- NANOG - lists.nanog.org

Re: Novice sysadmins (was: Suggestions for a more privacy conscious email provider)
by Scott Weeks 06 Dec '17

06 Dec '17

--- list(a)satchell.net wrote: From: Stephen Satchell <list(a)satchell.net> Indeed, I'm not aware of any certification that applies to system administrators. Network administrators have certs that are well-recognized and accepted. Mail admins? Server admins? The certs that are out there border on jokes or disguised sale pitches. --------------------------------------- Have you seen neteng certs lately? I'm forced to maintain a lower level one to keep my job and it makes me angry every time I have to do it. The sales pitch is hidden in the words and the correct answer is almost always something that has to do with the proprietary item the vendor has. scott

2 1

Lanner Devices - NCA-5510
by Raymond Burkholder 05 Dec '17

05 Dec '17

Hello, A number of people have been suggesting Lanner boxes for routing. I have used FW-7543A and FW-7573A boxes with Debian with no issues. I am currently trying the NCA-5510 model with NCS2-IGM806B (XL710) and NCS2-IXM407A (I350) cards with a standard Debian Stretch installation. I was hoping that it would be as easy as installing the operating system, turning ports up, and getting a working network. It was like that with the other models. Not with this model. There seems to be a bunch of different BIOS combinations which give different (bad) results. And for the combinations I've tried, I can't seem to get the XL710 card to work properly. Maybe I should have gone with the 82599 card instead. In addition, the I210 based management port also isn't coming up properly, always some sort 'interface reset' error. Which, with some bios settings, I get on the I350 cards as well. If someone has a similar model and/or configuration, what sort of BIOS/Kernel settings have you used to get something operationally stable? Any particular Kernel versions work best? I tried 4.9.51, and 4.14.3. It seems to take about 48 hours to get turn arounds from Taiwan engineering, which I am currently trying to escalate from a sales office, but was hoping, in the meantime, someone else might have some experiences to share? I can provide console / kernel messages to show what I am encountering for those interested. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Akamai contact
by J. Oquendo 05 Dec '17

05 Dec '17

Can one of the Akamai (non salesy) guys ping me off list please. Security related. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 0A96 6318 EA49 4032 21C9 A7A8 81E9 3E95 414F 356E https://pgp.mit.edu/pks/lookup?op=get&search=0x81E93E95414F356E

