- NANOG - lists.nanog.org

Ipsec/VRF Mpls ?
by Stephane MAGAND 24 Dec '09

24 Dec '09

Hi after a first post with 0 answer (very thanks ..) i test a second post for get a small help. I am search a simple sample of configuration for a cisco 2821 for connect a Ipsec routers ton a MPLS IP VPN Backbone My cisco 2821 have two interface, one connected at my MPLS network and the second at the Internet. I create two vrf, one for a site to site and the second for a Remote User Access anyone have this into a config ? because i never have used Ipsec actually on cisco. The site-to-site router are a C1721, and remote user use cisco IPSEC client and i want a radius authentification (and it's the radius that sent the vrf) thanks for your help Stephane

2 1

re: used hardware
by Bill Lewis 24 Dec '09

24 Dec '09

http://www.networkhardware.com/ContactNHR/ Mostly Cisco, but I think they'll do Juniper. Bill ---------------------------------------------------------------------- -Date: Fri, 18 Dec 2009 04:34:05 -0800 -From: Mehmet Akcin <mehmet(a)akcin.net> -Subject: used hardware.. -To: "nanog(a)nanog.org list" <nanog(a)nanog.org> -Message-ID: <16E6D13C-AB9C-4EA5-8E73-59172DD2866B(a)akcin.net> -Content-Type: text/plain; charset=us-ascii -Hello there.. -I am looking to sell and buy some used hardware, where is the best place for this, other than ebay ? -Mostly juniper stuff -thanks in advance. -Mehmet

3 2

Re: [NANOG] Roport on internet business
by Scott Weeks 24 Dec '09

24 Dec '09

--- takashi(a)cpqd.com.br wrote: From: "Takashi Tome" <takashi(a)cpqd.com.br> Morgan Stanley has released a very interesting report on internet business with some tips to net operators: http://www.morganstanley.com/institutional/techresearch/mobile_internet_rep… ------------------------------------------------------- It must be purchased: ---------------------- The Mobile Internet Report To receive a printed copy of The Mobile Internet Report, please contact your Morgan Stanley Representative. To purchase a copy, please click here. ---------------------- scott

5 5

UltraDNS Failure?
by Mark Pace 24 Dec '09

24 Dec '09

Anyone else having problems resolving DNS from UltraDNS? I'm seeing this: $ dig www.ultradns.com @8.8.8.8 ; <<>> DiG 9.6.0-P1 <<>> www.ultradns.com @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 26650 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.ultradns.com. IN A ;; Query time: 38 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Wed Dec 23 16:59:39 2009 ;; MSG SIZE rcvd: 34 $ dig www.ultradns.com +trace ;; Truncated, retrying in TCP mode. ; <<>> DiG 9.6.0-P1 <<>> www.ultradns.com +trace ;; global options: +cmd . 490316 IN NS d.root-servers.net. . 490316 IN NS k.root-servers.net. . 490316 IN NS j.root-servers.net. . 490316 IN NS h.root-servers.net. . 490316 IN NS g.root-servers.net. . 490316 IN NS m.root-servers.net. . 490316 IN NS c.root-servers.net. . 490316 IN NS i.root-servers.net. . 490316 IN NS b.root-servers.net. . 490316 IN NS e.root-servers.net. . 490316 IN NS a.root-servers.net. . 490316 IN NS l.root-servers.net. . 490316 IN NS f.root-servers.net. . 490316 IN NS d.root-servers.net. . 490316 IN NS k.root-servers.net. . 490316 IN NS j.root-servers.net. . 490316 IN NS h.root-servers.net. . 490316 IN NS g.root-servers.net. . 490316 IN NS m.root-servers.net. . 490316 IN NS c.root-servers.net. . 490316 IN NS i.root-servers.net. . 490316 IN NS b.root-servers.net. . 490316 IN NS e.root-servers.net. . 490316 IN NS a.root-servers.net. . 490316 IN NS l.root-servers.net. . 490316 IN NS f.root-servers.net. ;; Received 717 bytes from 10.23.69.254#53(10.23.69.254) in 52 ms com. 172800 IN NS C.GTLD-SERVERS.NET. com. 172800 IN NS A.GTLD-SERVERS.NET. com. 172800 IN NS G.GTLD-SERVERS.NET. com. 172800 IN NS I.GTLD-SERVERS.NET. com. 172800 IN NS D.GTLD-SERVERS.NET. com. 172800 IN NS E.GTLD-SERVERS.NET. com. 172800 IN NS B.GTLD-SERVERS.NET. com. 172800 IN NS J.GTLD-SERVERS.NET. com. 172800 IN NS K.GTLD-SERVERS.NET. com. 172800 IN NS H.GTLD-SERVERS.NET. com. 172800 IN NS F.GTLD-SERVERS.NET. com. 172800 IN NS L.GTLD-SERVERS.NET. com. 172800 IN NS M.GTLD-SERVERS.NET. ;; Received 522 bytes from 192.228.79.201#53(b.root-servers.net) in 70 ms ultradns.com. 172800 IN NS pdns1.ultradns.net. ultradns.com. 172800 IN NS pdns2.ultradns.net. ultradns.com. 172800 IN NS pdns3.ultradns.org. ultradns.com. 172800 IN NS pdns4.ultradns.org. ultradns.com. 172800 IN NS pdns5.ultradns.info. ultradns.com. 172800 IN NS pdns6.ultradns.co.uk. ;; Received 237 bytes from 192.52.178.30#53(K.GTLD-SERVERS.NET) in 374 ms ;; connection timed out; no servers could be reached

