- NANOG - lists.nanog.org

NAT-PT or NAT64 in real life
by jarod smith 19 Jan '11

19 Jan '11

Although it would seem that double-stack is still the preferred method of linux distribution, I want my next deployed in IPv6 only. For linux there is NAT-PT tomicki and NAT64 Viagenie. I don't have Cisco equipment although I'd like tested their NAT-PT, even if it's obsolete. Are some of you have installed one of these two implementations in production on recent versions of linux? Is it stable, secure, ... ? Regards

4 4

NANOG 51 Agenda posted
by David Meyer 19 Jan '11

19 Jan '11

Folks, See http://www.nanog.org/meetings/nanog51/agenda.php See you in Miami, Dave (for the NANOG PC)

1 0

Network Simulators
by James Jones 19 Jan '11

19 Jan '11

Are there any good Network Simulators/Trainers out there that support IPv6? I want play around with some IPv6 setup. -- James Jones +1-413-667-9199 james(a)freedomnet.co.nz

13 14

Dual Homed BGP for failover
by Ahmed Yousuf 19 Jan '11

19 Jan '11

Hi, I'm looking at a setup where we use BGP to announce PI space to two upstream ISPs. ISP A provides a 30Mb/s connection and ISP B provides a 10Mb/s. Originally the plan was to use ISP B's link as a backup and local pref traffic outbound via ISP A and pref inbound using AS prepend via ISP A. It has now been requested to be able to distribute traffic across both links rather than preference traffic to the higher speed link. We are going to be using Juniper SRX210s to do this. I have some questions: - Is this really a good idea, as the BGP process won't care what the utilisation of the links are and you will see situations where the lower speed link gets used even though the high speed link utilisation is 0? - If we are doing this, I don't want to take a full routing table, I would rather just take the ISPs routes and perhaps their connected customers. One ISP has said they will only provide full routing table or default. I really don't want to take a full table, is receiving default only going to be a problem for my setup? - Any advice on how to avoid situations where the low bandwidth link is being used even though there is 0 utilisation on the high bandwidth link? Thanks Ahmed

