- Test - lists.nanog.org

Cisco 2 factor authentication
by Ray Ludendorff 27 Jun '16

27 Jun '16

Has anyone setup two factor VPN using a Cisco ASA VPN solution? What sort of soft client based dual factor authentication options were used for the Cisco VPNs (e.g. Symantec VIP, Google authenticator, Azure authenticator, RSA, etc.) I am trying to find what infrastructure is needed to come up with the solution. Please contact me of list Regards Ray Ludendorff

6 5

Quick question regarding: Problematic IPv6 Multicast traffic within an IX.
by Bob Evans 26 Jun '16

26 Jun '16

Is it true that managed Layer2 switches used by IX's can not block IPv6 multicast ingress port traffic from broadcasting to all ports ? ___Yes , seen many IXs with IPv6 multicast continuing yet IPv4 multicast is blocked. ___No , All should be able to bock IPv6 multicast. ___Only a few specific managed switch manufacturers have this issue with IPv6 multicast broadcasting. You're knowledge on this problem would be helpful. Thank You in advance. Bob Evans CTO

5 4

measuring effects of happy eyeballs
by Bajpai, Vaibhav 25 Jun '16

25 Jun '16

Dear NANOG, A paper on measuring the effects of happy eyeballs [RFC 6555] just got accepted last week. This uses a 3-years long ('13 - '16) dataset of TCP connect times towards ALEXA top 10K websites collected from 80 dual-stacked SamKnows probes. We just released [a] the paper. Thought to share it along: [a] http://goo.gl/JmKEax Feedback most welcome! You may recall preliminary versions of this work at RIPE 66 [b] and IETF 87 [c]. [b] https://ripe66.ripe.net/archives/video/1208 [c] https://vimeo.com/71407427 Measuring the Effects of Happy Eyeballs --------------------------------------- The IETF has developed protocols that promote a healthy IPv4 and IPv6 co-existence. The Happy Eyeballs (HE) algorithm, for instance, prevents bad user experience in situations where IPv6 connectivity is broken. Using an active test (happy) that measures TCP connection establishment times, we evaluate the effects of the HE algorithm. The happy test measures against ALEXA top 10K websites from 80 SamKnows probes connected to dual-stacked networks representing 58 different ASes. Using a 3-years long (2013 - 2016) dataset, we show that TCP connect times to popular websites over IPv6 have considerably improved over time. As of May 2016, 18% of these websites are faster over IPv6 with 91% of the rest at most 1 ms slower. The historical trend shows that only around 1% of the TCP connect times over IPv6 were ever above the HE timer value (300 ms), which leaves around 2% chance for IPv4 to win a HE race towards these websites. As such, 99% of these websites prefer IPv6 connections more than 98% of the time. We show that although absolute TCP connect times (in ms) are not that far apart in both address families, HE with a 300 ms timer value tends to prefer slower IPv6 connections in around 90% of the cases. We show that lowering the HE timer value to 150 ms gives us a margin benefit of 10% while retaining same preference levels over IPv6. Best, Vaibhav =================================== Vaibhav Bajpai www.vaibhavbajpai.com Room 91, Research I School of Engineering and Sciences Jacobs University Bremen, Germany ===================================

1 0

colo at 111 8th ave NY?
by Sean Watkins 25 Jun '16

25 Jun '16

Hi, I'm looking for a rack or half rack at 111 8th ave NYC. I've tried going via sales at Equinix etc and few other carriers, it seems to never go anywhere... Can anyone who is there, and wants to sell some space contact me off list? thanks Sean -- -- Sean Watkins 403-629-6152

2 1

FCC adopts order requiring submarine cable outage reporting
by Sean Donelan 24 Jun '16

24 Jun '16

In the past, over 75% of submarine cable operators did not voluntarily report outages of submarine cables with US landing points to the FCC. In other words, less than 25% of submarine cable operators reported outages. The FCC would learn about the submarine cable failures, sometimes days later, from news reports or calls from the public. Since the FCC treats outage reports as confidential information, that still means the public will not necessarily be informed. https://www.fcc.gov/document/fcc-adopts-rules-reliable-submarine-cable-infr… The rules require submarine cable licensees to report major outages to the agency’s Network Outage Reporting System (NORS). Other communications providers – including wireline, wireless, and satellite – already report outages to NORS.

