- NANOG - lists.nanog.org

Redhat contact
by Eric Litvin 18 Sep '20

18 Sep '20

Hi, I need to get in contact with someone in the sales team at Redhat but they are not replying either to my emails or phone calls. Do you know anyone working for Redhat whom we can call? Please dm me. Thanks Eric Sent from my iPhone > On Sep 18, 2020, at 7:48 AM, Wilco Baan Hofman <wilco(a)baanhofman.nl> wrote: > > > >> On 18/09/2020 12:07, Mark Tinka wrote: >> >> >> There was a time when the use-case for MACSec was to move banks away >> from running their own DWDM/FC networks, and letting operators do it. >> > > Well, the other use case is access networks with 802.1x. With 802.1x as > long as the port stays up the session cookie (whatever is set as > authenticated) is the MAC address. So once a port is authenticated, it's > really easy to spoof a MAC and still be on the network. > > With WPA2 enterprise on WiFi, this problem does not exist, because then > there is a cryptographic session. MACsec fixes that gap on wired. > > Not all that relevant for long-distance links though :) > > -- Wilco

1 0

SRm6 (was:SRv6)
by Ron Bonica 17 Sep '20

17 Sep '20

Folks, If you want an IPv6 underlay for a network offering VPN services, it makes sense to: * Retain RFC 4291 IPv6 address semantics * Decouple the TE mechanism from the service labeling mechanism Please consider the TE mechanism described in draft-bonica-6man-comp-rtg-hdr and the service labeling mechanism described in draft-bonica-6man-vpn-dest-opt. These can be deployed on a mix and match basis. For example can deploy: * Draft-bonica-6man-vpn-dest-opt only, allowing traffic to follow the least-cost path from PE to PE. * Deploy draft-bonica-6man-vpn-dest-opt only, using a legacy method (VXLAN, RFC 4797) to label services. In all cases, the semantic of the IPv6 address is unchanged. There is no need to encode anything new in the IPv6 address. Ron Juniper Business Use Only

5 7

Re: how would draft-ymbk-opsawg-finding-geofeeds work in noam
by Randy Bush 16 Sep '20

16 Sep '20

perchance is RDAP implemented by all RIRs? randy

4 4

CenturyLink -> Lumen
by R. Leigh Hennig 16 Sep '20

16 Sep '20

https://www.fiercetelecom.com/telecom/centurylink-rebrands-re-defines-enter… Curious. Any thoughts on how this changes their business approach, if any? Obviously something like this has to be planned far in advance, but I can’t help but wonder what impact the recent outage and bad press might have had on their plans here, possibly accelerating them? Probably not. But it’s an interesting move regardless. . | R. Leigh Hennig, Principal Network Architect ..| Markley Group https://markleygroup.com Sent from ProtonMail Mobile

5 4

Network Gear Seismic Tolerances
by Crist Clark 16 Sep '20

16 Sep '20

I've been living and working in earthquake country for many years. The primary focus I've always encountered for network gear is to make sure it is properly secured to the racks and the racks properly secured to the building (and hope the building is well secured). I'm working on a project now where we're doing seismic isolation for the servers. I think the main concern there is spinning disks. The cabinets are effectively "floating," well, rolling really, on the data center floor. There are various vendor solutions for this. Of course, the network gear living up close and personal with the servers is along for the ride. That's all fine. I don't think it's a problem for the network gear. But now there are people with the idea that seismic isolation is the technology we need for all of our electronics, down to network gear in IDRs. I am trying to find any real information about this, but Google-fu is not producing results for me. I asked some of our vendor sales people, they said they'd get back, but never did. I don't know if shake tolerances is something published for your typical data center and campus network gear. Anyone have some best practice info from some reliable sources or seen any shake tolerance data for network gear?

3 2

microsoft mail contact
by Nicholas Warren 15 Sep '20

15 Sep '20

We recently acquired some IP space, but it seems outlook does not want to receive email from that space. If there's someone that knows what we need to do, we would be grateful for any pointers in the right direction. nich

2 1

IP addresses on subnet edge (/24)
by Andrey Khomyakov 15 Sep '20

15 Sep '20

TL;DR I suspect there are middle boxes that don't like IPs ending in .255. Anyone seen that? Folks, We are troubleshooting a strange issue where some of our customers cannot establish a successful connection with our HTTP front end. In addition to checking the usual things like routing and interface errors and security policy configurations, hopening support tickets with the load balancer vendor so far all to no avail, we did packet captures. Based on the packet captures we receive a SYN, we reply with SYN-ACK, but the client never actually receives that SYN-ACK. In a different instance the 3-way completes, followed by TLS client hello to us, we reply with TLS Server Hello and that server hello never makes it to the client. And again, this is only affecting a small subset of customers thus suggesting it's not the load balancer or the edge routing configuration (in fact we can traceroute fine to the customer's IP). So far the only remaining theory that remains is that there are middle boxes out there that do not like IPs ending in .255. The service that the clients can't get to is hosted on two IPs ending in .255 Let's just say they are x.x.121.255 and x.x.125.255. We even stood up a basic "hello world" web server on x.x.124.255 with the same result. Standing up the very same basic webserver on x.x.124.250 allows the client to succeed. So far we have a friendly customer who has been working with us on troubleshooting the issue and we have some pcaps from the client's side somewhat confirming that it's not the customer's system either. This friendly customer is in a small 5 people office with Spectrum business internet (that's the SYN-ACK case). The same customer tried hopping on his LTE hotspot which came up as Cellco Partnership DBA Verizon Wireless with the same result (that's the TLS server hello case). That same customer with the same workstation drives a town over and he can get to the application fine (we are still waiting for the customer to let us know what that source IP is when it does work). Before you suggest that those .255 addresses are broadcasts on some VLAN, they are not. They are injected as /32s using a routing protocol, while the VLAN addressing is all RFC1918 addressing. --Andrey

