to produce the most efficient paper static address producers. A fraction of the $3/address would then go into an allocation fund. This allocation fund (until congress gets involved) would be then be used to lower the cost of cookies at NANOG. Bill At 04:07 PM 5/7/98 -0400, Paul Ferguson wrote: >At 03:18 PM 5/7/98 -0400, William B. Norton wrote: > >> >>Connectivity at NANOG 13 >>------------------------ >>Bring your laptops and cables! We will have over 400 ports available plus >>wireless connectivity including 40 wired tables. If you need to configure >>your firewalls in advance... >> >>Address space: 207.75.182.0-207.75.183.0 >> >>We will also have a small number of PCs running a flavor of unix in a >>terminal room down the hall. >> >>We will have IPv6 connectivity, IPv6 DNS, and a Squid web cache server on >>site. >> > >DHCP? > >- paul > > > -------------------------------------------------------------- William B. Norton <wbn(a)merit.edu> (734) 764-9430 (New Area Code)

5 4

NANOG 13 Logistics Update
by William B. Norton 07 May '98

07 May '98

Hi all - Bunch of logistics information about the upcoming NANOG in Dearborn... NANOG 13 Agenda --------------- As usual, we have a very full agenda. See: http://www.nanog.org/mtg-9806/topics.html for details. I'd like to especially point out that we are starting the tutorials early this time. We have a Sunday early afternoon tutorial "Introduction to RPSL" (Cengiz Alaettinoglu, ISI, Curtis Villamizar, ANS ). In addition, we will be going all the way up to 4PMish on Tuesday, so book your flights accordingly. NANOG Registration ------------------ We will be cutting off registration at 500 again. Please register at: http://www.nanog.org If you are using NorthWest airlines, note that the NW machinists contract negotiation difficulties have resulted in a work slowdown, causing occasional flight delays and cancellations. You may want to take this into account scheduling your flights - one strategy is to fly in on Saturday AM and return Tuesday AM. Hotel Room Block Extended until May 15th ---------------------------------------- The NANOG hotel block reservation has been extended until May 15th, after which time the hotel room cost will rise from the NANOG rate of $125/night to the normal rate of $165/night. Make your reservations directly with the Hyatt, mentioning the NANOG meeting: Hyatt Regency Dearborn Hotel Fairlane Town Center Dearborn MI 48126-2793 Telephone: 1 313 593 1234 Sales Fax: 1 313 593 3366 If you run into problems, contact Pam Ciesla (Merit) at 734-936-0172 or e-mail her at pam(a)merit.edu. Connectivity at NANOG 13 ------------------------ Bring your laptops and cables! We will have over 400 ports available plus wireless connectivity including 40 wired tables. If you need to configure your firewalls in advance... Address space: 207.75.182.0-207.75.183.0 We will also have a small number of PCs running a flavor of unix in a terminal room down the hall. We will have IPv6 connectivity, IPv6 DNS, and a Squid web cache server on site. For those who can not attend, the meeting will be cast over both the Real Broadcast Network (RBN) as well as to the MBone for those that use vic/vat. RBN has graciously agreed to store the meeting on disk for later on-demand replay as well. We will ask the speakers provide web pointers in advance and link them into the agenda for those attending remotely (the camera shots of the screens never work well). Looking for Monday Evening BOFs ------------------------------- We have 3 rooms and the main ballroom Monday evening to use, so we are looking for Birds-of-a-Feather session proposals from folks. If you want to suggest a BOF or lead one, please send me a paragraph or so describing the BOF and the audience. These can be groups of interest, coordination discussions, emerging technology discussions. If possible, list members of the community that share an interest in airing the topic. There will be a preference for BOFs which have not been done at NANOG in the past. The only stipulation for these BOFs is that these *must not* be commercial product/service promotions. Fair warning: The community will respond very harshly to blatant commercial pitches. T-Shirts Welcome ---------------- While we do walk a fine line on the commercial influences at NANOG, noone has ever complained about free T-shirts at NANOG! To this end, if your company would like to ship boxes of T-shirts to the meeting, there should be no shortage of takers! If you are interested, send me e-mail (wbn(a)merit.edu) Beer-n-Gear Monday Evening -------------------------- Aptis, Bay and Cisco have graciously sponsored the beer-n-gear event Monday evening, immediately following the meeting. The kegs will be tapped around 5PM, dig into thousands of dollars worth of overpriced hotel food, and enjoy some lively technical discussions over some of the latest gear. (My experience is that these discussions get only livelier with the addition of beer ;-) ) Sponsorships ------------ The NANOG counts on the support of the community for everything from agenda topics to loaner equipment and event sponsorship. We would like to thank the following companies for their commitments to NANOG: +Bay Networks for providing the room connectivity. We will have dozens of hubs for over 400 wired ethernet ports for this meeting! +RBN for casting the meeting and providing storage and reply facilities +Cisco for providing the hardware and staff to cast the meeting on the MBone +University of Michigan Information technology Division for providing PCs for the terminal room +Aptis, Bay, and Cisco for participating in the Beer-n-Gear event +Cabletron for providing Wireless transceivers and a handful of loaner PCMCIA cards +MichNet for providing transit connectivity to the Hyatt Dearborn While the beer-n-gear event is currently full, we are still looking for companies to sponsor (or co-sponsor) breaks, breakfasts, or lunches for the meeting. If you would like more information, please send e-mail to me (wbn(a)merit.edu) with "NANOG 13 SPONSORSHIP" in the subject line or call (734-764-9430). Want to help set up equipment Sunday Morning? --------------------------------------------- If you are around Sunday morning and want something to do, help us set up routers and hubs, run wires, set up the terminal room, etc. Stop down to the Hubbard Ballroom and lend a hand - we have lots to set up in just a few morning hours, so we could really use the help! That's all I have. Cheers - Bill -------------------------------------------------------------- William B. Norton <wbn(a)merit.edu> (734) 764-9430 (New Area Code)

