- NANOG - lists.nanog.org

RE: Fire protection in ISPs and collocation facilities
by Roeland Meyer 06 Nov '00

06 Nov '00

Simple rule, make sure that you're upstream and the down-stream end has more bandwidth than the up-stream end. It's kind of the reverse of the internet. In the event that the inflow exceeds the outflow, hit the SCRAM switch before you fry something. This is the main reason I have it (SCRAM), but I'm damned if I can justify it for that reason. It's a lot easier to talk about fire. It should be left in the Fire codes. What are the four seasons in California? Earthquake, Drought, Fire, and Flood. You've no doubt heard about the "Oakland Hills Fire" but no one has ever talked about the mud-slides, in the Winter following the "Oakland Hills Fire", caused by the ground-cover being burnt off. In fact, no one hears much about California flooding. That's because it is a natural part of the ecology here and not as sexy as earthquakes and brush fires. > -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Sunday, November 05, 2000 8:58 PM > To: tme(a)21rst-century.com > Cc: nanog(a)merit.edu > Subject: Re: Fire protection in ISPs and collocation facilities > > > > On Sun, 05 November 2000, Marshall Eubanks wrote: > > In Fairfax and Loudon Counties here in Virginia, fire codes require > > water for fire suppression (you can use other means, but you have to > > have water). So all the co-lo and exchange facilities here have > > pressurised water fire suppression. I have been surprised > at how many > > of these do not have DRAINS for the water. > > In my real estate experience, whenever you have > > the possibility of water release, you will eventually HAVE water > > release. With no drains, that means you will have > > to move the equipment out to get the water out... > > Its a catch-22. In Rochelle Park, a substantional amount of the > flooding entered the building through the drains and plumbing. If > you have openings for the water to flow out, the water can also flow > in. On the other hand, there have also been colo's (in Virginia) with > depressed/raised floors which turned into concrete pools submerging > all the data cables and power cables below the raised floor. > > Do I have a solution? No. I've thought about building in dry sumps > and containment (i.e. like nuclear reactor buildings). But that > has problems too. > > >

2 1

Re: Fire protection in ISPs and collocation facilities
by Sean Donelan 06 Nov '00

06 Nov '00

On Sun, 05 November 2000, Marshall Eubanks wrote: > In Fairfax and Loudon Counties here in Virginia, fire codes require > water for fire suppression (you can use other means, but you have to > have water). So all the co-lo and exchange facilities here have > pressurised water fire suppression. I have been surprised at how many > of these do not have DRAINS for the water. > In my real estate experience, whenever you have > the possibility of water release, you will eventually HAVE water > release. With no drains, that means you will have > to move the equipment out to get the water out... Its a catch-22. In Rochelle Park, a substantional amount of the flooding entered the building through the drains and plumbing. If you have openings for the water to flow out, the water can also flow in. On the other hand, there have also been colo's (in Virginia) with depressed/raised floors which turned into concrete pools submerging all the data cables and power cables below the raised floor. Do I have a solution? No. I've thought about building in dry sumps and containment (i.e. like nuclear reactor buildings). But that has problems too.

1 0

Re: Fire protection in ISPs and collocation facilities
by Sean Donelan 06 Nov '00

06 Nov '00

Several people have asked where can they obtain a copy of the US Air Force draft. Engineering Technical Letter (ETL) 00-3: Fire Protection Engineering Criteria - Electronic Equipment Installations http://www.afcesa.af.mil/Publications/Drafts/ETL00-3Draft.pdf I find it interesting how the designs created by people who have to operate an installation are different from the designs from consultants and vendors, or even the National Fire Protection Association. Or commercials on television like those being run by Janus. But back to my original question. What is the real fire risk for ISPs and collocation operators. Is it burned buttered popcorn in the microwave setting off the FM-200 system? Is it home-made computers? Is it the Emergency Power Off switch? State Farm Insurance has started a project to change the National Electrical Code for computer rooms and the requirement for an EPO switch. Is this something other ISPs and collocation providers would be interested in seeing changed? If so, we need to collect data and evidence to support the change.

