- NANOG - lists.nanog.org

Re: Network Segmentation Approaches
by Scott Weeks 06 May '15

06 May '15

--- rsk(a)gsp.org wrote: From: Rich Kulawiec <rsk(a)gsp.org> The first rule in every firewall is of course "deny all" and subsequent rulesets permit only the traffic that is necessary. ------------------------------------ I think you got this backward? That way all traffic is blocked, so none is allowed through. Also, deny by default at the end of the rule set is not the best thing for every network that needs a firewall. Some just want to block bad stuff they see and allow everything else. (And some have stated here that they will block entire countries until their culture changes!) scott

3 2

Re: Alcatel-Lucent 7750 Service Router (SR)
by Scott Weeks 06 May '15

06 May '15

--- colton.conor(a)gmail.com wrote: From: Colton Conor <colton.conor(a)gmail.com> Why is ALU never mentioned, but Juniper MX and Cisco are all day long? ----------------------------------------- Because they're really expensive, mostly bell head networks use them and we're mostly bell head free on NANOG... >;-) scott

1 0

Re: Alcatel-Lucent 7750 Service Router (SR)
by Scott Weeks 06 May '15

06 May '15

> On May 6, 2015, at 5:48 PM, Colton Conor <colton.conor(a)gmail.com> wrote: > > I was wondering if anyone was using a > Alcatel-Lucent 7750 Service Router> (SR) > in their network? How does this platform > compare the the Cisco ASR, Brocade MLXe, > and Juniper MX line? --------------------------------- I haven't used them for nearly 5 years now, but at the time they were really good. Likely, they're still the same. Search the NANOG archives, there have been discussions before. Pay attention to the after the sale service stuff in the archives. Also Jared Mauch has a ML for them at puck.nether.net, but it's a really low volume list. ALU engineers hang out there. scott

1 0

Network Segmentation Approaches
by nanog1＠roadrunner.com 06 May '15

06 May '15

Possibly a bit off-topic, but curious how all of you out there segment your networks. Corporate/business users, dependent services, etc. from critical data and/or processes with remote locations thrown in the mix which could be mini-versions of your primary network. There's quite a bit of literature out there on this, so have been considering an approach with zones based on the types of data or processes within them. General thoughts: - "Business Zone" - This would be where workstations live, web browsing occurs, VoIP and authentication services live too. Probably consider this a somewhat "dirty" zone, but I should generally be OK letting anything in this zone talk fairly unfettered to anything else in this zone (for example a business network at my HQ location should be able to talk unfettered to an equivalent network at a remote site). I'd probably have VoIP media servers in this zone, AD, DNS, etc. - Some sort of management zone(z) - Maybe accessible only via jump host -- this zone gives "control" access into key resources (most likely IT resouces like network devices, storage devices, etc.). Should have sound logging/auditing here to establish access patterns outsid the norm and perhaps multi-factor authentication (and of course FW's). - Secure Zone(s) - Important data sets or services can be isolated from untrusted zones here. May need separate services (DNS, AD, etc.) - I should think carefully about where I stick stateful FW's -- especially on my internal networks. Risk of DoS'ing myself is high. Presumably I should never allow *outbound* connectivity from a more secure zone to a less secure zone, and inbound connectivity should be carefully monitored for unusual access patterns. Perhaps some of you have some fairly simple rules of thumb that could be built off of? I'm especially interested to hear how VoIP/RTP traffic is handled between subnets/remote sites within a "Business Zone". I'm loathe to put a FW between these segments as it will put VoIP performance at risk (maybe QoS on FW's can be pretty good), but maybe some sort of passive monitoring would make sense. (Yes, I've also read the famous thread on stateful firewalls[1]). Thanks! [1] http://markmail.org/thread/fvordsbnuc74fuu2#query:+page:1+mid:fvordsbnuc74f…

