- NANOG - lists.nanog.org

Re: T1 Customer CPE Replacement?
by Curtis Maurand 25 Feb '04

25 Feb '04

They're still in business. They've been bought out, but they're still there. Curtis On Tue, 24 Feb 2004, Sameer Khosla wrote: > Just to add my 2 cents, I have installed a lot of Openroute routers over the > years, and have had virtually no problems with them. There is a GTX 1000 > Model that is modular, for which there are T1 CSU modules available. I > believe there were DSL modules as well. There was also a GTX1500 model > which had the encryption hardware for VPN's. > > If anyone is interested, drop me a line and I'll do some digging with one of > their former SE's. He has access to a fair supply of them. > > Sameer > > ----- Original Message ----- > From: "Curtis Maurand" <curtis(a)maurand.com> > To: "Brian Bruns" <bruns(a)2mbit.com> > Cc: "Claydon, Tom" <Tom.Claydon(a)DobsonTelco.net>; <nanog(a)merit.edu> > Sent: Tuesday, February 24, 2004 1:35 PM > Subject: Re: T1 Customer CPE Replacement? > > > > > > > > I had excellent luck with OpenRoute (formerly Proteon) GT90's. They > > handle dual ethernet or T1/E1. They need an external CSU/DSU, but they > > get the job done and they're very stable. They will do NAT and most of > > the other goodies that you can think about. They also have gt900 firewall > > and they have a model with a hardware accelerator to handle cryptographic > > calculations. I installed one of the latter into a customer about 4 years > > ago and I've not had any trouble with it, except to upgrade the OS once to > > fix some wierd packet length issues surrounding IPSEC tunnels. > > > > http://www.openroute.com > > > > Curtis > > > > > > On Mon, 23 Feb 2004, Brian Bruns wrote: > > > > > > > > On Monday, February 23, 2004 3:37 PM [EST], Claydon, Tom > > > <Tom.Claydon(a)DobsonTelco.net> wrote: > > > > > > > Hello, > > > > > > > > We're looking for a good replacement for fractional T1 customers with > Cisco > > > > 1600- & 1700-series routers as their CPE. They are good routers, but > the > > > > ongoing support costs are an issue, and we need to replace them ASAP. > > > > > > > > Someone had mentioned several CPE vendors, such as Adtran and Netopia. > Are > > > > there any others, and does anyone have any pros/cons of what they're > > > > familiar with? > > > > > > > > > > > > > > I'm quite familiar with the Netopia R53xx series T1 routers. Excellent > little > > > routers for deplyoing to customers. Very reliable, and if you are > familiar > > > with the DSL routers, you'll be right at home. They have built in > > > PPTP/ATMP/IPSec VPN support (both client and server), basic routing > features, > > > filtering, NAT, one-to-one IP mapping, remote syslog logging, as well as > > > everything you'd expect in a T1 router (fractional T1 support, HDLC, > PPP, > > > FrameRelay, etc). Theres also a 56k dialup backup module which is > handy. > > > > > > > > > > -- > > -- > > Curtis Maurand > > mailto:curtis@maurand.com > > http://www.maurand.com > > > > > -- -- Curtis Maurand mailto:curtis@maurand.com http://www.maurand.com

1 0

Re: Converged Networks Threat (Was: Level3 Outage)
by Matthew Crocker 25 Feb '04

25 Feb '04

> > Yesterday we witnessed a large scale failure that has yet to be > attributed to configuration, software, or hardware; however one need > look no further than the 168.0.0.0/6 thread, or the GBLX customer who > leaked several tens of thousands of their peers' routes to GBLX shortly > This should be rewritten 'Or GLBX who LET one of their customers leak several tens of thousands of the peers routes...'. I'm sorry, a network should be able to protect itself from its users and customers. BGP filters are not that hard to figure out and peer prefix limits should be part of every config. Don't trust the guy at the other end of the pipe to do the right thing. -Matt

1 0

RE: Converged Networks Threat (Was: Level3 Outage)
by Sean Crandall 25 Feb '04

25 Feb '04

>From Jared: > I keep hear of Frame-Relay and ATM signaling that is > going to happen in large providers MPLS cores. That's right, > your "safe" TDM based services, will be transported over > someones IP backbone first. > This means if they don't protect their IP network, the TDM > services could fail. These types of CES services are not > just limited to Frame and ATM. > (Did anyone with frame/atm/vpn services from Level3 > experience the same outage?) We use Level3 for IP transit and transport (both DS-3 and Ethernet over MPLS (via Martini)) all over the country. As with everyone else, we saw the problems with the transit traffic out of SJC and ATL. However, our transport services were not affected at all by the problems. In fact, I just ended up sending my Level3-SJC bound traffic to LAX via Level3 which was going through the same equipment as the transit traffic which was having problems. >From Pete: > From this, it can be deduced that reducing unneccessary > system complexity and shortening the strings of pearls that > make up the system contribute to better availablity and > resiliency of the system. Diversity works both ways in this > equation. It lessens the probablity of same failure hitting > majority of your boxes but at the same time increases the > knowledge needed to understand and maintain the whole system. > > I would vote for the KISS principle if in doubt. I agree. Granted the string of pearls is always going to be pretty long, but there are definitely is a trend from what I have seen with customers to make the string longer than it needs to be. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax)

