- NANOG - lists.nanog.org

Single router for P/PE functions
by Serge Vautour 04 Sep '09

04 Sep '09

Hello, I'm pretty confident that a router can be used to perform P & PE functions simultaneously. What about from a best practice perspective? Is this something that should be completely avoided? Why? We're considering doing this as a temporary workaround but we all know temporary usually lasts a long time. I'd like to know what kind of mess awaits if we let this one go. Thanks, Serge __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

4 4

Re: Single router for P/PE functions
by Erik Schmersal 04 Sep '09

04 Sep '09

Hi dave, Our setup was a dual ring with two devices common to both rings. It used a full mesh of LSP's but the majority of traffic was L3VPN. There were some VPLS connections as well, maybe a total of 30 VLAN's. LSP's were set up with static path's the short way around the ring and a standby active secondary path the long way around. Convergence time for a failure on either ring was barely noticable. I am no longer with that organization so I can't get access to the gear anymore :( >From my experience, you are probably just asking the EX4200 to do more than it was made to do. That is a lot of CCC circuits to reallocate on the fly, especially for a smaller device. You may me able to reduce convergence time by making your LSP's static with a standby secondary so the path is preconfigured when a failover occurs, the only problem with this is the scalability gets poor quickly as you start to add devices. Erik On Fri, Sep 4, 2009 at 8:39 AM, daveb <spike(a)zitomedia.net> wrote: > > Hi, I saw your response on NANOG and have a couple questions for you if you > don't mind. I'm doing a similar design with MPLS (OSPF/RSVP) on EX4200s in > a 10GE ring, mainly for 'ccc' circuits and IP connectivity. The EX4200 > serves both the P and PE functions and some of my rings may be as large as > 30 devices. > > In my informal lab test with just 4 EXs in a ring, the convergence time > (optomized with FRR, path protection and 50ms BDF) for 1 ccc circuit was > 300ms and with 200 ccc circuits it was several seconds, and 800 kills the > box. I can't imaging what it would be like with 20 or 30 device in the > ring. > > I was just wondering if you've doen similar testing with the MX as far as > scaling. I'm assuming the EX4200 just isn't up to the task but I'm also > concerned that ring topologies are problematic for re-routing LSPs. I can > test to find the optimum/maximum number of allowable ccc circuits with 4 > devices in the ring but I have no way or testing with 20 or 30 so I'm really > trying to determine how much worse convergence is with more devices vs > number of LSPs. > > Thanks, > Dave Bernardi > > > > At 12:00 AM 9/4/2009, Erik Schmersal wrote: > >> > Not only can they, it's done quite frequently. I just completed a >> >> deployment of seven Juniper MX series routers in a dual ring >> configuration, >> >> all acting as combination P/PE devices for a state government WAN >> backbone. >> >> Works like a charm. >> >> >> >> Erik >> >> >> >> >> >> On Thu, Sep 3, 2009 at 10:20 AM, Serge Vautour <sergevautour(a)yahoo.ca >> >wrote: >> >> >> >>> Hello, >> >>> >> >>> I'm pretty confident that a router can be used to perform P & PE >> >>> functions simultaneously. What about from a best practice perspective? >> Is >> >>> this something that should be completely avoided? Why? We're >> considering >> >>> doing this as a temporary workaround but we all know temporary usually >> lasts >> >>> a long time. I'd like to know what kind of mess awaits if we let this >> one >> >>> go. >> >>> >> >>> Thanks, >> >>> Serge >> >>> >> >>> >> >>> >> >>> >> __________________________________________________________________ >> >>> Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark >> your >> >>> favourite sites. Download it now >> >>> http://ca.toolbar.yahoo.com. >> >>> >> >>> >> >> >> > >> > >