10 9

Hulu, ABC, Disney have blocked my entire subnet!
by Brett A Mansfield 06 May '15

06 May '15

Anyone know any good contacts with any of these companies so I can get this resolved? As an ISP, having my entire subnet blocked prevents my customers from being able to use these services they pay for. We are getting the outside of the U.S. or going through hosted proxy issue. I have never used proxies, but even if one of my customers did shouldn't it block just the one IP address? Thank you, Brett A Mansfield

3 2

Google IPv6 geo location problem
by Frederik Kriewitz 05 May '15

05 May '15

Hello, At the beginning of this year we started to roll out IPv6 for a large part of our customer base. Everything was working perfectly fine until mid February when google decided to geo locate our entire 2a00:e60::/32 IPv6 net to Iran. We expected that it would be done for /48 to /64 blocks (On IPv4 it's done for each IP). Being a ISP with mostly satellite internet customers from all over the world we're used to problems caused by IP based geo locating. Usual the complains are "Please change the language of google.com to English, I don't understand the currently configured language" (happens if the previous user of the IP address trained google to some other language). Most of our customers (Mostly military, oil & gas, government and international companies) are expecting an English internet. Usually we can fix their problems by changing their IP address. But with our entire /32 being handled as Iran by Google this is a problem. The problem is that google apparently blocks Iran from using any remotely commercial service (I assume due to the sanctions against Iran). We got a lot of customers complaining about not being able to login into Google Apps ("Unable to sign in from this country - You appear to be signing in from a country where Google Apps accounts are not supported."). But plenty of other purely informational Google websites (e.g. http://www.html5rocks.com/) returned a "403 - We're sorry, but this service is not available in your country." forbidden error too. We had to revert our IPv6 roll out again due to this problem. We tried submitting a correction request via https://support.google.com/websearch/contact/ip back in February but that apparently wasn't processed. Is there anyone from Google around who can help with this? This is currently blocking our IPv6 deployment. Best Regards, Freddy AS62023 / NYNEX satellite OHG

2 1

Fw: Euro-IX quagga stable download and implementation
by Goran Slavic 05 May '15

05 May '15

Greetings Mr. Lamparter My name is Goran Slavic, and I am contacting you in the name of Serbian Open Exchange (SOX). I have read your post "Bird vs Quagga revisited" http://mailman.nanog.org/pipermail/nanog/2012-August/051285.html at the mailing list and have an interest in downloading and implementing the Euro-IX version of Quagga in our Internet exchange. My questions are simple: - Considering the time when the post is written (2012) - what is the current status of the Euro-IX Quagga ? - Where can it be downloaded as a stable release / version ? I am grateful for any help you can provide with the issue in question. Regards G.Slavic

9 12

Re: Verizon Policy Statement on Net Neutrality
by Scott Fisher 04 May '15

04 May '15

Funny, but in my honest opinion, unprofessional. Poor PR. On Fri, Feb 27, 2015 at 9:10 AM, Scott Fisher <littlefishguy(a)gmail.com> wrote: > Funny, but in my honest opinion, unprofessional. Poor PR. > > On Fri, Feb 27, 2015 at 9:05 AM, Larry Sheldon <larrysheldon(a)cox.net> wrote: >> http://publicpolicy.verizon.com/blog/entry/fccs-throwback-thursday-move-imp… >> -- >> The unique Characteristics of System Administrators: >> >> The fact that they are infallible; and, >> >> The fact that they learn from their mistakes. >> >> >> Quis custodiet ipsos custodes > > > > -- > Scott -- Scott

73 337

Gov.vc...alert!!
by Rudolph Daniel 04 May '15

04 May '15

Hi Guys Take a look at gov.vc please. Idil hack. RD

1 0

Looking for a provider in Ecuador
by Eric C. Miller 02 May '15

02 May '15

Hello, Does anyone have a recommendation for a provider who can service the west coast of Ecuador at speeds 100Mbps - 1Gbps? Thanks! Eric Miller, CCNP Network Engineering Consultant (407) 257-5115

6 5