- NANOG - lists.nanog.org

IPv6 in Education Question
by Todd Christell 18 Mar '10

18 Mar '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So Im giving an introductory talk on IPv6 for a state wide conference for tech coordinators for education. I have the usual catechism of reasons/advantages from the network side but was wondering if there were any good education specific applications of v6. My major goal is to help them understand the situation so that they can make use of the base of educators in our state to help spread the work about IPv6. Thanks in advance, Todd Todd Christell Manager Network Architecture and Support www.springnet.net <http://www.springnet.net> 417.831.8688 Key fingerprint = 4F26 A0B4 5AAD 7FCA 48DD 7F40 A57E 9235 5202 D508 -----BEGIN PGP SIGNATURE----- Version: 10.0.1 (Build 4020) Charset: iso-8859-1 wj8DBQFLoSZ1pX6SNVIC1QgRAubmAJ9jCx38cd+jEq3tUYwabyC/o/W2DgCaArb7 7BwL9r8E27sGhO2x394FgYE= =6CqS -----END PGP SIGNATURE-----

10 13

anti-ddos test solutions ?
by jul 18 Mar '10

18 Mar '10

Hello nanogers, Following the multiple thread on ddos attack, I was asking myself how someone could test chosen solutions. In most cases, you can't load your Internet access in the same way attackers will (does someone have a botners with ten thousands computers or more :) ?) But a solution to test basic attack (synflood, slowloris, socktress, ...) with 10 to hundred computers would be interesting, so not a tool but more a service. Found only Parabon [1] on Google Does someone know something similar ? Thanks Best regards, Jul Note: Please, don't forget this kind of public tests have some serious legal impact and you need to have an agreement with your ISP/operators to do it in most countries. Note2: Google has a lot of answers. Most of them are about tool and methodology, so not sure for a live test. I'm not looking for a lab solution but real one with business acceptation (and a wise choice on the hours of the test so front-end can be switch to "maintenance mode") [1] New grid service simulates DDoS attacks, May 2009 http://www.computerworlduk.com/technology/security-products/business-contin…

10 11

Re: Latency quesstion
by Gregory Hicks 18 Mar '10

18 Mar '10

> X-VR-Score: -70.00 > Date: Thu, 18 Mar 2010 11:48:31 -0500 > From: Larry Sheldon <LarrySheldon(a)cox.net> > To: nanog(a)nanog.org > Subject: Re: Latency quesstion > > On 3/18/2010 10:07, Larry Sheldon wrote: > > On 3/18/2010 09:56, Dennis Dayman wrote: > >> have a friend who has 21 floors of a building in DFW, multiple [...] > > It would be interesting to know where this message has been for an hour > and a half. It looks like it was stuck on machine eastrmpop110.cox.net for a while: Received: from eastrmpop110.cox.net ([68.230.240.52]) by s0.nanog.org with esmtp (Exim 4.68 (FreeBSD)) (envelope-from <larrysheldon(a)cox.net>) id 1NsIq7-00072X-DV for nanog(a)nanog.org; Thu, 18 Mar 2010 16:44:56 +0000 Received: from eastrmimpo01.cox.net ([68.1.16.119]) by eastrmmtao107.cox.net (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP id <20100318150713.FCRZ18765.eastrmmtao107.cox.net(a)eastrmimpo01.cox.net> for <nanog(a)nanog.org>; Thu, 18 Mar 2010 11:07:13 -0400 It didn't waste any time getting from you to eastrmimpop01.cox.net but took about 45 minutes to get off of eastrmpop110.cox.net. That backlog has most probably been cleared up by now. Regards, Gregory Hicks --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer | Direct: 408.569.7928 People sleep peaceably in their beds at night only because rough men stand ready to do violence on their behalf -- George Orwell The price of freedom is eternal vigilance. -- Thomas Jefferson "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

cisco as pptp client
by Ingo Flaschberger 18 Mar '10

18 Mar '10

Hi, I'm searching a working (if possible) configuration for a cisco 1841 as pptp-client. 1841 should do an pptp dialin to another cisco via ethernet-port. Kind regards, Ingo Flaschberger

1 0

Latency quesstion
by Dennis Dayman 18 Mar '10

18 Mar '10

have a friend who has 21 floors of a building in DFW, multiple switches, etc and they started to have latency issues this weekend where half if not all packet are being dropped to folder shares, printers, etc. Suggestions on how they can troubleshoot that? call in a company to help identify it? -Dennis

11 19

Re: Latency quesstion
by Brielle Bruns 18 Mar '10

18 Mar '10

Dennis, In large installations, I've always found it helpful when diagnosing LAN issues to isolate floors and departments first - using routers or with devices that can do transparent bridging. That way, you can walk through each dept/floor testing for the issues, and hopefully find only one location its still affecting. Its entirely likely that there's either a loop of some sort or a switch has gone off the deep end. If you'd like, let him know if he wants to drop me a mail, I can walk through details about the situation and hopefully help him narrow it down. ------Original Message------ From: Dennis Dayman To: nanog(a)nanog.org Subject: Latency quesstion Sent: Mar 18, 2010 7:56 AM have a friend who has 21 floors of a building in DFW, multiple switches, etc and they started to have latency issues this weekend where half if not all packet are being dropped to folder shares, printers, etc. Suggestions on how they can troubleshoot that? call in a company to help identify it? -Dennis -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org