2 1

draft-iana-ipv4-examples
by Ron Bonica 04 Sep '09

04 Sep '09

Folks, The IETF has recently passed draft-iana-rfc3330bis-08. This draft documents the fact that the following address ranges have been reserved for documentation: - 192.0.2.0/24 (TEST-NET-1) - 198.51.100.0/24 (TEST-NET-2) - 203.0.113.0/24 (TEST-NET-3) In addition, some authors have used 128.66.0.0/16 (TEST-B) for example purposes. There is no RFC that talks about this block, but my understanding is that IANA/ARIN have marked it as reserved. If you search the Internet you will find at least some number of examples and firewall rule sets that use this block, but I have no good idea about how widespread such usage is. What should we do about this block? Some of the potential answers include documenting its role, marking it as reserved but deprecating its use in examples, and returning it to the free pool immediately (with a warning sign about possible filtering problems). Comments? Ron

2 1

picking up server vendor in a global scope..
by Mehmet Akcin 04 Sep '09

04 Sep '09

Hey, Let's say you want to pick a server vendor and you don't necessarily want to buy from one country and ship it to 50 different locations but instead buy them locally in each country, and also have local parties provide support. If you were to compare brands such as Dell, IBM, HP, Supermicro (or any other vendor?) which one you would recommend for this kind of approach? The server specs are fairly standard. Nothing extraordinary.. and expected support isn't also 7/24/365 but a decent next day -5 hours M- F type of deal.. thanks for responses.. Mehmet

4 3

Re: Single router for P/PE functions
by Erik Schmersal 04 Sep '09

04 Sep '09

> Not only can they, it's done quite frequently. I just completed a >> deployment of seven Juniper MX series routers in a dual ring configuration, >> all acting as combination P/PE devices for a state government WAN backbone. >> Works like a charm. >> >> Erik >> >> >> On Thu, Sep 3, 2009 at 10:20 AM, Serge Vautour <sergevautour(a)yahoo.ca>wrote: >> >>> Hello, >>> >>> I'm pretty confident that a router can be used to perform P & PE >>> functions simultaneously. What about from a best practice perspective? Is >>> this something that should be completely avoided? Why? We're considering >>> doing this as a temporary workaround but we all know temporary usually lasts >>> a long time. I'd like to know what kind of mess awaits if we let this one >>> go. >>> >>> Thanks, >>> Serge >>> >>> >>> >>> __________________________________________________________________ >>> Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your >>> favourite sites. Download it now >>> http://ca.toolbar.yahoo.com. >>> >>> >> >

1 0

Power basics- any resources?
by Darren Bolding 04 Sep '09

04 Sep '09

I need to teach an operations group (Systems, Network, Security, IT folks) some basics of power as it applies to the team. Normal things they will see and should understand when they are planning on bringing equipment online etc. I have an idea of many things to talk about, particularly as they apply to our environment, but I was hoping there might be some publicly available slides or docs that I could take advantage of. I'll be happy to share anything we come up with- though this may just be me in front of a whiteboard. Here are some of the questions I plan to cover: What are amps, volts and watts? What are Volt-Amps, and why do they matter? How much can I load that circuit? How does a breaker work? Where are the breakers at our sites? What should you do if a breaker trips? How do we know how much load a device will place on a circuit? How do we monitor power usage? Basic safety. Redundant power. Thanks for any pointers! -- -- Darren Bolding -- -- darren(a)bolding.org --

4 3

Request for a pointer - Linux modifying DSCP on replies?
by Darren Bolding 04 Sep '09

04 Sep '09

I believe this is operational content, but may well be better asked somewhere else. I would love to have a pointer to another list/website. I am looking to do some policy routing based on DSCP marking, and I have this all working inside the networking equipment. I DSCP mark some packets at ingress and I policy-route others based on ACL's matching those DSCP markings. This should allow me to solve some problems in a rather elegant manner, if I do say so myself. And this works fine for some things- I have verified that Ping's to a host work as expected- the Ping shows up at the destination host DSCP marked, and the ICMP reply leaves with the same DSCP marking. However, when I do this with apache and mysql connections (TCP 80/3306), the incoming packets are marked, but the replies are not. My research into the subject doesn't seem to suggest there is a standard for whether replies to a TCP connection are required to have the same DSCP marking, but it seems to make a lot of sense that they would. I've disabled iptables on the server host to no avail. I've looked around for an apache or Linux kernel setting and found nothing. At this point I'm looking for pointers- to a way to solve this issue, or to a better place to ask. I've started investigating writing iptables rules to match incoming connections that have DSCP marking and explicitly mark response traffic, but that seems, I don't know... wrong. Linux kernel we are using is 2.6.9-67.ELsmp. Any help or pointers would be appreciated! --D -- -- Darren Bolding -- -- darren(a)bolding.org --