1 0

60 hudson - insurance?
by Chris McDonald 24 Jun '16

24 Jun '16

are others being told that their remote hands / installers , etc now need to show proof of insurance? thanks

4 4

Re: Cisco 2 factor authentication
by Peter Loron 23 Jun '16

23 Jun '16

We are in the process of rolling out Okta, including using a second factor for AnyConnect VPN. Works well. -Pete On 6/22/16, 01:27, "NANOG on behalf of Ray Ludendorff" <nanog-bounces(a)nanog.org on behalf of LudendorffR(a)rferl.org> wrote: Has anyone setup two factor VPN using a Cisco ASA VPN solution? What sort of soft client based dual factor authentication options were used for the Cisco VPNs (e.g. Symantec VIP, Google authenticator, Azure authenticator, RSA, etc.) I am trying to find what infrastructure is needed to come up with the solution. Please contact me of list Regards Ray Ludendorff

1 0

Looking for a Level 3 Routing Registry contact
by Delacruz, Anthony B 23 Jun '16

23 Jun '16

Please contact me off list if you can help me get in touch with an actual person that can clear out old entries in the Level 3 routing registry. I can't do jack with the automated and the contacts that put them in are non responsive for clearing out their years old mess. Thanks. This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

3 2

Re: 1GE L3 aggregation
by Baldur Norddahl 23 Jun '16

23 Jun '16

Hi If I need to speak BGP with a customer that only has 1G I will simply make a MPLS L2VPN to one of my edge routers. We use the ZTE 5952E switch with 48x 1G plus 4x 10G for the L2VPN end point. If that is not enough the ZTE 8900 platform will provide a ton of ports that can do MPLS. The tunnel is automatically redundant and will promote link down events, so there is not really any downside to doing it this way on low bandwidth peers. Regards Baldur Den 16. jun. 2016 09.52 skrev "Saku Ytti" <saku(a)ytti.fi>: Hey, I've been bit poking around trying to find reasonable option for 1GE L3 full BGP table aggregator. It seems vendors are mostly pushing Satellite/Fusion for this application. I don't really like the added complexity and tight coupling Satellite/Fusion forces me. I'd prefer standards based routing redundancy to reduce impact of defects. ASR9001 and MX104 are not an options, due to control-plane scale. New boxes in vendor pipeline are completely ignoring 1GE. I've casually talked with other people, and it seems I'm not really alone here. My dream box would be 96xSFP + 2xQSFP28, with pretty much full edge features (BGP, LDP, ISIS, +1M FIB, +5M RIB, per-interface VLANs, ipfix or sflow, at least per-port QoS with shaper, martini pseudowires). With tinfoil hat tightly fit on my head, I wonder why vendors are ignoring 1GE? Are business cases entirely driven now by Amazon, Google, Facebook and the likes? Are SP volumes so insignificant in comparison it does not make sense to produce boxes for them? Heck even 10GE is starting to become problematic, if your application is anything else than DC, because you can't choose arbitrary optics. -- ++ytti

6 23

IP and Optical domains?
by Glen Kent 23 Jun '16

23 Jun '16

HI, I was reading the following article: http://www.lightreading.com/optical/sedona-boasts-multilayer-network-orches… It says that "The IP layer and optical layer are run like two separate kingdoms," Wellingstein says. "Two separate kings manage the IP and optical networks. There is barely any resource alignment between them. The result of this is that the networks are heavily underutilized," or, from an alternative perspective, "they are heavily over-provisioned." Can somebody shed more light on what it means to say that the IP and optical layers are run as independent kingdoms and why do ISPs need to over-provision? Thanks, Glen

7 21