January 2005 - NANOG - lists.nanog.org

RE: Proper authentication model
by Hannigan, Martin 13 Jan '05

13 Jan '05

> -----Original Message----- > From: Joe Abley [mailto:jabley@isc.org] > Sent: Wednesday, January 12, 2005 10:55 AM > To: Hannigan, Martin > Cc: NANOG list > Subject: Re: Proper authentication model > > > > On 12 Jan 2005, at 10:16, Hannigan, Martin wrote: > > > If you have 3 sites and they're interconnected via an OC3 > > and the internet, you would also have 2 frame or ppp circuits > > seperately connecting the terminal server network. You'd do the > > different path, different provider, etc. on these circuits. > > You mean you'd *request* a different path from different providers. Provisioning a circuit from two different ^providers^, other than your OC3 provider. Of course, you need to have at least 3 unique carriers in the facility, but most do. This is not so easy at the enterprise level. I'd add the caveat that this only works if you have diversified entrance facilities and follow bellcore standards for central offices when you design and implement your facilities. For example, Level3 and Internap. -M<

5 4

answered: /24 route propagation, how long is reasonable?
by Michael Airhart 13 Jan '05

13 Jan '05

Thanks for the private responses I received! Turns out it was a AS append problem... Michael ---- Quick question for the group.. How long should I be patient to wait for some /24s to become fully routable worldwide? None of the addresses are mine, they came from the upstream (only one provider) They are all part of the upstreams IP space, and I had assumed that they would have kept them as part of a larger block and just blackholed into their network.. Instead it seems that route filters had to be propagated WW before the traffic would leave a given AS.. I can reach the nets now (after the first day) from most of the ASs out there, as seen from traceroute.org... But, as my luck would have it, the two nets that I connect from can't get there (die at the handoff to the next AS). I have confirmed this from other people on a few other ASs as well. It has been two days now.. I don't want to be one of those PITA customers you guys get tired of, but I have work to get done.. How long should I sit on my hands? Note: I would post the /24s, but I don't want to call negative attention to a SP that might be doing his/her job just fine and I just have unrealistic expectations.. Thanks in advance! Michael

1 0

FW: AlterPoint Mail Security detected prohibited content in a message sent from your address (SYM:42361956180980318002)
by Steven Champeon 13 Jan '05

13 Jan '05

Why content filtering is stupid: ----- Forwarded message from it-alerts(a)alterpoint.com ----- X-Delivered-To: <schampeo(a)hesketh.com> From: <it-alerts(a)alterpoint.com> To: <schampeo(a)hesketh.com> Subject: AlterPoint Mail Security detected prohibited content in a message sent from your address (SYM:42361956180980318002) Date: Wed, 12 Jan 2005 23:12:40 -0600 Subject of the message: Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet) Recipient of the message: "nanog(a)merit.edu" <nanog(a)merit.edu> ----- End forwarded message ----- -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

IBGP Question --- Router Reflector or iBGP Mesh
by Erik Sundberg 13 Jan '05

13 Jan '05

hello, I have a ibgp question? There is a Diagram at http://erik.appscorp.net/bgp/ Which Setup is better, the Router Reflector or the ibgp meshed? What are the positive and negitive to each setup. Which Setup is commonly used / best pratice / More stable Diagram at http://erik.appscorp.net/bgp/ Thanks in Advance Erik

9 14

Re: Proper authentication model
by Hannigan, Martin 13 Jan '05

13 Jan '05

Think methodology, as least amount of failure points, less capex, to protect the sla, real or imagined. Bellcore/Telcordia guidelines for RBOC CO's are very suitable for datacenters/colo. Hybrids. --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: erik(a)office.is.nl <erik(a)office.is.nl> CC: NANOG list <nanog(a)merit.edu> Sent: Wed Jan 12 14:35:21 2005 Subject: RE: Proper authentication model On Wed, 12 Jan 2005, Hannigan, Martin wrote: > Out of band management isn't telnetting from your desktop to > the serial port. > > Mgmt and surveillance is the Bellcore standard for out of band. > It means your M/S is not riding your customer or public networks, and > it's physically seperate. Yes, this is the cadillac method, but the > only way to support five nines IMHO. > > If you have 3 sites and they're interconnected via an OC3 > and the internet, you would also have 2 frame or ppp circuits > seperately connecting the terminal server network. You'd do the > different path, different provider, etc. on these circuits. Recently I've been doing this by tunneling over ADSL circuits from the local telco. At around $60 per month per location with static IP addresses it's cheap. Since the tunnels go between two ADSL lines, they're limited to circuits' 128Kb/s upload speeds, but that's generally ok for management traffic. I've also been connecting bastion hosts to the DSL lines. This way, all that's required to get into the OOB network is Internet connectivity through some other network, rather than having to hunt around for a POTS phone line to plug a modem into in an emergency. Obviously, if you are the local telco this isn't really out of band, but works well for others who aren't sharing the local telco's infrastructure. Is it as secure as having your own diverse-path management network of private point to point circuits? Probably not, but with sufficient firewalling and encryption on the tunnels, it's good enough, and cheap enough that it's possible to talk ISP owners into paying for it. -Steve

1 0

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet)
by Eric Brunner-Williams in Portland Maine 13 Jan '05