4 8

Re: UltraDNS Failure?
by Stefan Fouant 24 Dec '09

24 Dec '09

There have been several DNS based DDoS observed throughout the day targetting Ultra as well as a few other companies. They were first observed earlier in the morning on the East coast. ------Original Message------ From: Richard A Steenbergen To: Shrdlu Cc: Nanog Subject: Re: UltraDNS Failure? Sent: Dec 23, 2009 8:42 PM On Wed, Dec 23, 2009 at 05:38:21PM -0800, Shrdlu wrote: > I'm still seeing the DNS servers at udns down, hard. Amazon's cloud will > need a reboot when this is over. Dang, what the heck happened to all > that anycast stuff? We have some DNS providing type customers (not UltraDNS) receiving a few million packets/sec of UDP/53 DoS traffic, starting at about the same time as the UltraDNS problems. No clue if it's related, but it certainly sounds suspicious. :) -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC) Sent from my Verizon Wireless BlackBerry

1 0

Re: [NANOG] Roport on internet business
by Scott Weeks 24 Dec '09

24 Dec '09

------- scott(a)doc.net.au wrote: ---------- From: Scott Howard <scott(a)doc.net.au> On Wed, Dec 23, 2009 at 3:01 PM, Scott Weeks <surfer(a)mauigateway.com> wrote: > It must be purchased: Only if you want the dead-tree edition. The others are linked below the text you've quoted. ---------------------------------------------- DOH! I blame it on Christmasits. It's a bad disease I recently caught... ;-) Apologies for the confusion. Have a great Christmas! scott

1 0

IGMP and PIM protection
by Glen Kent 24 Dec '09

24 Dec '09

Hi, Any idea if folks use AH or ESP to protect IGMP/PIM packets? Wondering that if they do, then how would snooping switches work? Affably, Kent

6 11

looking for a contact at Orange
by andrew young 23 Dec '09

23 Dec '09

if anyone has a contact at Orange or is from Orange, can you contact me off list. need help with some issues originating from the EU. -- ---------------------------------------- Andrew Young Webair Internet Development, Inc. Phone: 1 866 WEBAIR 1 x143 http://www.webair.com Shift hours: Tues-Friday 12PM-8PM, Sat 9AM-5PM

1 0

FYI, new USG Cybersecurity Coordinator ...
by Jorge Amodio 23 Dec '09

23 Dec '09

FYI, http://www.whitehouse.gov/blog/2009/12/22/introducing-new-cybersecurity-coo…

8 9

Re: IGMP and PIM protection
by David Barak 23 Dec '09

23 Dec '09

Multicast encryption using GDOI works well, although I haven't seen that implemented on a LAN. If you're trying to provide encryption for LAN listeners (more accurately to exclude some LAN listeners) you'll probably find more bang for the buck in implementing this on a per-application basis. That leaves the IGMP request subject to eavesdropping, but the data itself flows over a secure channel. If instead you want the IGMP itself to be encrypted, then you'll need all of the switches to participate in the security protocol, and I would imagine that there are far easier ways to provide secure connections. I believe GDOI is esp-only. Cisco's term for GDOI is GETVPN. -David Barak On Wed Dec 23rd, 2009 7:26 AM EST Peter Hicks wrote: >Glen Kent wrote: >> Any idea if folks use AH or ESP to protect IGMP/PIM packets? Wondering >> that if they do, then how would snooping switches work? >> >Would encrypting multicast not fundamentally break the concept of multicast itself, unless you're encrypting multicast traffic over a backbone? > > >Peter > > >

1 0