10 18

RE: Dual Homed BGP for failover (Ahmed Yousuf)
by James Byaruhanga 19 Jan '11

19 Jan '11

On 2011/01/19 5:28 PM, "nanog-request(a)nanog.org" <nanog-request(a)nanog.org> wrote: >Send NANOG mailing list submissions to > nanog(a)nanog.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://mailman.nanog.org/mailman/listinfo/nanog >or, via email, send a message with subject or body 'help' to > nanog-request(a)nanog.org > >You can reach the person managing the list at > nanog-owner(a)nanog.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of NANOG digest..." > > >Today's Topics: > > 1. Re: NAT-PT or NAT64 in real life (jarod smith) > 2. Re: Software DNS hghi availability and load balancer solution > (Joe Greco) > 3. Re: Software DNS hghi availability and load balancer solution > (Joe Abley) > 4. Re: Software DNS hghi availability and load balancer solution > (InterNetX - J?rgen Gotteswinter) > 5. Re: Network Simulators (Ryan Shea) > 6. RE: Network Simulators (Gary Gladney) > 7. RE: Dual Homed BGP for failover (Randy McAnally) > 8. Re: Network Simulators (Carlos Martinez-Cagnazzo) > 9. RE: Dual Homed BGP for failover (Ahmed Yousuf) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Wed, 19 Jan 2011 13:02:33 +0100 >From: jarod smith <jarod.smouth(a)gmail.com> >Subject: Re: NAT-PT or NAT64 in real life >To: nanog(a)nanog.org >Message-ID: > <AANLkTing2SOssk-yNLOVKSPS4nTRjEwcq+itVWkhrJZC(a)mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Thanks for your reply. > >In summary it's not possible to deployed IPv6 only if I want to access the >whole internet :) > > > >On Wed, Jan 19, 2011 at 10:18 AM, jarod smith ><jarod.smouth(a)gmail.com>wrote: > >> Although it would seem that double-stack is still the preferred method >>of linux >> distribution, I want my next deployed in IPv6 only. >> For linux there is NAT-PT tomicki and NAT64 Viagenie. >> >> I don't have Cisco equipment although I'd like tested their NAT-PT, even >> if it's obsolete. >> >> Are some of you have installed one of these two implementations in >> production on recent versions of linux? Is it stable, secure, ... ? >> >> >> Regards >> > > >------------------------------ > >Message: 2 >Date: Wed, 19 Jan 2011 07:17:07 -0600 (CST) >From: Joe Greco <jgreco(a)ns.sol.net> >Subject: Re: Software DNS hghi availability and load balancer solution >To: paul(a)paulgraydon.co.uk (Paul Graydon) >Cc: nanog(a)nanog.org >Message-ID: <201101191317.p0JDH74H076996(a)aurora.sol.net> >Content-Type: text/plain; charset=us-ascii > >> On 01/18/2011 07:42 AM, Sergey Voropaev wrote: >> > Does any one know software sollutions (free is preferable) like as >>cisco GSS >> > and F5 BIG-IP? The main point is that DNS-server (or dns server >>plugin) must >> > be able to monitor server availability (for example by TCP connect) >>and from >> > DNS-reply depends on it. >> > >> > I know that it is possible by BIND with set of script. But we are >>trying to >> > find more usable solution with frendly interface. >> > >> > Thanks a lot. >> >> If you want to get fancy you could try an Anycast DNS setup, using >>GNU's >> Zebra tool to automatically alter routing tables. >> >>http://www.netlinxinc.com/netlinx-blog/45-dns/118-introduction-to-anycast >>-dns.html > >You wouldn't use Zebra; it isn't actively developed anymore and has >not been updated in many years. Use Quagga instead, which is the >community-based offshoot. > >... JG >-- >Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net >"We call it the 'one bite at the apple' rule. Give me one chance [and] >then I >won't contact you again." - Direct Marketing Ass'n position on e-mail >spam(CNN) >With 24 million small businesses in the US alone, that's way too many >apples. > > > >------------------------------ > >Message: 3 >Date: Wed, 19 Jan 2011 08:23:09 -0500 >From: Joe Abley <jabley(a)hopcount.ca> >Subject: Re: Software DNS hghi availability and load balancer solution >To: Joe Greco <jgreco(a)ns.sol.net> >Cc: nanog(a)nanog.org >Message-ID: <B3ABA767-D8DC-4806-A127-AD0BD5138960(a)hopcount.ca> >Content-Type: text/plain; charset=us-ascii > > >On 2011-01-19, at 08:17, Joe Greco wrote: > >> You wouldn't use Zebra; it isn't actively developed anymore and has >> not been updated in many years. Use Quagga instead, which is the >> community-based offshoot. > >I don't think this is what the original post was asking about, but for >the sake of completeness other alternatives to Zebra/Quagga (when using >BGP between anycast origin servers and adjacent routers, e.g. with >multipath configured on the