- NANOG - lists.nanog.org

Gi Firewall for mobile subscribers
by Amos Rosenboim 13 Apr '19

13 Apr '19

Hello NANOG, We are discussing internally and wanted to get more opinions and especially more data on what are people actually doing. We are running an ISP network with about 150K fixed broadband users, running dual stack (IPv4 behind CGNAT). On the ISP network IPv6 is simply routed, and is firewalled on the CPE. This network added mobile services about a year ago, also dual stack (we have no control on the mobile devices so we were too concerned to choose IPv6 only access). We have an ongoing discussion about Gi firewall (adding a firewall between the subscribers and the internet, allowing only subscriber initiated connections), for the IPv6 traffic. The firewall is doing very little security, the ruleset is very basic, allowing anything from subscribers to the internet and blocking all traffic from the internet towards the subscribers. We have a few rules to limit the number of connections per subscriber (to a relatively high number) and that is it. One of the arguments in favor of having the firewall is that unsolicited traffic from the internet can “wake” idle mobile devices, and create signaling (paging) storms as well as drain user batteries. On the other hand, allowing only subscriber initiated traffic is mostly achievable using ACLs on the mobile core facing routers, or is it with the growing percentage of UDP traffic ? BTW – I don’t mention IPv4 traffic on the mobile network as it’s all behind CGNAT which don’t allow internet initiated connections. Anyway, we are very interested to know hear more opinions, and especially to hear what are other mobile operators do. Regards Amos

10 16

Re: Disney+ CDN
by Scott Weeks 12 Apr '19

12 Apr '19

--- cgrundemann(a)gmail.com wrote: From: Chris Grundemann <cgrundemann(a)gmail.com> Yep, they decided to buy BAMTech and build their own: https://www.thewaltdisneycompany.com/walt-disney-company-acquire-majority-o… ---------------------------------------------------- https://www.bamtechmedia.com/company 2004 - "Patent awarded for GeoLocation" I'd be interested in learning about how well that one works! scott

