- NANOG - lists.nanog.org

Mikrotik Cloud Core Router and BGP real life experiences?
by Martin Hotze 02 Jan '14

02 Jan '14

Hi, looking at the specs of Mikrotik Cloud Core Routers it seems to be to good to be true [1] having so much bang for the bucks. So virtually all smaller ISPs would drop their CISCO gear for Mikrotik Routerboards. We are using a handful of Mikrotik boxes, but on a much lower network level (splitting networks; low end router behind ADSL modem, ...). We're happy with them. So I am asking for real life experience and not lab values with Mikrotik Cloud Core Routers and BGP. How good can they handle full tables and a bunch of peering sessions? How good does the box react when adding filters (during attacks)? Reloading the table? etc. etc. I am looking for _real_ _life_ values compared to a CISCO NPE-G2. Please tell me/us from your first hand experience. Thanks! greetings, Martin [1] If something sounds too good to be true, it probably is.

16 26

Catalyst IOS refresher site?
by Jay Ashworth 02 Jan '14

02 Jan '14

It's been a bit too long since I was near the high end, so I grabbed a 4507 from my local surplus vendor; dual PS, dual supe, Gig Fiber (large transceivers, alas, not GBIC), and 3 48port RJ45 POE cards. For $60. I love surplus. Is there a good Catalyst-IOS tutorial on line I can buzz through, to refresh my memory on where everything is? Cheers, -- jra -- Make Election Day a federal holiday: http://wh.gov/lBm94 100k sigs by 12/14 Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

3 4

Re: NSA able to compromise Cisco, Juniper, Huawei switches
by Clay Kossmeyer 02 Jan '14

02 Jan '14

Hi Folks - Clay Kossmeyer here from the Cisco PSIRT. We've published the following document in response to the original (Dec. 29) Der Spiegel article: http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… and are investing the claims in the Dec. 30 Der Spiegel article referencing 'persistent implants' for the PIX and ASA product lines under case number PSIRT-1384943056. Any vulnerabilities we discover will be disclosed via our standard vulnerability handling process documented here: http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy… I'm not currently subscribed to NANOG, so if you have a reply you'd like me to see, please copy me directly. Regards, Clay ----- Found some interesting news on one of the Australia news websites. http://www.scmagazine.com.au/News/368527,nsa-able-to-compromise-cisco-junip… Regards, Steven.

13 24

NSA able to compromise Cisco, Juniper, Huawei switches
by sten rulz 01 Jan '14

01 Jan '14

Found some interesting news on one of the Australia news websites. http://www.scmagazine.com.au/News/368527,nsa-able-to-compromise-cisco-junip… Regards, Steven.

36 75

Re: NSA able to compromise Cisco, Juniper, Huawei switches
by Brandon Butterworth 01 Jan '14

01 Jan '14

> If legal, consider risk to NSA. Official product ran inside company to add > requested feature, hundred of people aware of it. Seems both expensive to > order such feature and almost guaranteed to be exposed by some of the > employees. > > Alternative method is to presume all software is insecure, hire 1 expert whose > day job is to search for vulnerabilities in IOS. Much cheaper, insignificant > risk. > > Which method would you use? I'd also look at having people work in the factory in china designing test or at (/own) the QA/test equipment manufacturer as when they connect the product jtag to test you can give a little extra. Both smaller groups of people and nobody knows what they do anyway but they do get legit access to the product perhaps with low level details handed on a plate. > If this is as widespread as claimed, and if we'll gain knowledge how to see if > you are affected, there are potentially repercussions on geopolitical scale, > as I'm sure many on these lists would go public and share information if > they'd find being targeted. Would they leave them out there gathering data for as long as possible or remove the evidence as soon as people start looking (then put some back later once the fuss has died down)? brandon

1 0

First! [?]
by jamie rishaw 01 Jan '14

01 Jan '14

Happy New Year to all, and to all a good lawful interception.

6 5

Re: Juniper SSL VPN
by Hank Nussbacher 01 Jan '14

01 Jan '14

At 20:55 31/12/2013 -0500, Christopher Morrow wrote: >Had no clue? Didn't they build it? > > > > From what I understood from the tech note, they had no clue this would > > happen on the 31st of December :) Perhaps it is a left over somehow from their Netscreen purchase (April 2004)? -Hank

2 1

Why are we fixated on Multimode fiber for high bandwidth communication?
by eric clark 31 Dec '13

31 Dec '13

I've been working with 40 gig for a few years. When I first ordered a switch, one of the first publicly available with full 40 gig, I was appalled that I was going to have to use 4 pair of multimode fiber for each of my connections. I had planned on using single mode because I can do that with 1 pair. Even today, we're still looking at MM fiber instead of SM, even with the horrendous limitations and cost issues of MM. For instance, if you need to go 301 meters or more, you've got to go OM4 which is very expensive. You have to lay 4 times the number of pairs as SM and when we move to 100G, it'll be even worse because they're still doing things in 6,12,etc... SM can do 100G easily, up to 1K with the lower grade fiber, so in the SM 100G world, you'd be installing 1/12 the strands as you would in multi mode. I just can't figure where this makes sense.... I am aware that single mode has more expensive optics, and I know how much they cost when I first looked at this, but if this were the standard, that price would drop enormously. Anyone know why the industry has their head stuck on MultiMode?