routers) are OpenBGPd and BIRD. > >See earlier suggestions for bedtime reading, also: ><http://www.merit.edu/mail.archives/nanog/msg06970.html>. > > >Joe > > > > >------------------------------ > >Message: 4 >Date: Wed, 19 Jan 2011 14:27:52 +0100 >From: InterNetX - J?rgen Gotteswinter > <juergen.gotteswinter(a)internetx.de> >Subject: Re: Software DNS hghi availability and load balancer solution >To: nanog(a)nanog.org >Message-ID: <4D36E6D8.9000408(a)internetx.de> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Am 19.01.11 01:01, schrieb david raistrick: >> >>> On 01/18/2011 09:42 AM, Sergey Voropaev wrote: >>>> Does any one know software sollutions (free is preferable) like as >>>> cisco GSS >>>> and F5 BIG-IP? The main point is that DNS-server (or dns server >>>> plugin) must >>>> be able to monitor server availability (for example by TCP connect) >>>> and from >>>> DNS-reply depends on it. >>>> >> >> On Tue, 18 Jan 2011, Charles N Wyble wrote: >>> >>> Ha-proxy and linux virtual server are popular packages. >> >> Neither of these do DNS. He asked about DNS based loadbalancing (also >> known as GSLB, among other things) software packages.... >> > >haproxy doesnt, > > >lvs works for dns very well, take a look at keepalived >(www.keepalived.org) it supports lvs + vrrp. > >> >> >> -- >> david raistrick http://www.netmeister.org/news/learn2quote.html >> drais(a)icantclick.org http://www.expita.com/nomime.html >> >> >> > > > > >------------------------------ > >Message: 5 >Date: Wed, 19 Jan 2011 08:36:31 -0500 >From: Ryan Shea <ryanshea(a)google.com> >Subject: Re: Network Simulators >To: Brandon Kim <brandon.kim(a)brandontek.com> >Cc: nanog group <nanog(a)nanog.org> >Message-ID: > <AANLkTinzXRVwa-sGirFLieDS6GJ7cH=YzbgOWKbXqbuJ(a)mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1 > >You can do some switching by stuffing a virtual NM-16ESW into your >faketastic 3660 in Dynamips. Then there are the built-in frame-relay and >ethernet switches you could dump into the mix as well. > >-Ryan > >On Mon, Jan 17, 2011 at 10:23 AM, Brandon Kim ><brandon.kim(a)brandontek.com>wrote: > >> >> James: >> >> I've been resisting GNS3 for the longest time, because I like real >> equipment and to get my hands a little dirty. >> But for the purpose of simulation, GNS3 helped me identify a BGP issue >>last >> week. If it weren't for GNS3, >> I would not have been able to figure it out. >> >> I will be using GNS3 in the future now for as much I can. Remember it is >> more router oriented than switch. >> >> So you can't do any fancy L3 switching...... >> >> >> >> > Date: Mon, 17 Jan 2011 10:05:21 -0500 >> > From: james(a)freedomnet.co.nz >> > To: nanog(a)nanog.org >> > Subject: Re: Network Simulators >> > >> > So far GNS3 has won out so far. It seems to work on my Mac fairly >>well. >> > trying it out now. >> > >> > On 17/01/11 9:37 AM, Carlos Martinez-Cagnazzo wrote: >> > > I am currently researching virtual simulation environments for the >> > > Networking courses that I teach. I am now interested in user-mode >> > > linux emulators as they provide more real environments. >> > > >> > > The one that I am liking the most right now is this one: >> > > http://wiki.netkit.org/index.php/Main_Page >> > > >> > > regards >> > > >> > > Carlos >> > > >> > > On Mon, Jan 17, 2011 at 12:20 PM, Arturo Servin< >> arturo.servin(a)gmail.com> wrote: >> > >> GNS3 >> > >> http://www.gns3.net/ >> > >> >> > >> This is another network simulator, mainly for academic >> research. >> > >> >> > >> NS-2 >> > >> http://www.isi.edu/nsnam/ns/ >> > >> >> > >> And you can always setup some virtual machines with DNSs, >> hosts and routers with open-source software. >> > >> >> > >> regards, >> > >> -as >> > >> >> > >> On 17 Jan 2011, at 11:58, James Jones wrote: >> > >> >> > >>> Are there any good Network Simulators/Trainers out there that >>support >> IPv6? I want play around with some IPv6 setup. >> > >>> >> > >>> -- >> > >>> James Jones >> > >>> +1-413-667-9199 <tel:+14136679199> >> > >>> james(a)freedomnet.co.nz >> > >>> >> > >> >> > > >> > > >> > >> >> > > >------------------------------ > >Message: 6 >Date: Wed, 19 Jan 2011 13:52:20 +0000 >From: Gary Gladney <gladney(a)stsci.edu> >Subject: RE: Network Simulators >To: Brandon Kim <brandon.kim(a)brandontek.com> >Cc: nanog group <nanog(a)nanog.org> >Message-ID: > <1B0C5329DB4558419BE8B3440A66ADF306E2B432(a)EXCHMAIL1.stsci.edu> >Content-Type: text/plain; charset="us-ascii" > >If you looking for network simulator for Cisco equipment it's been my >experience that Boson (www.boson.com) has