March 2021 - NANOG - lists.nanog.org

CGNAT
by Steve Saner 06 Apr '21

06 Apr '21

We are starting to look at CGNAT solutions. The primary motivation at the moment is to extend current IPv4 resources, but IPv6 migration is also a factor. We've been in touch with A10. Just wondering if there are some alternative vendors that anyone would recommend. We'd probably be looking at a solution to support 5k to 15k customers and bandwidth up to around 30-40 gig as a starting point. A solution that is as transparent to user experience as possible is a priority. Thanks -- Steve Saner ideatek HUMAN AT OUR VERY FIBER This email transmission, and any documents, files or previous email messages attached to it may contain confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you are not, or believe you may not be, the intended recipient, please advise the sender immediately by return email or by calling 620.543.5026. Then take all steps necessary to permanently delete the email and all attachments from your computer system.

11 28

RouteViews is looking for host at AMS-IX
by David Teach 31 Mar '21

31 Mar '21

Hi NANOG, Without going into too much detail, RouteViews is looking for a new host at AMS-IX. Our current host has made a considerable effort to keep our collector connected, but has be unable to find a suitable long term solution with AMS-IX. If you would like to help, and have VM resources capable of hosting a linux VM at AMS-IX, please contact me off list. Thanks, - David

1 0

NANOG 82 and NANOG 83 Announcements
by NANOG News 30 Mar '21

30 Mar '21

NANOG 82 To ensure our community's safety and well-being, the NANOG Board and Staff have determined that the in-person component of NANOG 82 will not be possible. Instead, we will hold a virtual meeting on June 14-16, 2021. Additional information about meeting registration will be forthcoming. The Program Committee is actively seeking talk proposals for the NANOG 82 virtual meeting and welcomes anyone interested in sharing their experiences, ideas, or the latest technologies with the greater NANOG community to submit a virtual presentation proposal by Monday, April 12, 2021. NANOG 83 Looking ahead to the NANOG 83 meeting later this year, we are excited to announce that NANOG 83 is being planned as our first hybrid meeting; we are planning an in-person meeting for those who can travel combined with a robust virtual experience. Unfortunately, due to circumstances related to the pandemic, please be aware that the date and location will be different from what was previously planned. We anticipate that the in-person meeting will be in Minneapolis, Minnesota, November 1-3, 2021. The meeting schedule will include a delayed start time to accommodate travel for those with Halloween-related plans. The ARIN conference will be held in conjunction with NANOG at the same location on November 4-5, 2021. Information related to COVID-19 changes frequently, please recognize we may have to change our plans for NANOG 83. Likewise, it is difficult to predict what preventative requirements will be in place at the meeting time. Please know that we will continue to closely monitor CDC guidelines and will share information as we get closer to the event. The safety of our community continues to be our top priority. Please contact us with any additional questions or concerns at any time: nanog-support(a)nanog.org Sincerely, The NANOG Board of Directors + Staff

1 0

Akamai IP Block Issues
by Matt Corallo 30 Mar '21

30 Mar '21

If anyone has a good contact at Akami, please reach out off-list. We are getting Akamai Access Denied errors on eyeballs trying to schedule COVID-19 appointment slots like the below: Access Denied You don't have permission to access "http://www.walgreens.com/findcare/vaccination/covid-19/location-screening" on this server. Reference #18.47be1cb8.1617112737.3f58747 Thanks, Matt

2 1

internet futures
by Randy Bush 30 Mar '21

30 Mar '21

in 2010, the internet society made some videos on possible internet futures ten years out, i.e. nowish. nothing spot on, but themes can be seen for sure. https://www.youtube.com/watch?v=PB4zfGwctGc randy --- randy(a)psg.com `gpg --locate-external-keys --auto-key-locate wkd randy(a)psg.com` signatures are back, thanks to dmarc header butchery

22 40

MS Teams orig/term carrier?
by Adam Thompson 30 Mar '21

30 Mar '21

Despite having worked for an ILEC in network ops for 10yrs, I can't figure out how to answer this without an SS7 sniffer (which I obviously no longer have, nor access to an SSP or SCP). What 3rd-party carrier(s), if any, does Microsoft use to originate & terminate MS Teams-to-PSTN voice calls in Canada? Pointers to rabbit holes welcome, if you think there’s an actual answer at the end ;-). Thanks, -Adam Adam Thompson Consultant, Infrastructure Services [[MERLIN LOGO]]<https://www.merlin.mb.ca/> 100 - 135 Innovation Drive Winnipeg, MB, R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) athompson(a)merlin.mb.ca<mailto:athompson@merlin.mb.ca> www.merlin.mb.ca<http://www.merlin.mb.ca/>