4 5

83.222.0.0/19 Unroutable on Verizon
by Peter Beckman 03 Sep '09

03 Sep '09

I can't reach 83.222.0.0/19 from Verizon, but I can via Cox Communications Business Fiber as well as Level3. Dies at a peering point it seems: HOST: home Loss% Snt Last Avg Best Wrst StDev 1. mph 0.0% 20 0.7 0.6 0.5 0.7 0.1 2. 10.1.41.89 0.0% 20 2.3 3.6 1.7 26.4 5.6 3. G2-0-3-891.WASHDC-LCR-08.ver 0.0% 20 2.1 1.9 1.6 2.2 0.2 4. so-1-1-0-0.RES-BB-RTR2.veriz 0.0% 20 2.3 2.4 2.2 2.8 0.1 5. 0.so-6-1-0.XL4.IAD8.ALTER.NE 0.0% 20 2.8 2.8 2.6 3.0 0.1 6. 0.xe-8-1-0.BR1.IAD8.ALTER.NE 0.0% 20 5.1 8.4 3.0 40.3 9.4 7. 64.212.107.157 0.0% 20 203.2 14.0 3.0 203.2 44.6 8. ??? 100.0 20 0.0 0.0 0.0 0.0 0.0 Hop 7 alternates between 64.212.107.157 (GBLX) and 204.255.169.202 (MCI dba Verizon) and dies after that. 83.222.32.0/19 seems to route correctly. Can anyone else confirm? Bad BGP Announcement? Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman(a)angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------

4 4

NANOG47 - Program Committee will meet next week to review second round submissions
by Ren Provo 03 Sep '09

03 Sep '09

Hi folks, There are many interesting abstracts in the tool at http://pc.nanog.org and we hope to see a few more presentations arrive prior to next Wednesday. Lightning talks will not be accepted until October. That doesn't mean you can't kick out that first draft to a friend for inspiration! Election season is also drawing close. The election timeline is now online at http://www.nanog.org/governance/elections/2009elections/ Last but not least, the hotel group rate expires this month - http://www.nanog.org/meetings/nanog47/hotel.php Cheers, -ren

1 0

Got this from Educause...
by Robert Mathews (OSIA) 03 Sep '09

03 Sep '09

Apologies in advance, to those who, as administrators of EDU domains, may have already received this from EDUCASE... Finally, DNSSEC is going to make its way to ".edu" Are we ready? Has resistance been obliterated? Test-bed implementation.. Sept, '09.... -- -------- Original Message -------- Subject: Security of .edu Internet Domain to Increase September 3, 2009, Washington, D.C.—EDUCAUSE and VeriSign announced today the initiation of a project to enhance Internet reliability and stability. By the end of March 2010, the project will deploy a security system known as Domain Name Security Extensions (DNSSEC) within the .edu portion of the Internet, which EDUCAUSE manages under a cooperative agreement with the U.S. Department of Commerce. When the project is completed, institutions whose domain names end in .edu will be able to incorporate a digital signature into those names to limit a variety of security vulnerabilities. The Domain Name System (DNS) is the part of the Internet that translates names such as "educause.edu" into numeric addresses (for example, 198.59.61.90). All Internet applications—from electronic mail to online banking—depend on the accuracy and integrity of this translation. Over the years, Internet security experts have discovered a variety of ways that DNS translation may be compromised. The DNSSEC security system limits the problem by allowing owners of domain names to provide a digital signature that adds an extra level of authentication to the translation process. The project plan includes a test-bed implementation, targeted for September 2009, to allow predeployment testing by a number of selected campuses in a nonproduction environment. Final deployment of DNSSEC for .edu will build on the previously announced U.S. Department of Commerce project to deploy DNSSEC at the authoritative root zone of the Internet. [ .... ]

1 0