best network simulator for >Cisco equipment. It behaves and process information the way real Cisco >equipment does. I've tried GS3, it great for routing situations but >lacks in simulating switches. > >Gary > >-----Original Message----- >From: Ryan Shea [mailto:ryanshea@google.com] >Sent: Wednesday, January 19, 2011 8:37 AM >To: Brandon Kim >Cc: nanog group >Subject: Re: Network Simulators > >You can do some switching by stuffing a virtual NM-16ESW into your >faketastic 3660 in Dynamips. Then there are the built-in frame-relay and >ethernet switches you could dump into the mix as well. > >-Ryan > >On Mon, Jan 17, 2011 at 10:23 AM, Brandon Kim ><brandon.kim(a)brandontek.com>wrote: > >> >> James: >> >> I've been resisting GNS3 for the longest time, because I like real >> equipment and to get my hands a little dirty. >> But for the purpose of simulation, GNS3 helped me identify a BGP issue >> last week. If it weren't for GNS3, I would not have been able to >> figure it out. >> >> I will be using GNS3 in the future now for as much I can. Remember it >> is more router oriented than switch. >> >> So you can't do any fancy L3 switching...... >> >> >> >> > Date: Mon, 17 Jan 2011 10:05:21 -0500 >> > From: james(a)freedomnet.co.nz >> > To: nanog(a)nanog.org >> > Subject: Re: Network Simulators >> > >> > So far GNS3 has won out so far. It seems to work on my Mac fairly >>well. >> > trying it out now. >> > >> > On 17/01/11 9:37 AM, Carlos Martinez-Cagnazzo wrote: >> > > I am currently researching virtual simulation environments for the >> > > Networking courses that I teach. I am now interested in user-mode >> > > linux emulators as they provide more real environments. >> > > >> > > The one that I am liking the most right now is this one: >> > > http://wiki.netkit.org/index.php/Main_Page >> > > >> > > regards >> > > >> > > Carlos >> > > >> > > On Mon, Jan 17, 2011 at 12:20 PM, Arturo Servin< >> arturo.servin(a)gmail.com> wrote: >> > >> GNS3 >> > >> http://www.gns3.net/ >> > >> >> > >> This is another network simulator, mainly for academic >> research. >> > >> >> > >> NS-2 >> > >> http://www.isi.edu/nsnam/ns/ >> > >> >> > >> And you can always setup some virtual machines with DNSs, >> hosts and routers with open-source software. >> > >> >> > >> regards, >> > >> -as >> > >> >> > >> On 17 Jan 2011, at 11:58, James Jones wrote: >> > >> >> > >>> Are there any good Network Simulators/Trainers out there that >> > >>> support >> IPv6? I want play around with some IPv6 setup. >> > >>> >> > >>> -- >> > >>> James Jones >> > >>> +1-413-667-9199 <tel:+14136679199> >> > >>> james(a)freedomnet.co.nz >> > >>> >> > >> >> > > >> > > >> > >> >> > > > >------------------------------ > >Message: 7 >Date: Wed, 19 Jan 2011 09:00:28 -0500 >From: "Randy McAnally" <rsm(a)fast-serv.com> >Subject: RE: Dual Homed BGP for failover >To: "Ahmed Yousuf" <ayousuf0079(a)gmail.com>,"'nanog group'" > <nanog(a)nanog.org> >Message-ID: <20110119140022.M30623(a)fast-serv.com> >Content-Type: text/plain; charset=iso-8859-1 > >On Wed, 19 Jan 2011 10:23:47 -0000, Ahmed Yousuf wrote > >> - Accept that we are never going to get an ideal >> distribution of traffic and continue monitoring and adjusting local >> pref/prepends etc. as and when we need to change the distribution of >> traffic. Hopefully we don't need to do this that often. > > >^ This. You're fighting a loosing battle with such slow links. Given the >limited route capacity of your router you might as well set up statics >aimed >at each link and forget about BGP shaping. Just keep a floating default >pointed at each peer. > >-Randy > > > >------------------------------ > >Message: 8 >Date: Wed, 19 Jan 2011 12:27:27 -0200 >From: Carlos Martinez-Cagnazzo <carlosm3011(a)gmail.com> >Subject: Re: Network Simulators >To: nanog(a)nanog.org >Message-ID: > <AANLkTikkwtptwNxxC0CTHuJ+nHzs9SeFMZXeo13+KCBG(a)mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Anything for Junipers ? > >On Wed, Jan 19, 2011 at 11:52 AM, Gary Gladney <gladney(a)stsci.edu> wrote: >> If you looking for network simulator for Cisco equipment it's been my >>experience that Boson (www.boson.com) has best network simulator for >>Cisco equipment. ?It behaves and process information the way real Cisco >>equipment does. ?I've tried GS3, it great for routing situations but >>lacks in simulating switches. >> >> Gary >> >> -----Original Message----- >> From: Ryan Shea [mailto:ryanshea@google.com] >> Sent: Wednesday, January 19, 2011 8:37 AM >> To: Brandon Kim >> Cc: nanog group >> Subject: Re: Network Simulators >> >> You can do some switching by stuffing a virtual NM-16ESW into your >>faketastic 3660 in Dynamips. Then there are the built-in frame-relay and >>ethernet switches you could dump into the mix as well. >> >> -Ryan >> >> On Mon, Jan 17, 2011 at 10:23 AM, Brandon Kim >><brandon.kim(a)brandontek.com>wrote: >> >>> >>> James: >>> >>> I've been resisting GNS3 for the longest time, because I like real >>> equipment and to get my hands a little dirty. >>> But for the purpose of simulation, GNS3 helped me identify a BGP issue >>> last week. If it weren't for GNS3, I would not have been able to >>> figure it out. >>> >>> I will be using GNS3 in the future now for as much I can. Remember it >>> is more router oriented than switch. >>> >>> So you can't do any fancy L3 switching...... >>> >>> >>> >>> > Date: Mon, 17 Jan 2011 10:05:21 -0500 >>> > From: james(a)freedomnet.co.nz >>> > To: nanog(a)nanog.org >>> > Subject: Re: Network Simulators >>> > >>> > So far GNS3 has won out so far. It seems to work on my Mac fairly >>>well. >>> > trying it out now. >>> > >>> > On 17/01/11 9:37 AM, Carlos Martinez-Cagnazzo wrote: >>> > > I am currently researching virtual simulation environments for the >>> > > Networking courses that I teach. I am now interested in user-mode >>> > > linux emulators as they provide more real environments. >>> > > >>> > > The one that I am liking the most right now is this one: >>> > > http://wiki.netkit.org/index.php/Main_Page >>> > > >>> > > regards >>> > > >>> > > Carlos >>> > > >>> > > On Mon, Jan 17, 2011 at 12:20 PM, Arturo Servin< >>> arturo.servin(a)gmail.com> ?wrote: >>> > >> GNS3 >>> > >> http://www.gns3.net/ >>> > >> >>> > >> ? ? ? ? This is another network simulator, mainly for academic >>> research. >>> > >> >>> > >> NS-2 >>> > >> http://www.isi.edu/nsnam/ns/ >>> > >> >>> > >> ? ? ? ? And you can always setup some virtual machines with DNSs, >>> hosts and routers with open-source software. >>> > >> >>> > >> regards, >>> > >> -as >>> > >> >>> > >> On 17 Jan 2011, at 11:58, James Jones wrote: >>> > >> >>> > >>> Are there any good Network Simulators/Trainers out there that >>> > >>> support >>> IPv6? I want play around with some IPv6 setup. >>> > >>> >>> > >>> -- >>> > >>> James Jones >>> > >>> +1-413-667-9199 <tel:+14136679199> >>> > >>> james(a)freedomnet.co.nz >>> > >>> >>> > >> >>> > > >>> > > >>> > >>> >>> >> >> > > > >-- >-- >========================= >Carlos M. Martinez-Cagnazzo >http://www.labs.lacnic.net >========================= > > > >------------------------------ > >Message: 9 >Date: Wed, 19 Jan 2011 14:26:32 -0000 >From: "Ahmed Yousuf" <ayousuf0079(a)gmail.com> >Subject: RE: Dual Homed BGP for failover >To: "'nanog group'" <nanog(a)nanog.org> >Message-ID: <008901cbb7e4$f1feb860$d5fc2920$(a)gmail.com> >Content-Type: text/plain; charset="us-ascii" > >We're doing BGP to announce our PI space and make sure that our PI space >is >reachable through both ISPs in case one link goes down. This is the >primary >need to do the BGP here. Unfortunately my boss has requested that we make >use of the capacity of both links, rather than pref traffic out of the >higher capacity link. > >-----Original Message----- >From: Randy McAnally [mailto:rsm@fast-serv.com] >Sent: 19 January 2011 14:00 >To: Ahmed Yousuf; 'nanog group' >Subject: RE: Dual Homed BGP for failover > >On Wed, 19 Jan 2011 10:23:47 -0000, Ahmed Yousuf wrote > >> - Accept that we are never going to get an ideal >> distribution of traffic and continue monitoring and adjusting local >> pref/prepends etc. as and when we need to change the distribution of >> traffic. Hopefully we don't need to do this that often. > > >^ This. You're fighting a loosing battle with such slow links. Given the >limited route capacity of your router you might as well set up statics >aimed >at each link and forget about BGP shaping. Just keep a floating default >pointed at each peer. > >-Randy > > > > >------------------------------ > >_______________________________________________ >NANOG mailing list >NANOG(a)nanog.org >https://mailman.nanog.org/mailman/listinfo/nanog > >End of NANOG Digest, Vol 36, Issue 120 >************************************** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error please contact the sender immediately by returning electronic transmission and then immediately delete this transmission including all attachments without copying distributing or disclosing the same. Any views or opinions presented are solely those of the author and do not necessarily represent those of Roke Telkom.