2 1

Latest Cisco IOS release with Version 5 flow export?
by dougd＠mail.airmail.net 07 May '98

07 May '98

Okay the cisco people haven't answered this in three days. *sigh* Does anyone know what the latest version of Enterprise IOS to support exporting Version 5 flow export data? i.e. the `ip flow-export version` command The one I am running is 11.1(18)CA and there is a bug in it which I need to upgrade out of. The 11.3 code they want us to go to only exports version 1 code. (or they've moved the command somewhere else) If you private email the answer to me I will summarize to the list.

2 1

Re: BGP & CIDR blocks
by Sean Donelan 07 May '98

07 May '98

> A bit of sanity..Prefix based filtering != not caring about your >backbone. Quite the reverse. As far as trusting bgp goes, most times you >can, sometimes you can't. Prefix filtering is for the times you >can't. Everybody remembers that those times happen, right? I remember, although it is getting to be a problem with each provider having a 'not invented here' syndrome. I give Sprint a list of our prefixes in one format, MCI a list of our prefixes in another format. I'm not a big fan of centralized storage, since whois.ra.net WHOIS server doesn't seem to be responding tonight. But it would be nice if I could generate the information once, and let all the providers use it.... Gosh, I wonder what that could be. > If your AS is in an appropriate (your upstream providers) autnum, >and the route object for the prefix is in the <pick the registry of your >choice> things work without a phone call. When they don't work, our noc >does a good job of helping to figure out what the problem is and getting >it fixed.. That exception is the process Jon is in. Exactly how this works hasn't been very clear to an outsider. I've had customers with their own AS number, who moved from one provider to another provider. I added their ASN to our AS-MACRO in the RADB and announced their AS and network prefixes. When their first provider stopped announcing the AS, the customer couldn't reach ANS. A call to the ANS NOC received a response in addition to updating the RADB we were supposed to send ANS a seperate message telling you the AS number was now being announced by our network (as indicated by the AS-MACRO). New network prefixes, and new AS numbers seem to get in Ok. But moving AS numbers still seems to be a special case. I can understand why, but it would be nice if there was some way you could let other ISPs know what the special cases are, so we don't get surprised. If this is not the case, I know I'm not alone in appreciating knowing when or not we have to send ANS a seperate note for AS number policy changes. On a related subject, is there any concern about cleaning obsolete objects out of the various routing registries? Information entropy seems out of control in most of these registries. It looks like they could use a good dose of authority control and weeding. If you aren't a library cataloger I suspect you've never heard of it. Or should we just declare the registry databases a failed experiment, and leave them as trash dumps for the archalogists to dig through. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2