2 1

Weekly Routing Table Report
by cscora＠apnic.net 12 Apr '19

12 Apr '19

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 13 Apr, 2019 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 745313 Prefixes after maximum aggregation (per Origin AS): 286294 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 358952 Total ASes present in the Internet Routing Table: 63889 Prefixes per ASN: 11.67 Origin-only ASes present in the Internet Routing Table: 54986 Origin ASes announcing only one prefix: 23700 Transit ASes present in the Internet Routing Table: 8903 Transit-only ASes present in the Internet Routing Table: 274 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 34 Max AS path prepend of ASN (206156) 26 Prefixes from unregistered ASNs in the Routing Table: 25 Number of instances of unregistered ASNs: 29 Number of 32-bit ASNs allocated by the RIRs: 26580 Number of 32-bit ASNs visible in the Routing Table: 21664 Prefixes from 32-bit ASNs in the Routing Table: 94966 Number of bogon 32-bit ASNs visible in the Routing Table: 24 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 242 Number of addresses announced to Internet: 2849895552 Equivalent to 169 /8s, 221 /16s and 244 /24s Percentage of available address space announced: 77.0 Percentage of allocated address space announced: 77.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.2 Total number of prefixes smaller than registry allocations: 249446 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 200535 Total APNIC prefixes after maximum aggregation: 58096 APNIC Deaggregation factor: 3.45 Prefixes being announced from the APNIC address blocks: 197351 Unique aggregates announced from the APNIC address blocks: 82271 APNIC Region origin ASes present in the Internet Routing Table: 9649 APNIC Prefixes per ASN: 20.45 APNIC Region origin ASes announcing only one prefix: 2702 APNIC Region transit ASes present in the Internet Routing Table: 1426 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4640 Number of APNIC addresses announced to Internet: 773494912 Equivalent to 46 /8s, 26 /16s and 152 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 221747 Total ARIN prefixes after maximum aggregation: 104303 ARIN Deaggregation factor: 2.13 Prefixes being announced from the ARIN address blocks: 220762 Unique aggregates announced from the ARIN address blocks: 105233 ARIN Region origin ASes present in the Internet Routing Table: 18426 ARIN Prefixes per ASN: 11.98 ARIN Region origin ASes announcing only one prefix: 6824 ARIN Region transit ASes present in the Internet Routing Table: 1891 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2655 Number of ARIN addresses announced to Internet: 1079234176 Equivalent to 64 /8s, 83 /16s and 206 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 205349 Total RIPE prefixes after maximum aggregation: 97932 RIPE Deaggregation factor: 2.10 Prefixes being announced from the RIPE address blocks: 201735 Unique aggregates announced from the RIPE address blocks: 119703 RIPE Region origin ASes present in the Internet Routing Table: 25987 RIPE Prefixes per ASN: 7.76 RIPE Region origin ASes announcing only one prefix: 11538 RIPE Region transit ASes present in the Internet Routing Table: 3697 Average RIPE Region AS path length visible: 4.6 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 8009 Number of RIPE addresses announced to Internet: 718764160 Equivalent to 42 /8s, 215 /16s and 120 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 96391 Total LACNIC prefixes after maximum aggregation: 21650 LACNIC Deaggregation factor: 4.45 Prefixes being announced from the LACNIC address blocks: 97742 Unique aggregates announced from the LACNIC address blocks: 42278 LACNIC Region origin ASes present in the Internet Routing Table: 8268 LACNIC Prefixes per ASN: 11.82 LACNIC Region origin ASes announcing only one prefix: 2198 LACNIC Region transit ASes present in the Internet Routing Table: 1530 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 27 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5814 Number of LACNIC addresses announced to Internet: 173673728 Equivalent to 10 /8s, 90 /16s and 13 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 21265 Total AfriNIC prefixes after maximum aggregation: 4292 AfriNIC Deaggregation factor: 4.95 Prefixes being announced from the AfriNIC address blocks: 27481 Unique aggregates announced from the AfriNIC address blocks: 9244 AfriNIC Region origin ASes present in the Internet Routing Table: 1267 AfriNIC Prefixes per ASN: 21.69 AfriNIC Region origin ASes announcing only one prefix: 438 AfriNIC Region transit ASes present in the Internet Routing Table: 243 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 546 Number of AfriNIC addresses announced to Internet: 104472832 Equivalent to 6 /8s, 58 /16s and 33 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4715 545 547 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4468 4192 74 ERX-CERNET-BKB China Education and Rese 7552 3136 1305 53 VIETEL-AS-AP Viettel Group, VN 45899 3007 1736 112 VNPT-AS-VN VNPT Corp, VN 9829 2734 1496 551 BSNL-NIB National Internet Backbone, IN 4766 2613 11120 761 KIXS-AS-KR Korea Telecom, KR 9808 2436 8699 27 CMNET-GD Guangdong Mobile Communication 9394 2180 4906 29 CTTNET China TieTong Telecommunications 4755 2149 429 186 TATACOMM-AS TATA Communications formerl 9498 2042 427 170 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 3644 238 589 CABLEONE - CABLE ONE, INC., US 6327 3616 1325 94 SHAW - Shaw Communications Inc., CA 22773 3392 2976 161 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2615 5904 1081 AMAZON-02 - Amazon.com, Inc., US 16625 2398 1316 1813 AKAMAI-AS - Akamai Technologies, Inc., 30036 2164 356 121 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 20115 