- NANOG - lists.nanog.org

IPv6 CPE best practices
by Chuck Church 16 Jul '15

16 Jul '15

So, I've been following this IPv6 discussion for a while now. Putting much more thought into it than ever before. What I've gathered so far: We need both SLAAC and DHPCv6 on CPE router to support all end clients. Android and some other platforms still have some issues with a v6-addressed DNS server (or don't use DHCPv6 at all), so you really need your v4-addressed DNS server to hand out both AAAA and A records together. Is that close? So giving each customer a /48 is the way to go. How does one go about configuring CPEs for devices to use this? I'm aware of how DHCP-PD can dish out a /48 of a larger block. Should I move to a standard CPE that supports DHCP-PD (here is a list: https://getipv6.info/display/IPv6/Broadband+CPE , some mention PD)? Or should I just allow them to use any IPv6 compatible router, and issue each customer a /48, but only configure a /64 of that block for each CPE's inside interface (manual config). Is there anything other than DHCP-PD that can do this auto-magically? I support a small WISP occasionally, it's all wireless and Ethernet. Several hundred small business customers. Nothing super complicated. Been playing with an HE tunnel the last few days and found my netflow collector works fine with FNF and IPv6, so making some progress. Just wanting to avoid any big mistakes when we think about getting some customers on it. Thanks, Chuck

2 1

Speaking of NTP...
by Matthew Huff 16 Jul '15

16 Jul '15

We have 5 NTP server: 2 x stratum 1 rubidium oscillator time servers with GPS sync, and 3 servers running NTP 4.2.6p5-3 synced to external internet based NTP stratum 1 servers. We monitor our NTP environment closely, and over the last 10+ years, normally all of our NTP servers are sync'ed within +/- 2 msec. Starting last Friday, we started seeing some remote NTP servers with GPS reference consistently offset by 10 msec. Any one else seeing this? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-694-5669

4 4

Re: 'gray' market IPv4
by Seth Mos 16 Jul '15

16 Jul '15

We had the same thing finding a broker for a /24 pi in the RIPE region. Not all of the brokers have the size you want, eg a /20 when you need a /24. It ends up being between 2500 to 4000 euros depending on notary fees and if you already have a LIR agreement. Cheers -------- Oorspronkelijk bericht --------Van: Nicholas Warren <nwarren(a)barryelectric.com> Datum: 14-07-2015 15:19 (GMT+01:00) Aan: nanog(a)nanog.org Onderwerp: 'gray' market IPv4 Where is one of these v4 markets that we can buy some IPv4 space from? I would prefer to have a place where we could see recent transactions, something along the lines of x amount of addresses for y amount of monies. Google search is failing me for some reason.. - Thanks, Nich

8 9

Re: Remember "Internet-In-A-Box"?
by Seth Mos 16 Jul '15

16 Jul '15

So, if i get this right. The problem is not quite as bad to fix. It just needs a dnscache/dnsproxy process bound to the ipv4 localhost that uses the ipv6 dns server. Basically what dnsmasq does. Biggest problem is that it wouldn't follow autoconfigure and thus require manual intervention. That is a no go for dynamic networks of any sort. Cheers-------- Oorspronkelijk bericht --------Van: Owen DeLong <owen(a)delong.com> Datum: 16-07-2015 08:51 (GMT+01:00) Aan: Mark Andrews <marka(a)isc.org> Cc: nanog(a)nanog.org Onderwerp: Re: Remember "Internet-In-A-Box"? > On Jul 15, 2015, at 19:32 , Mark Andrews <marka(a)isc.org> wrote: > > > In message <55A682E6.1050607(a)matthew.at>, Matthew Kaufman writes: >> On 7/14/2015 11:22 PM, Mark Andrews wrote: >>> >>> Yet I can take a Windows XP box. Tell it to enable IPv6 and it >>> just works. Everything that a node needed existed when Windows XP >>> was released. The last 15 years has been waiting for ISP's and CPE >>> vendors to deliver IPv6 as a product. This is not to say that every >>> vendor deployed all the parts of the protocol properly but they >>> existed. >> >> This is only true for dual-stacked networks. I just tried to set up an >> IPv6-only WiFi network at my house recently, and it was a total fail due >> to non-implementation of relatively new standards... starting with the >> fact that my Juniper SRX doesn't run a load new enough to include RDNSS >> information in RAs, and some of the devices I wanted to test with >> (Android tablets) won't do DHCPv6. > > You can blame the religious zealots that insisted that everything > DHCP does has to also be done via RA's. This means that everyone > has to implement everything twice. Something Google should have > realised when they releases Android. Actually, no. In this case, the problem isn’t the things RA does, but the things his implementation of RA doesn’t do (RDNSS). Without RDNSS, android would still be brain-damaged and unable to figure out what an IPv6 nameserver is. The only way it would be able to talk to the IPv6 internet was if it got nameservers from DHCP4. At least with RDNSS, a thin lightweight client can get nameservers on IPv6. At least with RDNSS, a network administrator that doesn’t want to have to do DHCPv6 doesn’t have to in most cases. >> The XP box is in an even worse situation if you try to run it on a >> v6-only network. > > Which is fixable with a third party DHCPv6 client / manual configuration > of the nameservers. Nope… XP’s resolver is utterly and completely incapable of transmitting an IPv6 DNS request. You _HAVE_ to have an IPv4 resolver reachable to the box or forego any idea of using DNS. Owen

