- NANOG - lists.nanog.org

NANOG 61 hotel
by Jon Lewis 15 May '14

15 May '14

The Hyatt appears to have filled up. :( Anyone have alternate hotel recommendations? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

IPAM DDI Software, Subscriber Management, CMDB and Per Customer VLANs
by Kyle Leissner 15 May '14

15 May '14

I would like recommendations on the following software/hardware elements required to run an access network. Assume you are building a greenfield network using a combination of access technologies such as DSL, GPON, AE, and WiFi. IPAM / DDI Solution: Needs full support for IPv6, Customer VLANs, RFC 1918, VRF, Overlapping Address Space, integration with DNS, DNSSEC, Integration with DHCP, and integration with ARIN. Looks like there are both open source and commercial solutions available according to old NANOG posts. Which cater to service providers? Who are the leaders in this space? Does anyone have experience with dealing with multiple vendors? Subscriber Management/BRAS/BNG: Redback was the big player back in the day, but I believe they are no longer. Juniper has their Subscriber Management feature pack on their MX routers, and Cisco has their Broadband Network Gateway on their ASR routers. Besides these two vendors I am not sure what other solutions are out there. I believe both of these solutions communicate upstream to external radius servers and DHCP servers. Is anyone using Subscriber Management, or is there another way of doing it? CMDB: A centralized database to keep track of all assets within the network would be nice. I would assume this would need to tie in with the IPAM solution and billing systems. I would also like to hear thoughts on the per customer VLAN model. Most of the whitepapers recommend a per customer VLAN for greenfield networks, but that seems like a management and documentation nightmare. The systems described above must be able to manage and maintain per customer VLANs in an automated fashion for this approach to work and scale. If you had your choice starting from the ground up how would you deploy an access network today?

6 6

FYI: Unbreakable VPN using Vyatta/VyOS -HOW TO-
by Naoto MATSUMOTO 15 May '14

15 May '14

Hi all! We wrote TIPS memo about the Basic Idea for inter-cloud networking using Virtual Router (a.k.a Brocade Vyatta vRotuer and VyOS) with High Availability Concept. Please enjoy it if you interest in ;-) Unbreakable VPN using Vyatta/VyOS -HOW TO- http://slidesha.re/1lryGVU Best Regards, -- SAKURA Internet Inc. / Senior Researcher Naoto MATSUMOTO <n-matsumoto(a)sakura.ad.jp> SAKURA Internet Research Center <http://research.sakura.ad.jp/>

2 2

BGP route flapping
by Gus Crichton 14 May '14

14 May '14

Hi there, Hope you networking experts can shed some light on a concern I have please. I am multihoming using 2 ISPs to the internet, due to reasons outside my control, my primary preferred link keeps dropping a number of times a day forcing traffic to my backup and vice-versa when the primary comes back up. The route calculations by the upstream tier 1s and 2s handle the route calculations but if I do this too many times consuming their resources, is there a penalty/blackmark on my AS? Is this monitored even by the tier1s and 2s? Thanks. Regards, Gus C. ________________________________ Notice of Confidentiality: The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by responding to this email and then delete it from your system.

3 2

New Zealand Spy Agency To Vet Network Builds, Provider Staff
by Paul Ferguson 14 May '14

14 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I realize that New Zealand is *not* in North America (hence NANOG), but I figure that some global providers might be interested here. This sounds rather... dire (probably not the right word). "The new Telecommunications (Interception Capability and Security) Act of 2013 is in effect in New Zealand and brings in several drastic changes for ISPs, telcos and service providers. One of the country's spy agencies, the GCSB, gets to decide on network equipment procurement and design decisions (PDF), plus operators have to register with the police and obtain security clearance for some staff. Somewhat illogically, the NZ government pushed through the law combining mandated communications interception capabilities for law enforcement, with undefined network security requirements as decided by the GCSB. All network operators are subject to the new law, including local providers as well as the likes of Facebook, Google, Microsoft, who have opposed it, saying the new statutes clash with overseas privacy legislation." http://yro.slashdot.org/story/14/05/13/005259/new-zealand-spy-agency-to-vet… FYI, - - ferg - -- Paul Ferguson VP Threat Intelligence, IID PGP Public Key ID: 0x54DC85B2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlNyHw4ACgkQKJasdVTchbLwDgD/WVHo2iTapJ90l8MRcwUZ5OQ7 QfJ5cI1v4t2bUXZp1hQBAKHCP0hyxg6naGOzRLt/vHjgxXnl3+yiWoj0ENxQyIr9 =0yLu -----END PGP SIGNATURE-----

14 22

CERT and ISO 27001
by DjinnS C. 14 May '14

14 May '14

Hi, I'm searching a service/company doing continuos review of security alerts for various tools, software and hardware (Apache, PHP, Cisco IOS, Juniper JunOS, Netapp Ontap, etc ...). I think the right way is to use a CERT offering commercial services with daily notifications about a list of specifics choosen subjects. I found some companies with a commercial CERT offering this services: Lexsi, XMCO, Intrinsec. Do you know or use a service link this ? We need this for our implementation of ISO 27001 standard. Thank you in advance. Regards, -- Guillaume

2 1

This is me venting.... OVH/lvl3
by Mr. Queue 13 May '14

13 May '14

Almost a week of this now.. OVH/lvl3 at dal-1-6k. Thank you sir may I have another...... http://weathermap.ovh.net/usa

2 2

Re: Observations of an Internet Middleman (Level3) (was: RIP Network Neutrality)
by Joel M Snyder 13 May '14

13 May '14

Shouldn't there be a rule against using "RIP" in the subject line of a NANOG post? Every time I see that, a shudder goes down *my* spine. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

3 2

level3 dia egress filtering?
by Christopher Rogers 13 May '14

13 May '14

Does anyone have any experience dealing with level3 in trying to get egress filters applied to an internet dia link with them? I've been trying to get them to apply an egress filter to drop all of udp to a certain /25 on my network that's been getting hammered by a dns amplification attack, and I am being told that they can only 'drop an entire protocol, and not to a specific ip address or range.' Can anyone confirm if that's the case? cheers -chris

8 10

Re: Residential CPE suggestions
by Scott Weeks 13 May '14

13 May '14

--- gary.buhrmaster(a)gmail.com wrote: From: Gary Buhrmaster <gary.buhrmaster(a)gmail.com> On Mon, May 5, 2014 at 11:59 PM, Deepak Jain <deepak(a)ai.net> wrote: > > Any recommendation for a residential CPE that supports dual > SFP uplinks <snip> Have you looked at the EdgeRouter Pro? 2 SFP links, routing capability. http://www.ubnt.com/edgemax ----------------------------------------------- It looks like everyone here should start looking for a new career: "Next-generation user experience allows anyone to quickly become a routing expert." ;-) scott

8 9