- NANOG - lists.nanog.org

DHCP server fail-over and accounting
by Joe 02 Feb '11

02 Feb '11

hi, we plan to implement DHCP server farm in our network. Currently , there are there problems burning my head. could anybody do some help? 1. How to set up DHCP server farm with high availability? It's required to set up DHCP server with 99.999% available. To our experience, this needs to set up DHCP server on two sites and syncronize their content in real time. Beside this , we hope there should be as less modification as possible on edge router when one DHCP server is down. should anycast architecture helpful ? or should we just set up two dhcp servers on two sites and sync. with ISC DHCPD? is there any other method for fail-over and high availability? 2. How to set up accouting and authentication with DHCP? Regulation and content based pricing is demanded. So, we plan to authenticate customer and accouting on their usage. In previous list post, someone said Juniper could do radius before DHCP. Does this mean Juniper could authenticate user with radius (username/password) before DHCP ? Is there anyway to collect user traffic under DHCP ? 3. Someone said PPPOE is not good for customer looking for long time online , DHCP is an good option. But, to my understanding DHCP is just good for those looking for easy-transfer to IPv6 , because pppoe could also make user on line as long as possible. Is there any reference on DHCP server consideration on 4-to-6 migration? Joe

3 2

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Chris Conn 02 Feb '11

02 Feb '11

> On 27/01/11 08:17 -0600, Jack Bates wrote: >> On 1/27/2011 12:57 AM, Frank Bulk wrote: >>> Have you looked at D-Link's DIR-825? It has most of the things you're >>> looking for. The DIR-655 is a more affordable option. >>> >> Haven't had the chance to look at that one. Will check it out. >> >>> In regards to (2), is it even possible to do DHCPv6-PD on with a SLAAC WAN? >>> >> It had better be, as IOS 12.2 SRE only supports SLAAC + DHCPv6-PD. >> Most of the Cisco documentation I've seen, says that is their >> beautiful layout. No more proxyarp/nd. Instead, assign a /64 to each >> subinterface, perform SLAAC, then hand out prefixes via DHCPv6-PD if >> someone needs a prefix. > > The DIR-825(Rev B) running firmware 2.05NA does. From the status screen: > > IPv6 Connection Type : Autoconfiguration (SLAAC/DHCPv6) > Network Status : Connected > > WAN IPv6 Address : 2610:b8:0:234:218:e7ff:fef8:66dc/64 > IPv6 Default Gateway : fe80::c67d:4fff:fed6:5401 > LAN IPv6 Address : 2610:b8:100f:1:218:e7ff:fef8:66db/64 > LAN IPv6 Link-Local Address : fe80::218:e7ff:fef8:66db/64 > Primary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:fef3:f9c8 > Secondary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:feee:9448 > DHCP-PD : Enabled > IPv6 network assigned > by DHCP-PD : 2610:b8:100f::/48 > > The latest firmware has fairly good support, but is lacking configurable v6 > firewall settings. I haven't done any firewall testing yet, but I'd imagine > all incoming v6 connections are blocked. > > The Emulator hasn't been updated yet to reflect the options in the new > firmware, but this should give you an idea of what the configuration looks > like: > > http://www.support.dlink.com/emulators/dir825_revB/203NA/adv_link_local.html > > The DIR-615 should have similar support, but I haven't upgraded it yet. Hello, As for the DIR-615, it should, but it doesn't...At least, the E3/E4 revisions I had. I contacted D-LINK support and was able to get a beta build that seems promising. But DHCP-PD over PPPoE works relatively well, minus a couple of little "features". I am hoping to have that hammered out soon, as the 615 is a capable little sub-50$ home CPE. But D-Link engineering seems receptive to my observations. I have to check the state of the firewalling in it too ;) Chris

4 5

A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)
by Martin Millnert 02 Feb '11