2 1

M$ no v6 or just me?
by Nicholas Warren 16 Jul '15

16 Jul '15

Surely Microsoft has IPv6 connectivity? Is there a problem with my dns, or is Microsoft not available over v6? Thanks, Nich

13 19

ARIN IPV4 Countdown
by Scott, Robert D. 15 Jul '15

15 Jul '15

If you have been keeping an eye on the ARIN IPV4 countdown, they allocated their last /23 yesterday. There are only 400 /24s in the pool now. https://www.arin.net/resources/request/ipv4_countdown.html Robert D. Scott Robert(a)ufl.edu Network Engineer 3 352-273-0113 Phone UF Information Technology 321-663-0421 Cell Network Services 352-273-0743 FAX University of Florida Florida Lambda Rail 352-294-3571 FLR NOC Gainesville, FL 32611 3216630421(a)messaging.sprintpcs.com

15 20

BIS re-regulating crypto is on the table...
by manning 15 Jul '15

15 Jul '15

if you use crypto (antivirus, mmap, etc.) or encrypt your data, use VPNs, etc… you might want to read and comment. Comment period closes next week. https://www.federalregister.gov/articles/2015/05/20/2015-11642/wassenaar-ar… manning bmanning(a)karoshi.com PO Box 12317 Marina del Rey, CA 90295 310.322.8102

2 1

Text Messages being blocked by AT&T
by Caine, Ronda 15 Jul '15

15 Jul '15

I am having a problem that started last Friday. Text messages sent from my domain seem to be being blocked by AT&T. Does anyone have a direct contact at AT&T who might be able to assist us in getting unblocked? Thank you in advance for any assistance you can offer. Ronda

2 1

Fwd: Overlay broad patent on IPv6?
by Baldur Norddahl 14 Jul '15

14 Jul '15

Nah what you describe is a different invention. Someone probably already has a patent on that. The browser will do a DNS lookup on slashdot.org and then cache that - forever (or until you restart the browser). Yes it will ignore the TTL (apps don't get the TTL at all, so apps don't know). Same happens if you ssh to yourserver.someplace.com. One DNS lookup, the traffic sticks there forever or until the session is terminated. DNS is horrible for this. If they had a IPv4 internal private network going you would not need to hook unto the DNS at all. Just get IP address when something wants to be routed out the WAN port. Also the NAT table is a good indicator of when you can release the address again. On other words, that would work, but the system described in the patent app wont. Of course both systems are useless. I can not imagine any end user that wont have a ton of IPv4 going on for the next decade to come. And when time comes, we are more likely to NAT64 than this. Regards, Baldur On 13 July 2015 at 18:04, Blake Dunlap <ikiris(a)gmail.com> wrote: > The point is you'd already have a 192 address or something, and it > would only grab the external address for a short duration for use as > an external PAT address, thus oversubscribing the ip4 pool to users > who need it (based on dns). Its still pretty broken, but less broken > than you describe. > > On Mon, Jul 13, 2015 at 8:55 AM, <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > Hi, > >> This is actually a good idea. Roll out an IPV6 only network and only > pass > >> out an IPV4 address if it's needed based on actual traffic. > > > > yes...shame someones applied for a patent on that! ;-) > > > > alan >

2 1

'gray' market IPv4
by Nicholas Warren 14 Jul '15

14 Jul '15

Where is one of these v4 markets that we can buy some IPv4 space from? I would prefer to have a place where we could see recent transactions, something along the lines of x amount of addresses for y amount of monies. Google search is failing me for some reason.. - Thanks, Nich

3 2