6 6

CEF/etherchannel load balancing algorithms or MLPPPoE
by Herro91 31 Dec '13

31 Dec '13

Hello, Looking for feedback/suggestions on a design issue. We have a two ethernet connections in a port channel between two Cisco routers (ASR1k), unfortunately we only have one unique flow between traversing the ether/port channel, so traffic is pinned to just one link. I'm looking for options including whether one of the algorithms available for CEF is able to make a load sharing decision if I expose some upper layer information such as DSCP/ToS to CEF to provide unique flows? I also have been considering MLPPPoE, but it does not seem to support more than one member link from what I can tell. Appreciate thoughts and suggestions. Best, -Doug

1 0

RE : Re: NSA able to compromise Cisco, Juniper, Huawei switches
by Michael Hallgren 31 Dec '13

31 Dec '13

+1, I fully agree. And not only concerning the "domestic" use by country, but also with regards to "information peering" with neighbors, and such. Enjoy '14! mh -------- Message d'origine -------- De : Ray Soucy <rps(a)maine.edu> Date : A : Blair Trosper <blair.trosper(a)gmail.com> Cc : "nanog(a)nanog.org list" <nanog(a)nanog.org> Objet : Re: NSA able to compromise Cisco, Juniper, Huawei switches I think there needs to be some clarification on how these tools get used, how often they're used, and if they're ever cleaned up when no longer part of an active operation. Of course we'll never get that. The amount of apologists with the attitude "this isn't a big deal, nothing to see here, the NSA does this kind of thing" is kind of shocking for this community; especially with the information that's been released over the past few months. This whole backdoor business is a very, very, dangerous game. On Tue, Dec 31, 2013 at 12:19 AM, Blair Trosper <blair.trosper(a)gmail.com>wrote: > To supplement and amend what I said: > > These are the KINDS of things we want the NSA to do; however, the > institutional oversight necessary to make sure it's Constitutional, > warranted, and kept "in bounds" is woefully lacking (if any exists at all). > Even FISA is unsatisfactory. > > At any rate, I agree that the current disposition of the NSA (or, at least, > what's been leaking the last few months) is simply unacceptable and cannot > be allowed. I say that last part from the perspective of a US citizen, > though I'd imagine most people of other nationalities would agree with me, > but probably for different reasons. > > > On Mon, Dec 30, 2013 at 11:08 PM, Jimmy Hess <mysidia(a)gmail.com> wrote: > > > On Mon, Dec 30, 2013 at 10:41 PM, Blair Trosper <blair.trosper(a)gmail.com > >wrote: > > > >> I'm torn on this. On one hand, it seems sinister. On the other, it's > not > >> only what the NSA is tasked with doing, but it's what you'd EXPECT them > to > >> be doing in the role as the NSA. > >> > > [snip] > > > > The NSA's role is not supposed to include subterfuge and undermining the > > integrity or security of domestic enterprise infrastructure > > > > With any luck, we'll hopefully find absolutely nothing, or that it was > > "targetted" backdooring against specific targets only. > > > > And people have a need to know that the security agencies haven't left a > > trail of artificially inserted bugs and backdoors in common IT equipment > > providing critical infrastructures services, and that the agencies > haven't > > prepared a collection of instant-root 0days, that are no more protected > > then the agencies' other poorly guarded "secrets". > > > > There would be a risk that any 'backdoors' are ready to be exploited by > > other unintended nefarious actors! > > Because the NSA are apparently great at prepping the flammables and > > setting fires, but totally incapable of keeping the fires contained, > > once they (or someone else) lights it. > > > > > > It is not the least bit necessary for the NSA itself to be a nefarious > > actor exploiting things or even complicit; for the mere presence of > any > > backdoor or surreptitious code to eventually have the potential for > serious > > damage. > > > > It could well be a rogue ex-employee of the NSA, such as Snowden, or > > others, that happened to be aware of technical details, hackers, or > > members of a foreign nation state, who will just happen to have the time > > and energy to track down open doors waiting for the taking, AND figure > > out how to abuse them for evil purposes. > > > > > > There are enough potential 0day risks, without intentional ones, waiting > > for bad guys to co-opt! > > > > -- > > -JH > > > -- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

1 0