1 0

PacketExchange/Mzima
by Andrew Kirch 19 Jan '11

19 Jan '11

Need a PacketExchange/Mzima admin to contact me off list regarding an AS Number issue. Andrwe

1 0

Routing Suggestions
by Lars Carter 19 Jan '11

19 Jan '11

Hi NANOG list, I have a simple, hypothetical question regarding preferred connectivity methods for you guys that I would like to get the hive mind opinion about. There are two companies, Company A and Company B, that are planning to continuously exchange a large amount of sensitive data and are located in a mutual datacenter. They decide to order a cross connect and peer privately for the obvious reasons. Company A has a small but knowledgable engineering staff and it's network is running BGP as its only routing protocol with multiple transit vendors and a handful of other larger peers. Company B is a smaller shop that is single homed behind one ISP through a default static route, they have hardware that can handle advanced routing protocols but have not had the need to implement them as of yet. There is a single prefix on both sides that will need to be routed to the other party. It is rare that prefixes would need to change or for additional prefixes to be added. >From an technical, operational, and security standpoint what would be the preferred way to route traffic between these two networks? Cheers, Lars

17 21

Auto ACL blocker
by Brian R. Watters 19 Jan '11

19 Jan '11

We are looking for the following solution. Honey pot that collects attacks against SSH/FTP and so on Said attacks are then sent to a master ACL on a edge Cisco router to block all traffic from these offenders .. Of course we would require a master whitelist as well as to not be blocked from our own networks. Any current solutions or ideas ?? -- BRW

10 14

Authentication using Microsoft 2008 Active directory for Cisco RADIUS login
by Michael Ruiz 19 Jan '11

19 Jan '11

Hello all, I am having some trouble getting my Cisco routers to use Active directory to authenticate users. I have searched on Google and so far I am coming up dry on good documentation that will work. I have used these links. http://briandesmond.com/blog/how-to-authenticate-against-active-director y-from-cisco-ios/ http://filedb.experts-exchange.com/incoming/2008/12_w51/87700/TA0001-Win dows-2008-RADIUS-for-C.pdf When I am doing a debug against the AAA I am getting the "Response (32) failed decrypt" error. Any thoughts? Thank you in advance. M.A.R

4 3

adaptec 5405 wedged
by Randy Bush 19 Jan '11

19 Jan '11

any adaptec bios-level fu out there? if so, please see http://archive.psg.com/110119.adaptec.pdf thanks randy

3 2