- NANOG - lists.nanog.org

What ISPs can do
by Sean Donelan 19 Oct '01

19 Oct '01

1. Keep the net running During any crisis keeping the lines of communications working is a key requirement. Almost every review of crisis and emergency response showed the importance of keeping communication systems working. (http://www.dtic.mil/ndia/2001wmd/scalingi.pdf) Unplugging things without reason seems to always make things worse. 2. Maintain the integrity of net data Implement procedures to assuring the integrity of the control data used in the net. This isn't the content of communications, but the routing and control data. This can be as simple as setting and synchronizing clocks used to generate timestamps, verifying IP address announcements, anti-spoofing filters, use routing passwords, patching known security holes. 3. Single point of contact A crisis is not the best time to learn that an ISP has decided to implement a voice mail system which won't allow any outside contact with their NOC until a 17 digit customer number is entered. All communciation providers need a reliable method to contact each other during a crisis. 4. Standardized law enforcement assistance forms Both law enforcement and ISPs need to work on specifying what the ISP needs from law enforcement and what law enforcement expects back from the ISP. There are a lot of language problems between the two groups, and often they don't understand what the other side is saying. It would also speed up the process of verifying the lawful authority for releasing the information if law enforcement knows ahead of time what ISPs expect. I understand we're not lawyers, that's why it needs to be decided ahead of time by the lawyers. But as engineers we can figure out what information is required to respond to specific, though generic, types of actions. It will also cut down on the mistakes which have happened.

1 0

Thoughts on BGP and Shared Hosting Environments
by Christopher J. Wolff 19 Oct '01

19 Oct '01

Had an interesting situation yesterday. Received a new /20 allocation. Split it into /19's and advertised it to two separate backbones via two separate routers. Users on the new /19's could get to about 75% of the available web hosts on the internet. I removed the /19's and advertised the entire /20 out of both servers, problem resolved. Any suggestions? Also, what are the groups opinions on web hosting customers who want to install custom ASP and COM components on a shared Windows 2000/IIS hosting server? I'm having a debate with a sales dude over this issue. My opinion is that it potentially destabilizes all of the virtual hosts on that system. When I hear "Can you install just a couple of ASP or COM components on my domain" my mind immediately goes to putting this customer in their own dedicated colo server. I don't think its right to jeopardize several hundred virtual domains because one $19.99/month customer wants to load up a special .dll. But that's just my rant, market conditions can dictate otherwise. Regards, Christopher J. Wolff, VP, CIO Broadband Laboratories, Inc. http://www.bblabs.com email:chris@bblabs.com phone:520.622.4338 x234

7 7

RE: 12000 ACL issue
by jhsu＠rathe.mur.com 19 Oct '01

19 Oct '01

: It seems like just yesterday everyone was blown away by an OC-48 capable : router. Now everyone is bitching that they can't apply access lists on 8 : port GE card. I am absolutely blown away by what a short memory everyone in : this industry has. The difference being, of course, that everyone wanted the OC-48, any way they could get it, more than they want GIGE, any way they can get it. And being blown away by OC-48 interfaces didn't stop *anyone* from complaining that they couldn't get OC-48 with ACLs- it was necessity that made them buy them anyway. Vendors have been plugging away at GIGE for three years now- they know what their customers want. They want ACLs. What is so wrong with that? _k

1 0

DOH! Thoughts on BGP and Shared Hosting Environments
by Christopher J. Wolff 19 Oct '01