02 Feb '11

Here be dragons, On Sun, Jan 30, 2011 at 12:39 PM, Carlos Martinez-Cagnazzo <carlosm3011(a)gmail.com> wrote: > The solution to this problem (theoretical at least) already exist in > the form of RPKI. Any top-down RPKI model is intrinsically flawed. Deploying an overlay of single-point(s) of failure on top of a well-functional distributed system such as the Internet does not seem like a solution to much. The Internet works reasonably well only because it is reasonably distributed. I acknowledge that: 1) there are occasionally routing problems, 2) that IPv4 will deteriorate further very rapidly as it runs out and second-hand markets pick up, 3) that spammers run BGP and abuse, seemingly primarily, the non-RIR IRR-dbs. The answer to these issues is not by default RPKI IMO. For example, how about: 1, fix them - are there any problems that hasn't been fixed or were seriously hard to fix? Enumerate and let's go specific; let's not deploy a tank to push in a screw. 2, IPv6? 3, improve/remove non-RIR IRR-dbs It should be fairly obvious, by most recently what's going on in Egypt, why allowing a government to control the Internet is a Really Bad Idea. While it is true that governments are more or less in control of the *geographic area* they govern, as is evident in Egypt, there is a serious and big difference between the ease of removing a prefix from the Internet today in a country and how easy it will be in the fully network-deployed RPKI case, because of the hierarchical model (send your tanks to the RIR office(s) instead of every single country). Yes, governments exploit capabilities given to them by technological means ("we do it just because we can" is a standing motto). A top-down RPKI model would be a severely negative development of the resilience of the Internet, especially for freedom-aspiring people (approximately equal to humankind?), who need to avert government suppression. If we are to go down this path, at the very least it must stay architecturally/technologically *impossible* for a entity from country A to via-the-hierarchical-trust-model block a prefix assigned to some entity in country B, that is assigned by B's RIR and in full accordance with the RIR policies and in no breach of any contract. If not, we're doing humanity a disservice. One that I have no doubt would simply spawn/grow further overlay-networks to counter the problem. Cheers, Martin > > On Sun, Jan 30, 2011 at 6:23 AM, Andrew Alston <aa(a)tenet.ac.za> wrote: >> Hi All, >> >> I've just noticed that Level 3 is allowing people to register space in its IRR database that A.) is not assigned to the people registering it and B.) is not assigned via/to Level 3. >> >> So, I have two queries >> >> A.) Are only customers of Level 3 allowed to use this database >> B.) Can someone from Level 3 please clarify if there are any plans to lock this down slightly >> >> At this point, it would seem that if you are a customer of level 3's, you can register any space you feel like in there, and announce anything you feel like once the filters propagate, which in my opinion completely nullifies the point of IRR in the first place. >> >> Though I think this also raises the question about IRR databases in general. Would it not be far more sane to have each RIR run a single instance each which talk to each other, which can be verified against IP address assignments, and scrap the distributed IRR systems that allow for issues like this to occur? >> >> (In the mean time I've emailed the relevant people to try and get the entries falsely registered in that database removed, and will wait and see if I get a response). >> >> >> Andrew Alston >> TENET - Chief Technology Officer >> Phone: +27 21 763 7181 >> >> > > > > -- > -- > ========================= > Carlos M. Martinez-Cagnazzo > http://www.labs.lacnic.net > ========================= > >

12 30

Re: ipv4's last graph
by Scott Weeks 01 Feb '11

01 Feb '11

--- townsley(a)cisco.com wrote: From: Mark Townsley <townsley(a)cisco.com> On Feb 1, 2011, at 9:11 PM, Geoff Huston wrote: > On 01/02/2011, at 7:02 PM, Randy Bush wrote: >> graphs any more. might we have one last one for the turnstiles? :-)/2 >> >> and would you mind doing the curves now for each of the five rirs? >> gotta give us all something to repeat endlessly on lists and in presos. > > but of course. > > http://www.potaroo.net/tools/ipv4/rir.jpg I can almost hear the cutting and pasting going on across the globe with this. ------------------------------------------------------- Yes... :-) I did my share of cut-n-paste over here in an effort to pull folks' head out of their...uhhh...the sand. scott

1 0

Re: A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)
by Brandon Butterworth 01 Feb '11