2 1

Any from amazon cloud app.conceptboard.com
by Shoaib Farhan 05 Dec '17

05 Dec '17

Hi, Anyone from Amazon Cloud in this list. Need help for app.conceptboard.com. Our client complaining they are getting disconnected from this site. Traceroute/mtr showing path is keep changing. traceroute to app.conceptboard.com (52.17.144.46), 30 hops max, 60 byte packets 1 noc-ut-gw.telnet.net.bd (120.50.31.17) 0.513 ms 0.619 ms 0.677 ms 2 116.212.104.25 (116.212.104.25) 0.842 ms 0.840 ms 0.943 ms 3 DHANMONDI-RTR1-2-BANANI-RTR.TELNET.COM.BD (116.212.104.173) 1.157 ms 1.212 ms 1.274 ms 4 43.224.113.185 (43.224.113.185) 0.974 ms 0.975 ms 0.977 ms 5 43.228.208.17 (43.228.208.17) 1.353 ms 1.355 ms 1.327 ms 6 43.228.208.1 (43.228.208.1) 2.229 ms 1.327 ms 4.002 ms 7 125.17.155.45 (125.17.155.45) 40.688 ms 42.783 ms 40.885 ms 8 182.79.245.18 (182.79.245.18) 170.338 ms 182.79.198.129 (182.79.198.129) 172.306 ms 203.101.100.170 (203.101.100.170) 172.314 ms 9 ams1-br-tra-r2.amazon.com (80.249.210.217) 199.384 ms 199.389 ms 197.153 ms 10 54.239.114.48 (54.239.114.48) 220.252 ms 54.239.114.96 (54.239.114.96) 219.471 ms 54.239.114.36 (54.239.114.36) 226.921 ms 11 54.239.114.65 (54.239.114.65) 222.170 ms 54.239.114.79 (54.239.114.79) 218.172 ms 54.239.114.89 (54.239.114.89) 218.971 ms 12 54.239.41.117 (54.239.41.117) 216.664 ms 54.239.41.119 (54.239.41.119) 216.329 ms 54.239.43.16 (54.239.43.16) 216.342 ms 13 54.239.41.206 (54.239.41.206) 216.650 ms 54.239.44.142 (54.239.44.142) 216.647 ms 216.635 ms 14 * * 54.239.41.204 (54.239.41.204) 215.933 ms 15 52.93.6.148 (52.93.6.148) 237.179 ms 52.93.7.186 (52.93.7.186) 231.180 ms 52.93.6.160 (52.93.6.160) 218.251 ms 16 52.93.7.3 (52.93.7.3) 216.543 ms 52.93.7.31 (52.93.7.31) 212.299 ms 52.93.7.19 (52.93.7.19) 218.105 ms 17 52.93.36.34 (52.93.36.34) 216.943 ms 52.93.7.8 (52.93.7.8) 230.334 ms 52.93.7.10 (52.93.7.10) 235.409 ms 18 52.93.7.101 (52.93.7.101) 218.487 ms 52.93.7.97 (52.93.7.97) 218.505 ms 52.93.7.117 (52.93.7.117) 217.368 ms 19 * * 178.236.0.213 (178.236.0.213) 215.187 ms 20 * * * MT: HOST: farhan.telnet.net.bd Loss% Snt Last Avg Best Wrst StDev 1.|-- noc-ut-gw.telnet.net.bd 0.0% 500 0.5 0.5 0.2 54.8 2.5 2.|-- 116.212.104.25 0.0% 500 0.9 0.8 0.7 1.6 0.0 3.|-- DHANMONDI-RTR1-2-BANANI-R 1.2% 500 0.8 2.0 0.8 187.7 12.6 4.|-- 43.224.113.185 0.0% 500 1.1 3.8 0.9 84.4 10.9 5.|-- 43.228.208.17 0.0% 500 1.2 1.9 1.0 16.7 1.6 6.|-- 43.228.208.1 0.0% 500 4.5 2.3 1.0 95.5 5.7 7.|-- 125.17.155.45 0.0% 500 41.2 42.5 39.9 109.5 6.6 8.|-- 182.79.247.217 0.2% 500 173.8 170.4 169.3 216.0 3.6 9.|-- ams1-br-tra-r2.amazon.com 2.8% 500 201.9 201.6 192.8 222.7 3.3 10.|-- 54.239.114.84 2.2% 500 222.7 224.8 211.8 336.8 9.6 11.|-- 54.239.114.91 1.8% 500 219.0 219.6 208.8 293.0 7.5 12.|-- 54.239.41.119 1.2% 500 218.3 218.1 208.9 257.0 3.9 13.|-- 54.239.44.140 2.2% 500 219.5 219.8 211.6 265.5 3.5 14.|-- ??? 100.0 500 0.0 0.0 0.0 0.0 0.0 15.|-- 52.93.6.136 1.8% 500 222.2 234.4 212.1 382.2 14.0 16.|-- 52.93.7.25 2.6% 500 212.9 218.8 208.9 248.9 4.2 17.|-- 52.93.7.18 2.8% 500 235.3 230.9 214.0 266.2 12.2 18.|-- 52.93.7.115 1.6% 500 217.8 218.0 210.0 244.2 2.4 19.|-- ??? 100.0 500 0.0 0.0 0.0 0.0 0.0 Any help would be appreciated. -- Regards, Md. Shoaib Farhan <http://www.telnet.com.bd>