4 3

Re: Fire protection in ISPs and collocation facilities
by Sean Donelan 05 Nov '00

05 Nov '00

On Sun, 05 November 2000, "Howard C. Berkowitz" wrote: > Perhaps it's worth observing that fire is but one of the classic > Elemental Forces, and I've personally had far more problems with > water than with fire. In my experiences, the water came from > firefighting elsewhere in the building, but several instances of CO > flooding and the like have been mentioned in recent posts--New > Rochelle (?) AT&T vs. Verizon? Welcome to business reality. 1999 wasn't the first time the Rochelle Park central office flooded. It also flooded in 1977. New Jersey Bell decided not to move the central office after the first flooding incident. I think you will find it is more cost effective for Bell Atlantic to pay off a few subscribers every few decades than to move the central office. Bell Atlantic has 18 central offices located in 100 year flood zones. But BA/Verizon only pays refunds on complete loss of telephone service. For example, 37,000 people lost all phone service in Rochelle Park. If you assume BA paid each subscriber $4 compensation, its works out to about $148,000. A conservative estimate is $6-$10 million to move the central office. If you were a bean counter what would you do? > While I doubt it's practical to develop exhaustive water protection > measures to guard against large-scale flooding, unless there's a move > to convert surplus submarines to colo centers, I'd like to see the > fire protection code be more exhaustive about diverting water away > from unaffected faciities. This is an admirable goal, but I think the fire codes are the wrong place to put it. There is already too much junk in the fire codes, unsupported by scientific evidence. FEMA and the building codes cover flood plains. Although there is always something. If you literally followed every contingency site requirement people have, there is no place on earth which meets them all. I sometimes think companies focus too much on the hardware. You should talk to the techs and engineers keeping things going. A good set of people can keep things going even during the unexpected, unplanned, and unknown. Of course, you need to give them a fighting chance, but concrete won't keep the water out if the door is left open. Whether it is network engineers or building engineers, clue is important. I'm working with some facility engineers who were trained in the navy. Waiting for the field service engineer to show up sometimes isn't an option on a ship. Not only do they know how to deal with water, but they also know how to keep things going.

1 0

RADWare Linkproof? (or better ways to multihome)
by Mike Johnson 05 Nov '00

05 Nov '00

Back in March (looking through the archives) there was some discussion on this product as a replacement for BGP-4 for multihoming. I find myself in a situation where I'm going to be setting up a site that will be multihomed at a co-lo site. We're going to be connected to two separate ISPs via fast ethernet connections. I have only discussed BGP with one of the ISP's (we will not be getting IP services from the co-lo company), but they didn't seem to indicate that they had any issues with us using BGP. So, it seems that BGP-4 is an option. We've been speaking with RADWare about their Web Server Directors for server load balancing and they brought up the Linkproof (http://www.radware.com/content/products/link.htm) I was planning on just purchasing a big ole router and running BGP, but the idea of replacing the router with a pair of Linkproofs (high availability) is very attractive both from a cost standpoint and from an expertise standpoint (I'm the only one here who has run BGP-4 at all, and that was only in a lab, playing around -- ie, we have damned near no in house BGP-4 experience). I'm waiting to hear back from our salesdroid on other customers who currently use Linkproofs in this manner (he says there are several), but since this has been discussed here (but no conclusions seem to have been reached), I thought I would ask and see if anyone has experience with this product. In the end, I'm certainly willing to look at other solutions, but we're a bit iffy on BGP and we're already planning on running NAT, so the Linkproof looks like a good fit. Thanks, Mike -- Mike Johnson Network Engineer / iSun Networks, Inc. Morrisville, NC All opinions are mine, not those of my employer

8 10

RE: Fire protection in ISPs and collocation facilities
by Roeland Meyer 05 Nov '00

05 Nov '00

There are a lot of non-fire reasons that I like the presence of an EPO switch and I would design one in regardless. However, its requirement in the fire-code makes the expense easier to justify. I design framerooms with many smaller UPS's distributed throughout the racks, as opposed to a central pile of batteries. As a result, I have gel cells everywhere. I usually use Liebert GT's, every two racks, with power pod and interlock, at the bottom of the rack. Some of the non-fire reasons; Ground-faults placing 120VAC on the rack frames. Flooding event. Data intrusion prevention (Emergency SCRAM). > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Saturday, November 04, 2000 5:56 PM > > Several people have asked where can they obtain a copy of the US > Air Force draft. > > Engineering Technical Letter (ETL) 00-3: Fire Protection Engineering > Criteria - Electronic Equipment Installations > > http://www.afcesa.af.mil/Publications/Drafts/ETL00-3Draft.pdf > > I find it interesting how the designs created by people who have to > operate an installation are different from the designs from > consultants > and vendors, or even the National Fire Protection Association. Or > commercials on television like those being run by Janus. > > But back to my original question. What is the real fire risk for > ISPs and collocation operators. Is it burned buttered popcorn in the > microwave setting off the FM-200 system? Is it home-made computers? > Is it the Emergency Power Off switch? > > State Farm Insurance has started a project to change the > National Electrical > Code for computer rooms and the requirement for an EPO > switch. Is this > something other ISPs and collocation providers would be interested in > seeing changed? If so, we need to collect data and evidence > to support > the change.