13 Jan '05

> Numerous (as in "at least hundreds, probably more") of spam gangs are > purchasing domains and "burning through" them in spam runs. In many > cases, there's a pattern to them; in others, if there's a pattern, > it's not clear to me what it might be. >From my point of view, "pattern" is which registars are getting the buys, for which registries, where the ns's are hosted, and for domains used in the return value side, hosting details. The latter to reduce to RIR CIDRs. There is more, but that is the first cut, localization of registrar(s) and registries and CIDRs. > This bunch prefers domains in .info -- no doubt motivated in part by things > like the recent $1.95 sale on such domains. OK. Now you've identified price as a significant control variable. There are registrars that don't sell .info. I don't. There are registars that don't sell to directly to registrants. I can think of half a dozen of us who only sell to corporations and bonafide people who buy reasonable names. Transcendental numbers in decimal character form are "reasonable". Your two example sets are not "reasonable". > The dirty little secret is that all this activity on the part of spammers > is a gold mine for registrars. This isn't going to make me think you can add or subtract. > It's gotten so bad that -- to a darn good first approximation -- if you > find a domain in the .biz or .info TLDs I agree, and don't sell .biz, .info or .name, or .cc or .tv or .bz or any of the obvious repurposed cctlds, with the exception of my friend Bill Semich's .nu, which actually means something in Sweden for local reasons. I do plan to sell .aero, .coop and .museum, however. In case it is inobvious, there is a possibility that part of _your_ problem (and a big part of my problems) can be placed at the figurative "door" of a 501(c)(3) located in California. > The answer? (1) no obfuscated registrations (2) mass, fast, permanent > confiscation of spammer domains (3) requirement for reasonably correct > domain registration info ... and (4) publication of all WHOIS data in > a simple, easily parseable form ... Nothing in this laundry list that makes the cost of bad business for my competitors rise, see add and subtract, above. Try the following: 1,$s/registrars/isp/g and 1,$s/registry/rir/g, and 1,$s/domain/ipv4_addr/. If you're still keen on your approach, then it might be a good one. I've replied after removing your personal identifiers back to NANOG. I appreciate the data, but I want the discourse to be multicast. Eric

2 3

RE: Proper authentication model
by Hannigan, Martin 12 Jan '05

12 Jan '05

> -----Original Message----- > From: Steve Gibbard [mailto:scg@gibbard.org] > Sent: Wednesday, January 12, 2005 5:35 PM > To: Hannigan, Martin > Cc: NANOG list > Subject: RE: Proper authentication model > > > On Wed, 12 Jan 2005, Hannigan, Martin wrote: > [ snip ] > > Obviously, if you are the local telco this isn't really out > of band, but > works well for others who aren't sharing the local telco's > infrastructure. > > Is it as secure as having your own diverse-path management network of > private point to point circuits? Probably not, but with sufficient > firewalling and encryption on the tunnels, it's good enough, and cheap > enough that it's possible to talk ISP owners into paying for it. I don't know if this specifically relates to any local telco, but there are some clear reasons on why to go through the excercise of having a true out-of-band network. I don't disagree that smaller ISP's may not neeed such a thing nor do I suggest that it offers a significant ROI to the smaller guys.

1 0

RE: Proper authentication model
by Hannigan, Martin 12 Jan '05

12 Jan '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Iljitsch van Beijnum > Sent: Wednesday, January 12, 2005 6:25 AM > To: Gernot W. Schmied > Cc: NANOG list > Subject: Re: Proper authentication model > > > > On 12-jan-05, at 11:30, Gernot W. Schmied wrote: > > >> True out of band management networks are very hard to > build and very > >> hard to use, and you run the risk that you can't get at your stuff > >> because the management network is down. > > > IS-IS can be highly recommended for true out of band > management, it is > > reachable when IP goes down the drain entirely. > > To me, true "out of band management" means that the > management traffic > doesn't flow over production links. You are right that IS-IS can > continue to function when IP is confused (although with integrated > IS-IS OSI will probably be just as confused as IP). But IS-IS isn't a > management protocol, of course. :-) Out of band management isn't telnetting from your desktop to the serial port. Mgmt and surveillance is the Bellcore standard for out of band. It means your M/S is not riding your customer or public networks, and it's physically seperate. Yes, this is the cadillac method, but the only way to support five nines IMHO. If you have 3 sites and they're interconnected via an OC3 and the internet, you would also have 2 frame or ppp circuits seperately connecting the terminal server network. You'd do the different path, different provider, etc. on these circuits. The ts' would be connected to the hub. If that failed, or the machine was DOA, serial port. A TS may have a modem at each site for the hail mary connection. > > IPv6 is also very useful in providing non-IPv4 management. I always knew you could get deer meat from a deer.

3 2

New IANA IPv6 allocation for RIPE NCC (2003:0000::/18)
by Doug Barton 12 Jan '05

12 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, This is to inform you that the IANA has allocated the following one (1) IPv6 /18 block to RIPE NCC: 2003:0000::/18 RIPE NCC 12 Jan 05 For a full list of IANA IPv6 allocations please see: <http://www.iana.org/assignments/ipv6-tla-assignments> - -- Doug Barton General Manager, The Internet Assigned Numbers Authority -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFB5aL5wtDPyTesBYwRAm4zAJ9a/3st27eUsCQeD2WKIoL8QVNA5gCfWc9F eHLYn34mS0qj3IhwU2woMLU= =qS1+ -----END PGP SIGNATURE-----

1 0

Contact at Austrian Telecom - urgent
by Steve Birnbaum 12 Jan '05

12 Jan '05

I think I'm seeing a rather massive cut. Does anyone have a direct # for someone with clue for backbone events? Thanks, Steve

3 3