1 0

100G - Whitebox
by Mike Hammett 04 Dec '17

04 Dec '17

I first sent to an IX-specific mailing list, but as I have yet to see the message hit the list, I figured I would post it here as well. We've had multiple requests for 100G interfaces (instead of Nx10G) and no one seems to care about the 40G interfaces we have available. Looking at cost effective options brings us to whitebox switches. Obviously there's a wide range of hardware vendors and there are a few OSes available as well. Cumulus seems to be the market leader, while IPinFusion seems to be the most feature-rich. We're not doing any automation on the switches at this time, so it would still need decent manual configuration. It wouldn't need a Cisco-centric CLI as we're quite comfortable managing standard Linux-type config files. We're not going all-in on some overlay either given that we wouldn't be replacing our entire infrastructure, only supplementing it where we need 100G. I know that LINX has gone IPinfusion. What OS would be appropriate for our usage? I'm not finding many good comparisons of the OSes out there. I'm assuming any of them would work, but there may be gotchas that a "cheapest that meets requirements" doesn't quite unveil. Any particular hardware platforms to go towards or avoid? Broadcom Tomahawk seems to be quite popular with varying control planes. LINX went Edgecore, which was on my list given my experience with other Accton brands. Fiberstore has a switch where they actually publish the pricing vs. a bunch of mystery. Thoughts? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 12

Alternatives to ISE?
by Christopher J. Wolff 04 Dec '17

04 Dec '17

I've about reached my limit with the dumpster fire that is Cisco's Identity Service Engine. Are there any reliable alternatives that do endpoint classification, central web auth, and .1x auth? Thanks in advance, Christopher

7 7

BGP next-hop self benefits
by craig washington 04 Dec '17

04 Dec '17

Hello everyone, Question, what are the true benefits to using the next-hop self feature, doesn't matter what vendor. Most information I see is just to make sure you have reach-ability for external routes via IBGP, but what if all your IBGP knows the eBGP links? Is there a added benefit to using next hop self in this situation? Any feedback is much appreciated, either for the question specifically or whatever else you got 😊, L3VPN's or underlying technology that has to have that. Thanks

4 3

Contact info, AS4766 Korea Telecom
by Igor Krneta 04 Dec '17

04 Dec '17

Hi, is there anyone from Korea Telecom on this list ? Trying to contact anyone in NOC, it seems that they blacklisted our complete AS (198252) and they are not responding to e-mail. Our customer support is overwhelmed with complaints about non reachable servers hosted in their network. Any help is appreciated. Sincerely, Igor Krneta Elta Kabel d.o.o.

1 0

Re: OSPF Monitoring Tool
by Scott Weeks 03 Dec '17

03 Dec '17

--- mmethw2003(a)gmail.com wrote: From: Methsri Wickramarathna <mmethw2003(a)gmail.com> Is anyone knows about a Monitoring tool for OSPF ?? -------------------------------------- Use SNMP and any graphing tool (such as Cacti, if you don't need to scale to a large size) Some SNMP OIDs: ospfNbrHelloSuppressed 1.3.6.1.2.1.14.10.1.11 ospfNbrState 1.3.6.1.2.1.14.10.1.6 ospfAreaLsaCount 1.3.6.1.2.1.14.2.1.7 ospfLsdbAdvertisement 1.3.6.1.2.1.14.4.1.8 and whatever else you want to monitor. scott

1 0

Re: Incoming SMTP in the year 2017 and absence of DKIM (fwd)
by John R. Levine 02 Dec '17

02 Dec '17

In article <6134b4a7-9da8-2935-e9f6-e4374b3fdba4(a)spamtrap.tnetconsulting.net>, Grant Taylor via NANOG <gtaylor(a)tnetconsulting.net> wrote: >> https://datatracker.ietf.org/doc/draft-levine-dkim-conditional/ >The only way that I can think of is for the originating mail server to >DKIM sign the message twice, 1st with the classic DKIM-Signature w/o the >!fs tag, and 2nd with a DKIM-Signature that includes the !fs tag with a >value of of the recipient's domain. >Is this what you were intending? A list of DKIM-Signatures linked via >!fs tags? Yup, with the chain typically having no more than one or two links, since legit forwarding of the kind that might break DKIM is pretty rare more than two deep. >If I do understand correctly, I think that it's intriguing. I'm not >aware of anything else that would work quite the same way. That was the plan. I thought it was pretty clever, but like I said, the large mail systems that developed ARC wanted to put the control with the recipients, not the senders. R's, John

1 0