1 0

RE: Security on a home DSL Line
by Roeland Meyer 04 Nov '00

04 Nov '00

I did that ... too much work. Easier to install an appliance. > -----Original Message----- > From: Sean Figgins [mailto:sfiggins@mail.wcg.net] > Sent: Friday, November 03, 2000 7:33 AM > To: nanog(a)merit.edu > Subject: RE: Security on a home DSL Line > > > > Of course, for those that don't know how to install a OS > without the use of > GUIs, you can always install FreeBSD just about as easily as > Linux, and have > all the security of IPFilter over IPChains... I've used this > method to do > everything from a Dial on Demand NAT gateway, to a full fledged > firewall/router solution. > > Of course, my home network is behind more sophisticated > security now, but > if/when I ever change jobs and network providers, I'll be > going back to the > FreeBSD firewall/NAT method. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Brandon Hume > Sent: Friday, November 03, 2000 9:07 AM > To: nanog(a)merit.edu > Subject: Re: Security on a home DSL Line > > > > >Otherwise, your idea is perfect; Linux or OpenBSD, whichever you're > >more comfortable with, will give you the most flexibility, > and Solaris x86 > >might work but will be dog-slow and unless you have a lot of RAM, > >completely unusuable. > > For such a weakly defined measure of "a lot of RAM", this statement is > inaccurate. Solaris 8 x86 will run comfortably, without X > and superfluous > processes (to say: a rational firewall/NAT box configuration) > within 12M > of RAM. A passing knowledge of Solaris would not let a > person know this to > be true, however, since Sun states its memory requirements on > the assumption > you'd be using X. > > That being said, OpenBSD is probably the best choice. It > requires more > skill > to install, but less skill to secure, and would probably run > better *by > default* on a minimal machine. After that I'd suggest > Solaris, since it > installs less crap than most of the Linux distributions (note: most). > Driver issues might force your hand to the Linuxes, of course. > > I also place OpenBSD and Solaris above Linux because they > both give you the > use of IPFilter, which I believe to be just flat-out superior > to IPChains. > > -- > Brandon Hume - hume -> BOFH.Halifax.NS.Ca, http://WWW.BOFH.Halifax.NS.Ca/ -> Solaris Snob and general NOCMonkey

2 1

Watch 500 Channels on your New Free Satellite System
by Ryan＠chems.co.kr 04 Nov '00

04 Nov '00

FREE Satellite T.V. System and FREE Installation For a limited time we'll give you this top of the line Digital Satellite System for FREE! We'll even include Free installation. Enjoy over 500 Channels of crystal clear digital picture and cd stereo sound on your FREE Satellite TV System. Why pay over $900 retail for these items, when we're giving you this satellite package for free. Call 888-514-6881 to be Guaranteed Your FREE Satellite Today This Innovative 20" Satellite includes a stereo receiver and an infrared remote. With this FREE offer you will have both Interactive Television Capability and an On Screen Program Guide. This limited time FREE offer is much less than the monthly cost of cable tv. All you have to do is call us to arrange delivery. If you call today, we'll throw in a second receiver for your second T.V. free. Call 888-514-6881 to Begin Surfing through 500 Channels Today! To be removed send email to youwannus2(a)yahoo.com

1 0

RE: Security on a home DSL Line
by Rishi Singh 04 Nov '00

04 Nov '00

Hmm.. Zone Alarm is a nice product, but I'd prefer to use BlackIce Defender for all my Wintel boxes. It does a fine job of protecting against many exploits and their databases are updated very frequently. BlackIce Defender available at: http://www.networkice.com -----Original Message----- From: J. Gilmore [mailto:reece0011@yahoo.com] Sent: Thursday, November 02, 2000 6:38 PM To: nanog(a)merit.edu Subject: Security on a home DSL Line I'm looking to beef up security on a home DSL line. Currently I am using ZoneAlarm (the freeware version). I'm thinking of taking an old Pentium 120, and setting that up as a firewall, but wanted to know if anyone else had a better idea. __________________________________________________ Do You Yahoo!? >From homework help to love advice, Yahoo! Experts has your answer. http://experts.yahoo.com/

7 6

BGP policy scripts
by Shah, Himanshu 04 Nov '00

04 Nov '00

Hi, Is there a repository where I can find BGP policy scripts (Cisco style) that I can use against our implementation? I am looking for complex examples of regular expressions, route maps, access lists, etc. If not, I would appreciate if someone would share examples of scripts that they commonly use and/or features they think would be useful to offer.. thanks, Himanshu

3 2