19 Oct '01

DOH! I meant split a /20 into a /21, been a long week, sorry. -----Original Message----- From: Chris Cappuccio [mailto:chris@dqc.org] Sent: Friday, October 19, 2001 2:14 PM To: Christopher J. Wolff Subject: Re: Thoughts on BGP and Shared Hosting Environments My first suggestion would be to note that there is no way you can split a /20 into two /19s, but you can very easily split a /19 into two /20s. Maybe you should rethink your strategy. Christopher J. Wolff [chris(a)bblabs.com] wrote: > > Had an interesting situation yesterday. > > Received a new /20 allocation. > Split it into /19's and advertised it to two separate backbones via two > separate routers. > > Users on the new /19's could get to about 75% of the available web hosts on > the internet. > > I removed the /19's and advertised the entire /20 out of both servers, > problem resolved. > > Any suggestions? > > Also, what are the groups opinions on web hosting customers who want to > install custom ASP and COM components on a shared Windows 2000/IIS hosting > server? I'm having a debate with a sales dude over this issue. > > My opinion is that it potentially destabilizes all of the virtual hosts on > that system. When I hear "Can you install just a couple of ASP or COM > components on my domain" my mind immediately goes to putting this customer > in their own dedicated colo server. I don't think its right to jeopardize > several hundred virtual domains because one $19.99/month customer wants to > load up a special .dll. But that's just my rant, market conditions can > dictate otherwise. > > Regards, > Christopher J. Wolff, VP, CIO > Broadband Laboratories, Inc. > http://www.bblabs.com > email:chris@bblabs.com > phone:520.622.4338 x234 > -- Rev. Chris Cappuccio http://www.dqc.org/~chris/

1 0

12000 ACL issue
by James A. T. Rice <james_r-nanog＠jump.org.uk> 19 Oct '01

19 Oct '01

Does anyone else here use ACL's on subinterfaces of single GigE linecards on GSRs? As of 12.0(16S), the ability to type 'ip access-group' while in the subinterface configuration was removed, leaving me stuck on 12.0(15S3). Cisco seem to be under the impression that BBC are the only customer who used this feature, if anyone else ACL's on GigE subinterfaces, please get in touch so we can correct them. Apparently the feature was never supported as it was never documented. To me, hitting '?' in the config and seeing the option there, counts as documentation. I guess we should all throughly check the IOS command reference guides before we use any commands on ciscos, in case theyre unsupported. I wonder what they'll remove next, I've not yet checked to see if "ip routing" is a supported command! The other excuse for removing it was because 'it wasnt line rate'. This doesnt bother me - I'd never expected the GigE cards to be line rate anyway. Theyre now suggesting buy 35xxT switches and use them for layer 3 filtering. Below is the email, names removed to protect the guilty. -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: +44 1737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. ---------- Forwarded message ---------- Date: Fri, 19 Oct 2001 09:35:13 +0100 From: Removed <@cisco.com> To: "James A. T. Rice" <jamesr> Cc: @cisco.com Subject: 12000 ACL issue Hi James, Having spoken to the guys in the US and worked through all the considerations of deploying a release of IOS code that supports the config you have it would seem that the most sensible route would be to consider the deployment of the Catalyst 3550T. The problem with simply restoring the functionality on the 12000 is that not only has it not been tested thoroughly (though expectation is that the performance will not be good) it will mean that the BBC are the only known customer using the functionality. Whilst Cisco would make every effort to support customer demands, the nature of software development and the current expectation in IOS development is that the 12000 is not suited to providing this functionality in the long term. This issue has been escalated highly within Cisco up to SE Director level and the consensus is that the most appropriate recommendation would be to consider a platform that can provide wirespeed ACL capability. The 12000 is unlikely to be able to provide this in the long term. Additionally the time required to develop and test stable code that can support all the 12000 features that will be required in the long term suggests that for the most immediate resolution to the problem an alternative platform should be considered. Cisco regret the confusion that led you to understand that this feature was supported and we will of course do our utmost to provide a satisfactory resolution. I have sent you through some collateral on the 3550T and i believe that this will provide you with the most scalable and best supported method of providing ACL's at high performance. The 3512T could well provide a more flexible solution in that it supports Vlan Maps. From the docs "VLAN maps can access-control all traffic. You can apply VLAN maps on the switch to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VLAN maps are used strictly for security packet filtering. Unlike router ACLs, VLAN maps are not defined by direction (input or output)." This would make configuration of ACL's and providing access control at layer 2 and 3 easier. This could provide benefits not only in providing layer 2 security but also in simplifying Vlan design and saving on IP addressing (one vlan for all customers, security via VLAN Maps, port security and private vlans. Our thoughts are to deploy a 3550T as part of the 3500 stack that you already have. This would not only provide simplified management and the addition of only a single RU box, but would also provide an additional 10 Copper Gigabit ports for the addition of other servers. If you could let me know your thoughts on this, we can look at what is the best way to go forward. Thanks and Regards