9 8

curious spam...
by William Herrin 15 Sep '20

15 Sep '20

Howdy, I've noticed something odd. When I lived in Virginia, I started receiving email directly to my gmail box from my U.S. Representative. Unsolicited spam from Congressmen is nothing new but it was a little odd that they found my gmail box (which I don't give out) and not one of the hundreds of aliases at herrin.us or dirtside.com which I do give out. The gmail box exists only in mail headers; "From" is always a different address. I moved to Seattle. Today I found my grmail box subscribed to a congressman's list from a nearby Washington jurisdiction. Not some random congressman. And not any of the addresses I give out; my gmail box's address which I don't. Anyone else have a similar experience? Any idea how a hidden address is making it on to relevant congressmens' lists but not any others? That's weird right? Regards, Bill Herrin -- William Herrin bill(a)herrin.us https://bill.herrin.us/

7 7

how would draft-ymbk-opsawg-finding-geofeeds work in noam
by Randy Bush 15 Sep '20

15 Sep '20

would folk familiar with the north american RIR and IRR registries be kind enough to suggest how this might adapt? thanks. A new version of I-D, draft-ymbk-opsawg-finding-geofeeds-02.txt has been successfully submitted by Randy Bush and posted to the IETF repository. Name: draft-ymbk-opsawg-finding-geofeeds Revision: 02 Title: Finding and Using Geofeed Data Document date: 2020-09-11 Group: Individual Submission Pages: 16 URL: https://www.ietf.org/id/draft-ymbk-opsawg-finding-geofeeds-02.txt Status: https://datatracker.ietf.org/doc/draft-ymbk-opsawg-finding-geofeeds/ Htmlized: https://datatracker.ietf.org/doc/html/draft-ymbk-opsawg-finding-geofeeds Htmlized: https://tools.ietf.org/html/draft-ymbk-opsawg-finding-geofeeds-02 Diff: https://www.ietf.org/rfcdiff?url2=draft-ymbk-opsawg-finding-geofeeds-02 Abstract: This document describes how to find and authenticate geofeed data.

3 16

why not use dns for draft-ymbk-opsawg-finding-geofeeds?
by Randy Bush 14 Sep '20

14 Sep '20

[ am i going to regret cross-posting? ] a friend raised in private the question of whether the dns could be used instead of rpsl. essentially, dns does not search down-tree for you. it only answers exact specific queries. for some reason lost in time, well at least lost in my mind, rpsl servers give you the nearest enclosing object. e.g., if i query for the ip address of psg.com, 147.28.0.62, i get the encompassing inetnum: object. ryuu.rg.net:/Users/randy> whois -h whois.ripe.net 147.28.0.62 inetnum: 147.28.0.0 - 147.28.31.255 netname: RGNET-RSCH-147-0 country: EE org: ORG-RO47-RIPE admin-c: RB45695-RIPE tech-c: RB45695-RIPE abuse-c: AR52766-RIPE status: LEGACY mnt-by: MAINT-RGNET remarks: Geofeed https://rg.net/geofeed created: 2020-09-03T22:23:37Z last-modified: 2020-09-13T20:16:05Z source: RIPE # Filtered and now i know not to query further in the range 147.28.0.0/19. note the geofeed pointer is not at the exact ip, or at the /24, or at the /16. and have fun getting the magic of knowing it is the /19 into the dns. one does not want to query the dns for an RR 62.0.28.147.in-addr.arpa because, for this to be useful, either o you need the geoloc data with every PTR record (think ipv6 and slaac) o you need some non-existent magic to get you the geoloc data for some unspecified less specific granularity if netflix wants to collect the geofeeds once a month. do we propose they dns query all ipv4 and ipv6 host addresses? i suspect there are also cultural issues. in most isps of scale, dns is close to customer service, a different 'silo' from provisioning. rpsl not so much. i am sure massimo is learning more about the silos in ntt than he would care to. but he was able to deploy this hack in a week. i would bet that he could never get a dns hack deployed. possibly amusing tangential note: we once tried to do rpki in the dns, see https://tools.ietf.org/html/draft-bates-bgp4-nlri-orig-verif-00 aside from other issues, dns only allows a single delegation, which would preclude two owners in a make before break transition. randy

1 0