2149 2751 527 CHARTER-20115 - Charter Communications, 18566 2109 405 108 MEGAPATH5-US - MegaPath Corporation, US 5650 2086 3074 1462 FRONTIER-FRTR - Frontier Communications 209 2040 5103 577 CENTURYLINK-US-LEGACY-QWEST - CenturyLi Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5444 1629 140 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3245 378 44 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2639 534 1913 AKAMAI-ASN1, US 12389 2227 2221 636 ROSTELECOM-AS, RU 34984 2083 342 537 TELLCOM-AS, TR 9121 1671 1693 19 TTNET, TR 13188 1602 100 47 TRIOLAN, UA 9009 1416 148 771 M247, GB 8402 1254 545 15 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5676 3339 593 Uninet S.A. de C.V., MX 10620 3436 537 388 Telmex Colombia S.A., CO 11830 2708 384 34 Instituto Costarricense de Electricidad 7303 1461 1000 252 Telecom Argentina S.A., AR 28573 1367 2249 191 CLARO S.A., BR 6503 1299 433 53 Axtel, S.A.B. de C.V., MX 6147 1259 374 25 Telefonica del Peru S.A.A., PE 3816 1041 507 128 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 13999 959 521 247 Mega Cable, S.A. de C.V., MX 11172 955 144 63 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1205 393 21 LINKdotNET-AS, EG 37611 894 107 9 Afrihost, ZA 24835 884 646 21 RAYA-AS, EG 36903 827 416 126 MT-MPLS, MA 36992 819 1531 71 ETISALAT-MISR, EG 8452 709 1731 19 TE-AS TE-AS, EG 29571 495 70 12 ORANGE-COTE-IVOIRE, CI 37492 470 470 57 ORANGE-, TN 15706 421 32 6 Sudatel, SD 37342 420 32 1 MOVITEL, MZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5676 3339 593 Uninet S.A. de C.V., MX 12479 5444 1629 140 UNI2-AS, ES 7545 4715 545 547 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4468 4192 74 ERX-CERNET-BKB China Education and Rese 39891 3778 203 20 ALJAWWALSTC-AS, SA 11492 3644 238 589 CABLEONE - CABLE ONE, INC., US 6327 3616 1325 94 SHAW - Shaw Communications Inc., CA 10620 3436 537 388 Telmex Colombia S.A., CO 22773 3392 2976 161 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 8551 3245 378 44 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5444 5304 UNI2-AS, ES 4538 4468 4394 ERX-CERNET-BKB China Education and Research Net 7545 4715 4168 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3616 3522 SHAW - Shaw Communications Inc., CA 22773 3392 3231 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3245 3201 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 3136 3083 VIETEL-AS-AP Viettel Group, VN 11492 3644 3055 CABLEONE - CABLE ONE, INC., US 10620 3436 3048 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65550 DOCUMENT 81.8.34.0/24 15924 BORUSANTELEKOM-AS, TR 65550 DOCUMENT 81.8.35.0/24 15924 BORUSANTELEKOM-AS, TR 65553 UNALLOCATED 103.132.227.0/24 138556 ARMOUR-AS-AP Armour Technologi 65549 DOCUMENT 117.239.163.0/24 65544 UNKNOWN 64339 UNALLOCATED 143.0.108.0/22 18747 IFX18747 - IFX Corporation, US 64355 UNALLOCATED 156.40.196.0/24 30387 NIH-NET-NCCS - National Instit 64011 UNALLOCATED 166.133.128.0/18 20057 ATT-MOBILITY-LLC-AS20057 - AT& 64011 UNALLOCATED 166.133.192.0/18 20057 ATT-MOBILITY-LLC-AS20057 - AT& Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 27.126.156.0/22 55827 UNKNOWN 27.126.156.0/23 55827 UNKNOWN 27.126.158.0/23 55827 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.220.48.0/20 36900 -Reserved AS-, ZZ 43.255.82.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:12 /9:10 /10:37 /11:100 /12:291 /13:568 /14:1135 /15:1905 /16:13353 /17:7972 /18:13881 /19:25629 /20:39916 /21:46161 /22:93255 /23:75822 /24:424200 /25:1066 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4358 5444 UNI2-AS, ES 6327 3390 3616 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2851 3644 CABLEONE - CABLE ONE, INC., US 8551 2699 3245 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2631 3392 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 11830 2053 2708 Instituto Costarricense de Electricidad y Telec 18566 2004 2109 MEGAPATH5-US - MegaPath Corporation, US 30036 1911 2164 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 5650 1754 2086 FRONTIER-FRTR - Frontier Communications of Amer Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1600 2:967 4:21 5:3085 6:45 7:1 8:1285 9:1 12:1805 13:328 14:1987 15:36 16:4 17:244 18:58 20:50 23:2666 24:2499 25:2 27:2483 31:1973 32:97 35:36 36:847 37:3051 38:1720 39:292 40:121 41:3279 42:767 43:2024 44:151 45:7175 46:3220 47:258 49:1351 50:1106 51:322 52:1016 54:285 55:693 56:6 57:42 58:1780 59:1070 60:507 61:2124 62:2124 63:1818 64:4967 65:2223 66:4836 67:2722 68:1169 69:3525 70:1324 71:605 72:2459 74:2754 75:515 76:543 77:1760 78:1806 79:2281 80:1804 81:1509 82:1134 83:905 84:1124 85:2297 86:514 87:1535 88:1053 89:2596 90:220 91:6566 92:1370 93:2442 94:2528 95:3254 96:928 97:343 98:951 99:377 100:87 101:1158 102:543 103:20923 104:3536 105:253 106:796 107:1784 108:690 109:3718 110:1652 111:1849 112:1484 113:1394 114:1143 115:1720 116:1734 117:1904 118:2175 119:1627 120:1008 121:1041 122:2348 123:1641 124:1471 125:1979 128:1267 129:829 130:538 131:1810 132:788 133:219 134:1087 135:242 136:566 137:718 138:2041 139:841 140:639 141:871 142:798 143:1046 144:862 145:494 146:1265 147:832 148:1723 149:801 150:787 151:1012 152:1054 153:335 154:2819 155:914 156:1622 157:948 158:640 159:1940 160:1571 161:906 162:2750 163:809 164:1194 165:1569 166:448 167:1393 168:3292 169:869 170:4103 171:574 172:1140 173:2213 174:1040 175:914 176:2327 177:4193 178:2522 179:1450 180:2179 181:2409 182:2668 183:1083 184:1441 185:14946 186:3652 187:2470 188:2899 189:1968 190:8301 191:1544 192:10047 193:6657 194:5411 195:4103 196:3092 197:1765 198:5909 199:6004 200:7190 201:5112 202:10392 203:10115 204:4539 205:3028 206:3223 207:3243 208:3963 209:4246 210:3936 211:1992 212:3156 213:2938 214:1099 215:54 216:5933 217:2214 218:881 219:581 220:1861 221:968 222:980 223:1364 End of report

