- NANOG - lists.nanog.org

RE: COnfiguration Suggestion - Etherchannel
by Michel Py 28 Jul '04

28 Jul '04

> Richard J. Sears wrote: > I am running a 6509 with Dual SUP720's in IOS mode only >(no cat software). It was pointed out that there are really > two different ways to configure the switch - I guess my > question is which is the best (lowest overhead, etc)? The two you posted are equivalent; the second one simply uses the default VLAN, amount of overhead is the same. Now, there is a third method (trunking) that allows your etherchannel to carry multiple VLANs at the same time (you would use encap dot1q). If you connect two large switches for the same organization, you likely want the trunk to carry all your VLANs. In your case, I believe one VLAN to connect the customer is enough, so your config is fine IMHO. Michel.

1 0

Re: SPF deployment by Oct. 1 ?
by Douglas Otis 27 Jul '04

27 Jul '04

On Tue, 2004-07-27 at 13:38, James Couzens wrote: > On Sat, 2004-07-24 at 18:49, John Bittenbender wrote: > > http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html > > > > As a side note, I notice that the article mentions a submission to the > > IETF but I haven't seen any RFC's related, if there is one out there > > can someone please point it out for me? > > > > I didn't see anything obvious here: > > > > http://www.ietf.org/html.charters/dnsop-charter.html > > > > or here: > > > > http://darkwing.uoregon.edu/~llynch/dnsop/ > > > > Looking in the wrong place? > > The "MARID" version of SPF is a bastardization of the original SPF being > called SenderID in that they are trying to cram as much crap into it as > they can. Although it appears that the idea of storing "SenderID" > records in XML as DNS records has been averted I'm extremely sceptical > that anything will come of that group in the near future. > > As for people parsing SPF records and dropping email as a result of a > FAIL response, there are some groups out there doing this. Verizon > tried for a few days I believe and then quickly reverted when they > realized the error in doing so. I think its much to soon to be doing > this especially in view of the forwarding problem with SPF. > > The MARID list is pretty useless for anyone seeking information, and > actually its pretty useless even if you are trying to subject the > proposed protocol to any idea you might have as many on the list have > disregarded valid issues several times. Perhaps this is to retain > focus, or perhaps its because they think they know better, this is my > opinion in view of what I have witnessed thus far. You will find a > better reception on the SPF-DISCUSS list as is hosted by spf.pobox.com. > You can find links to it on the spf.pobox.com site by clicking on the > "Forums" link (poorly worded I know, the old site was much better). Sender-ID employs existing SPF records intended to qualify the RFC 2821 MAIL FROM, but then fully ignores the RFC 2821 MAIL FROM. Sender-ID introduces "Purported Responsible Address" (PRA) from the RFC 2822 headers, where differing types trump more recent headers. The author of SPF and owner of spf.pobox.com dropped the MAIL FROM strategy of ASRG to adopt this proprietary scheme of Microsoft. PRA will not abate the bounce traffic. PRA is not able to end Phishing as touted either. A message can be fully validated by including a header such as Resent-From: random.random.Starbucks.to where the From seen by the user could be anyone. There is no means to accredit the administration of the domain accountable for the introduction of the spam either. With the typical scale otherwise needed, many publish their records open-ended to allow mail sent from differing points of access. If a common relay point were published in a closed-ended fashion, then those sharing this server would know they could forge mail for that domain as fully validated. The number of DNS lookups to obtain the "record set" could include hundreds of queries. There is a timeout of 20 seconds for obtaining perhaps dozens of references contained within a single "SPF" record, such as PTR, MX, A, AAAA. If a timeout occurs, the message receives a 450 temp error and is to be repeated at some point. A new series of DNS queries is immediately started for the next message. Without exceeding Sender-ID time limits, the process can continue for more than 3 minutes per message. It also threatens network stability with high levels of UDP traffic together with premature termination and overlay of these queries. With IPS's transparent interception of SMTP traffic, mail may go missing if this is not known before hand. Defining an "open" record set could swamp DNS with spammer abuse. Forget about mail forwarding working. But, by all means, publish, publish, publish. Caveat Emptor. Publisher beware. MARID http://www.ietf.org/html.charters/marid-charter.html (note, the marid-protocol links are in error). Sender-ID drafts: http://www.ietf.org/internet-drafts/draft-ietf-marid-submitter-02.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-core-02.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-protocol-00.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-rationale-00.txt CSV drafts: http://www.ietf.org/internet-drafts/draft-ietf-marid-csv-intro-01.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-csv-csa-01.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-csv-dna-01.txt There is an alternative solution that can do something to protect the networks and not break mail. The Client SMTP Validation (CSV) drafts provides a solution to ensure the SMTP client can be both authenticated and authorized to send mail. If used in conjunction with SPF, it could effectively thwart spam and Trojan systems. PRA however, keeps the door open. : ( There is a possible alternative to SPF that uses a DomainKey approach to sign the RFC2821 MAIL FROM using the local part called Bounce Address Tag Validation (work in progress). http://www.brandenburg.com/specifications/draft-crocker-marid-batv-00-06dc.… There is also work ongoing to provide an effective means to identify the sender (work in progress). http://www.ietf.org/internet-drafts/draft-fenton-identified-mail-00.txt -Doug

1 0

Re: ad.doubleclick.net missing from DNS?
by Robert Bonomi 27 Jul '04

27 Jul '04

>From owner-nanog(a)merit.edu Tue Jul 27 11:37:36 2004 Date: Tue, 27 Jul 2004 12:34:04 -0400 (EDT) From: Sean Donelan <sean(a)donelan.com> To: nanog(a)merit.edu Subject: ad.doubleclick.net missing from DNS? The A record for ad.doubleclick.net is missing from DNS. This is causing apparent web page slowdowns when viewing web sites containing ads linked to ad.doubleclick.net Aw, shucks. <weeping type="tears" sub-type="crocodile"> Couldn't happen to a more deserving company.