3 2

RE: Best VPN Appliance
by Joel M Snyder 18 Mar '10

18 Mar '10

> > Thank-you all for reply and sugessting the VPN Box.?? > I'm in the process of evaluating different boxes and they are;?? > > SA4500 SSL VPN Appliance? > http://www.juniper.net/us/en/products-services/security/sa-series/sa4500/?? > > Barracuda SSL VPN? > http://www.barracudanetworks.com/ns/products/sslvpn_overview.php > > F5 ??FirePass SSL VPN > ?http://www.f5.com/products/firepass/ > > The problem i'm facing so far is MAC OS X compatibility. The demo box i had for Juniper was not able to run Network Connect on MAC OS 10.5.8. The Juniper SSL VPN works great with Mac 10.6 (and prior versions going back about 5 years). I'm not sure what issue you might be seeing, but Network Connect is very solid in that environment. Secure Meeting also works fine on the Mac. The place where you will have compatibility issues is the end-point security checking, but this is common to all OS X. If you're not doing EPS checking, you don't care. If you are, you already know that Macs have a different set of software & vocabulary than Windows platforms. >>From your experience from F5, Juniper and Barracuda, which one will be best in terms of; > > 1) Support > 2) Resiliency > 3) Security > 4) Scalability > 5) Manageability The Barracuda box is very new and I haven't looked at it, but certainly the Juniper and F5 boxes are top contenders; you should also be looking at SonicWALL (which used to be Aventail). Your laundry list above is fairly vague, since you don't list YOUR requirements. However, I did a very extensive test of SSL VPN devices a few years ago which is still VERY applicable to the products that were in it. This is considered a fairly mature market, and the F5 box of today is not very different from the one of three years ago. You might consider figuring out what you want to do with the box, and then measuring the contenders against that, rather than asking "which is the most scalable," since in the NANOG context that could mean anything from "two-node active/active cluster" to "geographic clustering in 40 data centers." (Nick will at this point chime in with his now-famous "string analogy") Try reading this: http://www.networkworld.com/reviews/2005/121905-ssl-test-intro.html?rl It's dated 2005, so you can assume that annoying bugs are fixed, but product feature sets are very similar. There's also some more recent SSL VPN testing I've done in Network World, such as the Netgear box (not designed for the enterprise) and just last week the Microsoft one. Note that Network World writes for enterprises, and NANOG is a service provider mailing list, so depending on why you're asking for this, my results may or may not be applicable. For example, features like delegated and partitioned management, which are SP-critical but often ignored in the enterprise, weren't really part of my evaluation. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

1 0

Hotmail/MSN email admin
by Daniel Staal 18 Mar '10

18 Mar '10

If there are any Hotmail/MSN email admins on this list, could you please contact me offlist at Daniel.T.Staal(a)uscg.dhs.gov Thanks. Daniel T. Staal --------------------------------------------------------------- This email copyright the author. Unless otherwise noted, you are expressly allowed to retransmit, quote, or otherwise use the contents for non-commercial purposes. This copyright will expire 5 years after the author's death, or in 30 years, whichever is longer, unless such a period is in excess of local copyright law. ---------------------------------------------------------------

1 0

Re: Best VPN Appliance
by Stefan Fouant 18 Mar '10

18 Mar '10

Toivo, The SA Series absolutely supports IPsec if you are using Network Connect. It defaults to using IPsec and if that is not supported then it will fall back to SSL. Of course, NC is not as secure as W-SAM, J-SAM, or Core Access in terms of role and resource granularity control but the support for IPsec is absolutely there. HTHs. Stefan Fouant ------Original Message------ From: Voll, Toivo To: Chris Campbell To: Dawood Iqbal Cc: nanog(a)nanog.org Subject: RE: Best VPN Appliance Sent: Mar 8, 2010 11:56 AM We're generally happy with our Juniper SA6500s, but they, and a lot of the other SSL VPN vendor appliances will not support IPSec. Cisco's ASA does, but it's less feature-rich in the SSL VPN arena. The Juniper was the most mature and flexible of all the offerings we looked at, but also the most expensive, and it's not perfect either. Having migrated from Cisco's 3000 series appliances, the current SSL VPNs are a totally different mindset and about two orders of magnitude more complicated. Have a very good understanding of exactly what problem you're trying to solve with the product and what kind of policies and requirements you have to meet, or it's going to be a mess. I can answer more specific questions on our experiences and testing off-list. -- Toivo Voll University of South Florida Information Technology Communications -----Original Message----- From: Chris Campbell [mailto:Chris.Campbell@nebulassolutions.com] Sent: Friday, March 05, 2010 11:36 AM To: Dawood Iqbal Cc: nanog(a)nanog.org Subject: Re: Best VPN Appliance The Juniper SA is by far and away the market leader and in my opinion the best end user experience. On 5 Mar 2010, at 15:57, Dawood Iqbal wrote: > Hello All, > > > > Is it possible to get your ideas on what VPN appliances are good to have in > enterprise network? > > > > Requirements are; > > SSL > > IPSec > > Client and Web VPN support (Win/MAC/iPhone/Android) > > If webvpn is used, then when any user connects via webvpn, we should be able > to re-direct him to any and ONLY specific application i.e SAP. > > If 2 boxes are installed then they should replicate data seamlessly. > > > > > > Regards, > > dI > Sent from my Verizon Wireless BlackBerry

16 16

Announcing: Ruby API for xtractr
by kowsik 18 Mar '10

18 Mar '10

What started off as a way to unit test the RESTful API for xtractr has now turned into a Ruby gem that we are releasing as open source. First xtractr, then nuggets and now a gem. We are happy to announce a Ruby gem for xtractr which takes all the goodness of Ruby and interacts RESTfully with xtractr for oh-so-fun network forensics and troubleshooting all from within IRB, the interactive Ruby shell. Blog: http://bit.ly/baW3zZ Code: http://code.google.com/p/pcapr/ Thanks, K. --- http://www.pcapr.net/ http://www.mudynamics.com http://labs.mudynamics.com http://twitter.com/pcapr

1 0