1 0

RE: possible L3 issues
by Arjan Lugtenberg 25 Feb '04

25 Feb '04

Here at planet (AS8737) we also having problems reaching msn/hotmail/messenger. Seems that C&W are also having problems reaching microsoft?? regards, Arjan -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of kwallace(a)pcconnection.com Sent: maandag 23 februari 2004 23:53 To: nanog(a)merit.edu Subject: possible L3 issues anyone else seeing high latency via L3 , especially the west coast ? - Keith

8 7

RE: New Draft Document: De-boganising New Address Blocks
by Michael.Dillon＠radianz.com 25 Feb '04

25 Feb '04

>> Timothy Brown wrote: >> I disagree with the view that it is a hack. >> It's no more a hack than using a DNS feed; >I concur with this. Besides, from the pragmatic side of the "consumer", >if it does solve a problem (albeit short or medium term) I don't care >much if it's a "hack". Then we all agree. The Cymru bogon feed is a hack. The completewhois feed is a hack. In fact, any third party feed that puports to identify authentic IP allocations is a hack. The only fix for this is to get the addressing authorities to provide an authoritative feed. That probably means first getting the RIRs to do it and then ICANN to fill in the gaps. As to whether the mechanisms used by bogon feeds are hacks or carefully crafted technology, well, my rule of thumb is that if it can completely automate the process while still allowing human intervention to make judgement calls on all changes to network configuration, then it is carefully crafted technology. I'm afraid that by this measure, using BGP feed as the mechanism is a hack because it involves plugging a 3rd party directly into your routing architecture. A directory service like DNS or LDAP is closer to the carefully crafted technology because it can be plugged into OSS systems that allow humans to validate and release any network changes. --Michael Dillon

1 0

RE: New Draft Document: De-boganising New Address Blocks
by Michel Py 25 Feb '04

25 Feb '04

William, > william(at)elan.net wrote: > [http://www.cymru.com/BGP/bogon-rs.html] > Unfortunetly this is kind-of a bgp hack and as has > been already mentioned it needs very carefull > implemention This is not positive thinking. I don't consider this a hack (if it is, then the draft that proposes to re-use ORF mechanisms is even worse). I'm not interested in what things were designed to do, I'm interested in what things _can_ do. I use [Cymru] myself as I am within the applicability domain. I use your stuff too. However, you might be borderline to abusing co-author privileges here; Team Cymru has lead the route-server project for long, and although the bogon list is by nature a lot less controversial than what you do the bottom line is the acceptance of Cymru's feed is far greater than Completewhois. Please don't use draft-py-idr-redisfilter-01.txt as a platform to compete with other co-authors; collaborative competition is sound, please stay within its borders. Thanks Michel.

2 2

RE: Proposal: De-boganising New Address Blocks
by Michel Py 25 Feb '04

25 Feb '04

Daniel, [me puts the Devil's advocate suit on] If I read this correctly, the way I summarize it is: "Instead of waiting for people that get real delegations in a newly allocated /8 to have real problems, we delegate parts of this new /8 to pilot projects before hand, knowing that there will be issues, which allows us to contact operators that are still bogonizing the new block. The idea being that the inconvenience caused by a pilot project being bogonized is of little consequence where the inconvenience of a real delegation being bogonized is real." Good idea, no contest. Now, the devil's advocate asks: what makes you think that operators/ISPs are going to react faster to your pilot stuff being bogonized than they would to real traffic being bogonized, as if it's a pilot project it's by definition not urgent and can wait tomorrow? Although I salute the effort, I am concerned that this will not change current reactive behavior which is to wait for the shit to hit the fan to update bogon lists. Might sound sad, but I think the way to de-bogonize new blocks is to automate the de-bogonization process, as the idea to de-bogonize ahead of time will not cut it as a priority, IMHO. My $0.02, and let me stress that I did not intend to sound negative as the idea is good; I'm just a little skeptical. Michel.

3 2

168.0.0.0/6
by Randy Bush 25 Feb '04

25 Feb '04

route-views.oregon-ix.net>sh ip bgp 169.223.0.0 BGP routing table entry for 168.0.0.0/6, version 7688303 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 3277 13062 20485 20485 20485 8437 3303 194.85.4.249 from 194.85.4.249 (194.85.4.249) Origin IGP, localpref 100, valid, external, best ripe is being overgenerous to the swiss!

8 11

RE: New Draft Document: De-boganising New Address Blocks
by Michel Py 25 Feb '04

25 Feb '04

> Timothy Brown wrote: > I disagree with the view that it is a hack. > It's no more a hack than using a DNS feed; I concur with this. Besides, from the pragmatic side of the "consumer", if it does solve a problem (albeit short or medium term) I don't care much if it's a "hack". Hint: all this bogon or related filtering is not a long-term solution. We need it now, but the long term solution is some kind of authentication that will allow only the rightful owner of a block to announce it. Michel.

2 1

Re: New Draft Document: De-boganising New Address Blocks
by Michael.Dillon＠radianz.com 25 Feb '04

25 Feb '04

>The RIPE NCC has prepared a draft document titled "De-Bogonising New >Address Blocks": That is a misleading title. The problem is that ISPs cannot react quickly enough to open filters when new ranges are allocated. The proposed solution is to provide advance notification. I suppose this could allow ISPs to open filters before the new addresses are actually in use officially. However, it will also allow spammers to announce this space and get it through bogon filters. The real solution to this problem is to make it possible for ISPs to closely track RIR allocations in their filters in a semi-automated way. There may still be a few days of delay before a new allocation is fully routable but ISPs can compensate for that with internal processes. Why can't ISPs subscribe to a feed of all new RIPE allocations in near real-time? --Michael Dillon

5 6