1 0

JunOS Fusion Provider Edge
by Mehmet Akcin 12 Apr '19

12 Apr '19

Hey there Any ISP using Juniper Fusion Provider Edge? https://www.juniper.net/documentation/en_US/junos/information-products/path… I am trying to chat with an engineer besides Juniper engineers to understand how buggy (or not) this is to go on production for a medium size ISP. Any feedback good/bad appreciated. -- Mehmet +1-424-298-1903

10 10

Re: Incoming SSDP UDP 1900 filtering
by Patrick McEvilly 11 Apr '19

11 Apr '19

I'm working with Level3 on a similar problem. They filter both UDP and TCP port 1900 on our peer to them. This is blocking all connections that randomly use ephemeral tcp port 1900. They are refusing to remove the tcp port 1900 filter without dispensation from the DDoS security gods. I understand blocking UDP 1900, what is the purpose of Level3 filtering tcp port 1900? On 3/25/19, 12:44 PM, "NANOG on behalf of Saku Ytti" <nanog-bounces(a)nanog.org on behalf of saku(a)ytti.fi> wrote: Hey Tom, > If your edge ingress ACLs are not 100% in sync all the time, you will inevitably have Really Weird Stuff happen that will end up taking forever to diagnose. You may at some cases have hard to troubleshoot issues, which is true for everything, even when perfectly configured, because software is not perfect. However choosing to do iACL is still something many networks choose to do, because the upside is worth the complexity to them. > Packet filtering is more computationally taxing than just routing is. Your edge equipment is likely going to be built for maximum routing efficiency. Trying to bite off too much filtering there increases your risk of legit traffic being tossed on the floor. Depends on implementation, on some implementations it is zero-cost on some it is not. On most implementations it's very cheap, particularly compared to say uRPF. It seems your position is 'i don't know how ACL works on my platforms and i don't trust myself to write ACL, so i should not do them', which is perfectly valid position under those constrains, but other networks have other constrains under which it is no longer valid proposal to omit doing iACL. I would encourage networks to continue deploying iACL and consider it BCP. iACL removes attack surface and protects you from host of known and unknown SIRT issues. -- ++ytti

4 4

Multi-tenant Internet Access
by Steve Danello 11 Apr '19

11 Apr '19

Hello all; forwarding a question from a couple folks I know that are having issues with Comcast internet access at a seasonal resort on the East Coast. Does anyone know how multi tenant access works? It appears that something has been put in place that prevents cable modems from syncing and actually going ‘online’. The technicians have mentioned MDTA’s and Q2Q’s which are probably in the path; but can someone provide a brief explanation of how it works? There are somewhere on the order of 500+ tenants at the facility in question; they used to be able to get internet service over the same cabling where they were provided about 60+ standard def channels. Any guidance appreciated. Best; Steve

1 0

Netgate TNSR software router using DPDK/VPP/FRR
by nanog-isp＠mail.com 11 Apr '19

11 Apr '19

Hello NANOG, Has anybody kicked the tires of Netgate's TNSR software router that uses DPDK/VPP/FRR and would like to share their experience? Jared