01 Feb '11

So a possible road to ruin I was thinking of when I mentioned my unease is, to state the obvious, - Some large ISPs do RPKI as it's secure and their government contract says they have to be secure, keep the terrists out, so all directly attached ISP have to do it too kicking off a domino Other large customers will see the government lead and choose the same to meet the corporate governance rules so smaller ISP they use start to fall in line. It'll escalate like the MD5 frenzy, goes global and at some point hits critical mass where some ISP decide the unsigned routes are a risk and they can afford to drop them, like some do with deaggregates now. You get to the state of either you sign or your upstream signs (like L3 IRR proxy entries just a bit harder) or you don't exist. Some other event, like with UK anti CP filters, will happen where it becomes a legal requirement to let someone fiddle and make a kill switch to be used in certain circumstances. Later it gets used in unintended circumstances Our trade of control for security has given us neither. Of course more likely the key renewal will get spam filtered and I'll not notice until we fall off the net, or we forget to pay the RIR invoice on time and get cut off, causing a long outage that I can't fix as quickly as rolling back a router config change. I also wonder about emergency use, post a katrina have we made something that's too hard to bootstrap quickly. Drive slow. brandon

1 0

2011.02.01 NANOG51 day 2 afternoon session notes
by Matthew Petach 01 Feb '11

01 Feb '11

I've posted the afternoon notes from today's session at http://kestrel3.netflight.com/2011.02.01-NANOG51-afternoon-notes.txt Definitely not as happy with the flash video stream as I was with the hi-def VLC video stream that was provided at NANOG49. :( Lots of player problems and audio stuttering/loss on the flash stream for me. Any chance of the hi-def VLC stream coming back for future NANOGs, or was the bandwidth requirement too high to be feasible? Thanks! Matt

1 0

Re: Using IPv6 with prefixes shorter than a /64 on a LAN
by Tim Franklin 01 Feb '11

01 Feb '11

> I think ULA is still useful for home networks. If the home router guys > properly generate the ULA dynamically, it should stop conflicts within > home networking. There's something to be said for internal services > which ULA can be useful for, even when you do fall off the net. I really, *really* expect my CPE router *not* to remove global addresses from the LAN interface(s) when the link to the Internet goes down. My internal services should go on working with their global addresses. This is how my tunneled IPv6 works today. Am I being an unreasonable engineer in this respect? Regards, Tim.

3 2

Akamai - Timouts (TCP Stalls) at the SIX
by Wade Peacock 01 Feb '11

01 Feb '11

We've been experiencing issue with content coming from Akamai servers located in Seattle since Thursday January 27, 2011. Our upstream peers directly with Akamai as the SIX (Seattle Internet Exchange). We've been seeing timeouts/partial loads for sites with content delivered from IP block 96.17.8.0/24. Known impacted site for our customers: www.cbc.ca www.ebay.ca www.westjet.ca(redirect to www.westjet.com) We've opened tickets with our upstream and Akamai, but we are curious if others are experiencing the same issues. Wade Peacock Network Administrator Sun Country Cablevision Ltd Sunwave Internet Department Tel: (250) 832-9711 or (250) 546-9667 Dir: (250) 832-5123 x 220 Web: http://www.sunwave.net Email: wade.peacock(a)sunwave.net Support Email: support(a)sunwave.net

2 1

2011.02.01 NANOG51 day2 morning session notes posted
by Matthew Petach 01 Feb '11

01 Feb '11

(sorry about the delay, had to hop on a vendor call right as lunch break started) Morning session notes have been posted to http://kestrel3.netflight.com/2011.02.01-NANOG51-morning-notes.txt for those following along remotely. Very nice handoff and signing ceremony this morning by Steve Feldman and Don Welch--congratulations, newNOG, new owners of the NANOG name! Matt

1 0

OT: Anyone have PDF Manual for Nortel/BayStack 425-24T Switch
by kmedcalf＠dessus.com 01 Feb '11

01 Feb '11

Does anyone happen to have PDF Manuals (not the sales literature, but the switch software command references) for this switch? We have one in a production network and know nothing about it nor how to manage it. Nortel does not make any of the manuals available anymore, at least not in the interwebs (that I can find) nor does googling turn up anything very useful. Any help would be appreciated. If nothing can be found this will probably be discarded and replaced with appropriately supported product. Now, back to your regularly scheduled programming ... ---- #include <shrinkwrap-disclaimer.h>

2 2