1 0

RE: 2511 line break
by Michel Py 27 Jul '04

27 Jul '04

>> Michel Py wrote: >> Dumb Cisco/SSH question: how do you get a banner to >> display _before_ the ssh user/pass prompts? > Christopher McCrory wrote: > On older IOS images with SSH protocol 1 , you can't > because the protocol does not support it. You need > SSH protocol 2. IIRC, only found in very newer > 12.3.x releases. This doesn't help 12.0.xS :( That's what I feared, and the firewall feature is so broken in 12.3 that it makes it unusable for the moment; I rolled back to 12.2(T) including for lab, and 12.2(T) still uses SSH 1.5 :-( Jul 27 08:48:02.805 PST: %SSH-5-ENABLED: SSH 1.5 has been enabled cisco7507#sh ssh Connection Version Encryption State Username 1 1.5 3DES Session started dude Michel.

1 0

What ever happened to... MARP (Multi-Access Reachability Protocol)
by Sam Stickland 27 Jul '04

27 Jul '04

Last draft appeared to be http://www.watersprings.org/pub/id/draft-retana-marp-02.txt which expired Sept 2003 (Abstract: defines a protocol to quickly determine the existence or aliveness of devices attached to a shared media (broadcast) subnet.) First read about it in this presentation, where it was billed as an alternative to fast hellos: http://routing.internet2.edu/wg-meetings/20021029-I2rwg-slides/20021029-dau… The idea was that a switch could notify connected routers of link failures immediately - there would be no need to wait for the dead and hold-timers to expire. Is this idea still flying? There appears to be very little on the net about it, except what I've mentioned above. Sam

2 1

RE: 2511 line break
by Michel Py 27 Jul '04

27 Jul '04

MP> Michel Py typed: MP> Same here. There is more CPU power in a dishwasher than in MP> a 2611 these days. > Rafi Sadowsky > Did you mean a 2511? Doh, yes! Thanks for correcting. The 2600 is quite more capable, that would be a DVR not a dishwasher (no joke: the TiVo DVR is a low-end PowerPC with 32 megs, see photos here: http://home.pacbell.net/arn-py/tivo/) > Joe Abley wrote: > but the ssh client session does actually complete, and I > can type commands. This is on a 2511 which is doing precisely > nothing else -- no routing protocols, just a single async port > connected to the console on a FreeBSD box. No real-world production application; first, it has 16 async lines, you would expect to be able to have two different users use two of them at the same time. This is what terminal servers are for. Second, if you need to use one of the serial ports to access the router with PPP, have an access-list to restrict telnet/SSH access, log anything, you're SOL. The 2511 is a perfectly good CCIE Lab terminal server though, no need for SSH. For what I have read, lots of people here could use a little practice. There's this story about the guy flying 10,000 miles coming to SJ to take the lab (before a testing center opened in Asia) and could not get through the first line of the first lab question (which is to configure the 2611 to access all the other devices using reverse telnet) and flew back home with a brilliant 0 points. There's no point using SSH when the router's enable password is "cisco", or is there? Michel.

1 0

RE: 2511 line break
by Michel Py 27 Jul '04

27 Jul '04

> Joe Abley wrote: > There are no ssh loads for the 2511 that allow you to actually > use ssh with a non-null cypher without triggering watchdog > timers on the router though, last time I checked. Same here. There is more CPU power in a dishwasher than in a 2611 these days. Dumb Cisco/SSH question: how do you get a banner to display _before_ the ssh user/pass prompts? Michel.

2 1

2511 line break
by Randy Bush 27 Jul '04

27 Jul '04

on a 2511, which i am using as a serial console server for a bunch of boxes, how do i send a <break> on one of the lines? randy

12 19

isp software suite
by Ingo Flaschberger 27 Jul '04

27 Jul '04

Hi i'm searching an isp management software suite. we need: service provisioning mail web dns dsl ethernet billing ip-address management ... i have searched a lot at the internet and looked at much software, but all of them looks like for "small" isp's, but we need a software suite for middle to big. if you are an isp and have coded your own, really great software and want to share it, please contact me off-list. bye, Ingo Flaschberger Network Operations --- Cable One GmbH fix: +43 (0)720 101 604 mail: if(a)cableone.at mobil: +43 (0)699 105 86 719

1 0

RE: 2511 line break
by Michel Py 26 Jul '04

26 Jul '04

> Dickson, Brian wrote: > IIRC, 2511's look the same as the aux on any Cisco box. > For those, it is "CTRL-carat x", where carat is '^', s/carat/caret ctrl-shift-6 x sends you back to the router prompt, it does not send a break. ctrl-shift-6 b does send a break. Michel.

1 0