2 1

Infinera GenericTom Enable?
by Nick Bogle 28 Mar '21

28 Mar '21

NANOG, I’ve got Infinera Cloud Xpress’s on two of our DCI’s that I’m trying to get 3rd party optics working in.. I notice there is a CLI structure of "feature GenericTom enable <Pwd>", but the command doesn’t do anything without supplying a password, and I’ve tried a bunch of generic passwords and get invalid password every time. Does anyone know this password or any way to get 3rd party optics working on these boxes? otn02.spknwa(config)# feature GenericTom enable ? Possible completions: <pwd> Enable 3rd party TOM Any help would be appreciated, thanks! -- Nick Bogle Network Engineering Manager (509) 464-6942 | https://ptera.com/

1 0

IP reputation lookup (prefix not single IP)
by vom513 27 Mar '21

27 Mar '21

Hello all, I’ve seen other folks asking the same/similar question in the past, but I don’t recall seeing more than a few options out there to *try* to suss this out. Use case is someone I’m working with looking to buy a v4 block from a broker. So far I’ve checked Talos and Sorbs (both allow a prefix lookup). Most of the other RBL/multi-RBL sites want a single IP (the use case being email of course). I won’t abuse their service by trying to lookup each single IP in the block... Could anyone share anything/anywhere else I might look to get crumbs of info on a given preifx ? Thanks.

9 10

Best practice for ptp/loopback numbering for "small" enterprise multihome setup
by vom513 26 Mar '21

26 Mar '21

Hello, tl;dr - If I only have a /24 PI - is there any way to use this and not “chop it up / deagg” to use for ptp/loopbacks ? Hopefully I can explain this in a manner that makes sense. Say I have a vanilla dual router/dual upstream setup (think enterprise internet edge). It’s basically an “H” shape: - Two ISPs - Two routers (“crosslink” is the middle of the H - iBGP) - Each router has at least a link downstream into my public “outside” segment. I run an FHRP here. This is where my DMZ firewalls, VPN endpoints etc. have their outside interfaces. Let’s also say I only have a /24 of PI. I need to number the crosslink and the loopbacks. The upstreams will use their own /30 / /31 let’s say for the top of the H. My downstream interfaces will have my /24 (or parts of it) on the bottom of the H. My understanding and instinct is that at least the crosslink should be numbered with public addresses. One scenario where this might matter is if router2 loses his inside interface (ex: switch failure) - he still needs to be able to deliver traffic via crosslink via router1 and onward downstream. When this traffic traverses here, if there is any kind of error (i.e. router is sourcing an ICMP packet of some kind) - this will be sourced from router1’s crosslink yes (assuming router1 is generating the error of course) ? Loopback’s may be negotiable, as only router1/2 are using these to pin up iBGP. Nevertheless, my instinct would be to also use public addresses here. As I said in the tl;dr - my main point of contention here is breaking up my /24 I.e. use the very top /30s / /31s for ptp/loop. I would then have at most the bottom /25 to use contig. on my “lan” - and I would need to use the next /26, /27 and so on in some manner for the space to be useable... Here are some other options, and my understanding of the pros/cons: - Use RFC1918 Makes my eye twitch out of the gate. Not to mention packets sourced from here *should* get blocked by my upstreams by way of uRPF. Likely to be filtered at other points and directions as well… - Get a /29 from one of the ISPs for ptp/loops Better than RFC1918. Kind of weird. If this is from isp1 - should have no issues sourcing toward them. Might have issues (uRPF) toward isp2. Announce this via BGP / no-export to both ISPs ? Now it’s getting even weirder… - Use my own PI space Should have no filtering issues at all. Now I have to deagg my /24 and use the pieces (largest /25). Am I making too big of a deal of this ? If you’ve read this far - I do appreciate it. Anxious to hear feedback on this. PS: I would likely ACL on my upstream interfaces to block direct packets to my routers themselves as well.

6 11

RE: Google IP Geolocation
by Michael K. Spears 26 Mar '21

26 Mar '21

Sweet, that’s massively helpful. I just found the link to request access to the Google ISP portal. Thank you, Michael K. Spears From: Brendan Halley <brendan(a)halley.net.au> Sent: Friday, March 26, 2021 6:18 PM To: Michael K. Spears <michael(a)spears.io> Subject: Re: Google IP Geolocation Hey, Google ISP portal is your best bet. Can do it self service. Another way is to get a few Android devices onto the IP range. Google use them heavily for working out Geo. Brendan On Sat, 27 Mar 2021, 9:14 am Michael K. Spears, <michael(a)spears.io<mailto:michael@spears.io>> wrote: Anyone have a good contact at Google who can help with IP geolocation? I have a /24 where anything related to Google is in the wrong language. Thank you, Michael K. Spears

1 0