1 0

Facebook (account)
by Nathan Anderson 10 Apr '19

10 Apr '19

Fellow NetOps, I realize this is an unorthodox / off-topic request, but I've been trying to help a friend out and don't know how to advise her next. If there is someone from FB here who has connections to someone in account security and is willing to contact me off-list, I'd really appreciate it. A friend had her FB account of many years hijacked and then held for ransom by a random dude. When she asked FB to intercede, she appeared to have her account back for a short time (< 24 hrs) before FB themselves blocked the account, and that's where we are now. It's been over 2 weeks and she has been going round and round with "CS" and getting nowhere...whoever these robots are keep repeating requests for her to send in ID, which she does, and then they repeat the request again and it just goes in a circle. I have a feeling that I know what's going on behind-the-scenes, but we can't seem to get a living, breathing human over there who isn't just reading a script to actually listen to her. Seriously, what is the average person supposed to do under these circumstances? If this was just the story of a lone FB account I'm not sure I would bother and I'd just tell her to get a new one. But she runs a business (popular local coffee shop) with a FB page that this account of hers was apparently the only admin for. Thanks in advance for any leads, -- Nathan Anderson First Step Internet, LLC nathana(a)fsr.com

5 5

residential/smb internet access in 2019 - help?
by david raistrick 10 Apr '19

10 Apr '19

folks, I've been away from nanog for a long time - and away from the ISP world for longer. Looking at a house in a new area, at&t copper splice box out front, bellsouth fiber markers as well (yes, that's usually just passing by. but it's there). Owners since '82 said the telephone company was AT&T - but the New AT&T apparently no longer offers phone or internet service there. This is located in a semi-rural area between Ocala and Gainesville Florida (Micanopy, specifically). I knew the state of residential service was in sorry shape - but from what I'm reading, it seems to be worse than I'd though possible. Anyone have any suggestions for service options? I'm cool with dark fiber, if it comes down to that (and can be price sanely and terminated somewhere useful), but it seems like there -should- still be CLEC/DLECs or just plain resellers in business who still have access to resources that are in the ground. My business operates from home - so obviously quality service is a priority, and I'm willing to pay for it within reason. Business plans are certainly an option as well. I've confirmed with all of the known players via their front channels - att, windstream, centurylink, frontier, cox/comcast/spectre. Via backchannels I've confirmed that cox has fiber in the ground 1.4 miles away - straight shot down a dirt road (same one with the BS fiber markers). I have a lead on a couple of tower shots - but there's a big (for florida) ridge between us, and I might have to build 3-400ft to hit anything (speculatively). Anyone have local area or other knowledge that might be helpful? I'd hate to miss out on this house - it's a lot of things we love - but cell or sat only for internet access just isn't going to fly. thanks guys. ...david

14 21

RPKI Route Origin Validation - Africa
by Ben Maddison 09 Apr '19

09 Apr '19

Hello all. In November 2018 during the ZAPF (South African Peering Forum) meeting in Cape Town, 3 major African ISP's announced that they would enable RPKI-based ROV (Route Origin Validation), including dropping Invalid routes as part of efforts to improve Internet routing security, on the 1st April, 2019. On the 1st of April, Workonline Communications (AS37271) enabled ROV and began dropping Invalid routes. This applies to all eBGP sessions, both IPv4 and IPv6. On the 5th of April, SEACOM (AS37100) enabled ROV and began dropping Invalid routes. This applies to eBGP sessions with public peers, private peers and transit providers, both for IPv4 and IPv6. eBGP sessions toward downstream customers will follow in 3 months time. Implementation at the third ISP has yet to be completed. We are sure they will communicate with the community when they are ready to do so. Please note that for the legal reasons previously discussed in various fora, neither Workonline nor SEACOM are utilising the ARIN TAL. As a result, any routes covered only by a ROA issued under the ARIN TAL will fall back to a status of Not Found. Unfortunately, this means that ARIN members will not see any improved routing security for their prefixes on our networks until this is resolved. We will each re-evaluate this decision if and when ARIN's policy changes. We are hopeful that this will happen sooner rather than later. If you interconnect with either of us and believe that you are experiencing any routing issues potentially related to this new policy, please feel free to reach out to either: - noc(a)workonline.africa - peering(a)seacom.mu Workonline Communications and SEACOM hope that this move encourages the rest of the ISP community around the world to ramp up their deployment of RPKI ROV and begin dropping Invalid routes. We appreciate the work that AT&T and others have carried out in the same vein. In the mean time, we are happy to answer any questions you may have about our deployments. Thanks, Mark Tinka (SEACOM) & Ben Maddison (Workonline Communications).

1 0