5 4

RE: Network Tools
by Irwin Lazar 19 Oct '01

19 Oct '01

I've got an extensive collection of links to freeware NMS tools at www.itprc.com/nms.htm > -----Original Message----- > From: Marquez-Klaka, Daniel [mailto:Daniel.Marquez-Klaka@star-21.de] > Sent: Friday, October 19, 2001 3:30 AM > To: Mike Hyde > Cc: nanog(a)nanog.org > Subject: RE: Network Tools > > > > > > Does anyone know of a good program that I can run on my > > linux server that > > will monitor the ping response time between routers on my > > network? > > Take a look at "Scotty - Tcl Extensions for Network Management > Applications" > > http://wwwhome.cs.utwente.nl/~schoenw/scotty/ > > This will do what your looking for and many things more. > > > D. >

1 0

OT: ARIN contact
by Grant A. Kirkwood 19 Oct '01

19 Oct '01

I'm trying to find someone who can help me with an ARIN request. If anyone here can help, please drop me a line. Thanks. Grant -- Grant A. Kirkwood - grant(a)virtical.net Chief Technology Officer - Virtical Solutions, Inc. http://www.virtical.net/

3 3

Cisco CEF SNMP MIB
by Yu Ning 19 Oct '01

19 Oct '01

Hi nanog, Does anyone know the MIB of Cisco CEF ? Especially on the statistic of CEF. I wonder if I can poll a MIB or OID to get some traffic statistic of CEF. BTW, I need the CEF MIB of GSR router, 12016/08 thanks for any input or pointer, Yu Ning ____________________________________________ (Mr.) Yu Ning, Chief Engineer ChinaNET(AS4134) Sr. Sup.& New Sev. R&D Internet Product Dep. DCB, China Telecom Beijing, P.R.China +86-10-62072357/62072354 Personal Web Page-> http://navidog.126.com ____________________________________________

2 1

RE: Cisco CEF SNMP MIB
by Yu Ning 19 Oct '01

19 Oct '01

Hi, Thanks for your reference. But I've fully download the Cisco public MIB ftp. But couldn't find any CEF related MIB. I've already digged into inches on that URL. regards, ____________________________________________ (Mr.) Yu Ning, Chief Engineer ChinaNET(AS4134) Sr. Sup.& New Sev. R&D Internet Product Dep. DCB, China Telecom Beijing, P.R.China +86-10-62072357/62072354 Personal Web Page-> http://navidog.126.com ____________________________________________ |-----Original Message----- |From: Christopher L. Morrow [mailto:chris@UU.NET] |Sent: Friday, October 19, 2001 2:09 PM |To: Yu Ning |Subject: Re: Cisco CEF SNMP MIB | | |Yu, |You can find these MIB's at the following location: | |ftp://ftp.cisco.com/pub/mibs/ | |I'd look in 'oids' or 'v1' or 'v2'... and I'd just pull down the entire |setup and grep through for items of interest. Likely you'll have to load |the MIB/my file into your poller anyway. | | | |--Chris |(chris(a)uu.net) |####################################################### |## UUNET Technologies, Inc. ## |## Manager ## |## Customer Router Security Engineering Team ## |## (W)703-886-3823 (C)703-338-7319 ## |####################################################### | |On Fri, 19 Oct 2001, Yu Ning wrote: | |> Hi nanog, |> |> Does anyone know the MIB of Cisco CEF ? Especially on the |statistic of CEF. |> I wonder if I can poll a MIB or OID to get some traffic |statistic of CEF. BTW, I |> need the CEF MIB of GSR router, 12016/08 |> |> thanks for any input or pointer, |> |> |> Yu Ning |> ____________________________________________ |> |> (Mr.) Yu Ning, Chief Engineer |> ChinaNET(AS4134) Sr. Sup.& New Sev. R&D |> Internet Product Dep. DCB, China Telecom |> Beijing, P.R.China +86-10-62072357/62072354 |> Personal Web Page-> http://navidog.126.com |> ____________________________________________ | | |

1 0

RE: Network Tools
by Marquez-Klaka, Daniel 19 Oct '01

19 Oct '01

> Does anyone know of a good program that I can run on my > linux server that > will monitor the ping response time between routers on my > network? Take a look at "Scotty - Tcl Extensions for Network Management Applications" http://wwwhome.cs.utwente.nl/~schoenw/scotty/ This will do what your looking for and many things more. D.

1 0