November 1998 - Test - lists.nanog.org

QUICKER FIX Re: [fjk].gtld-servers.net bogus for .com
by J.D. Falk 11 Nov '98

11 Nov '98

Many thanks to my friend & cow-orker Tristan Horn for this idea...in BIND 8 you can define servers as bogus (meaning "don't ever trust these") as follows: // [fjkl].root-servers.net server 192.5.5.241 { bogus yes; }; server 198.41.0.10 { bogus yes; }; server 193.0.14.129 { bogus yes; }; server 198.32.64.12 { bogus yes; }; -- J.D. Falk <jdfalk(a)cp.net> "A name indicates what we seek. Special Agent In Charge (Abuse Issues) An address indicates where it is. Critical Path, Inc. A route indicates how we get there." -- Jon Postel (1943-1998)

2 1

gateway failover.
by spam＠eek.org 11 Nov '98

11 Nov '98

i've a situation where the network we're building is very low-traffic, but requires maximum uptime. the budget is for all components to be duplicated to allow for failover. i've figured out various ways to do load-balancing and failover at the router/nat level, and at L2, but have run into a bit of a problem figuring how to use two solaris boxes (firewalls) as gateways for all servers/clients behind them in some kind of HA/failover configuration. i'd like to minimize the client/server side configuration as much as possible (and the environment may include NT, Macs, or other such ilk which will not easily supporting a useful routing protocol), so something like installing gated on all of the boxes, and implementing an ospf environment is an unsavory proposition. i'd like something like HSRP, but for solaris/unix, and preferably free. i'm aware of several vendor HA solutions, but they are mostly overkill for our application. i've looked into IRDP (rfc1256), but i cant find any information about vendor support. any pointers to relevant info would be appreciated, including any general resources for HA/network redundancy/failover stuff (preferably non-commercial). -foo

2 1

Cisco IOS 12.0 x 11.1CC
by Rubens Kuhl Jr. 11 Nov '98

11 Nov '98

Have anyone here upgraded a 7500 router from IOS 11.1CC to IOS 12.0 ? If you upgraded, are you happy with it ? ( ) Yes, it supports all the features I was using in 11.1CC ( ) Yes, it supports new features that I'm using now or intend to use ( ) Yes, it supports all cards and/or port adapters ( ) If you upgraded and you are you unhappy with it, why ? ( ) Because it lacks support of features I need ( ) Because it lacks support of card and/or port adapter I have ( ) Because it makes CPU go 100% ( ) Because it doesn't work at all ( ) If you have not upgraded, why ? ( ) Have no support contract, costs money ( ) Cisco told me not to do so ( ) My Cisco representative told me not to do so ( ) 11.1CC works very well, why should I risk ( ) I've seen no reason to upgrade (till last week security notice) ( ) Downtime concerns ( ) Rubens Kuhl Jr.

1 1

Re: ARIN?
by Scott Gifford 11 Nov '98

11 Nov '98

>On Tue, Nov 10, 1998 at 03:36:53PM -0600, Phil Howard wrote: > >> The other purpose, however, is used to justify address space allocation. > >Ok, this question just occurred to me... > >NACS is going to need a new /19 pretty soon. But we have 13 Class C's >used for things like dialups, servers, web virtual hosts, etc. So how can >we explain our need for more addresses when much of our current /19 may appear >to be unused, since it isn't SWIP'd? > We just put "internal use" on the ARIN form to request the allocation, explained what each block was used for in the justification section, and had no problem whatsoever. ------Scott.

1 0

Re: gateway failover.
by Paul Vixie 11 Nov '98

11 Nov '98

foo(a)eek.org (foo) writes: > i'm looking for pointers to any resources for doing failover on > solaris boxes. i have an environment in which i'd like a pool of > servers to use one of two solaris boxes as their gateway, the other > box being in hot standby until a failure of the primary box occurs, > at which time it would failover. f.root-servers.net (192.5.5.241) is a virtual host on two different physical hosts. these hosts speak gated and inject a /32 route into ospf, which makes the /32 look dual homed. the exit gateways pick the first one they saw (or sometimes i adjust the costs manually). if the host that was picked as the path to the vhost dies, the exit gateways flip the route over to the surviving host. alteon, foundry, and radware make "layer 4 switch" boxes that do the same thing but add local load balancing so that both hosts can be up and serving at the same time. in this case the virtual host is in the L4-switch box which does its own remapping to physical hosts. -- Paul Vixie <paul(a)vix.com>

1 0

Re: ARIN?
by Steven J. Sobol 10 Nov '98

10 Nov '98

On Tue, Nov 10, 1998 at 11:02:58PM -0500, Kim Hubbard wrote: > We will do this as soon as we add some kind of security measures to SWIP > templates. I'm concerned with end-users even knowing about SWIP :-) Fair enough. Thanks for the quick reply. -- Steve Sobol [sjsobol(a)nacs.net] Part-time Support Droid [support(a)nacs.net] NACS Spaminator [abuse(a)nacs.net] Spotted on a bumper sticker: "Possum. The other white meat."

1 0

gateway failover.
by foo 10 Nov '98

10 Nov '98

i'm looking for pointers to any resources for doing failover on solaris boxes. i have an environment in which i'd like a pool of servers to use one of two solaris boxes as their gateway, the other box being in hot standby until a failure of the primary box occurs, at which time it would failover. something like HSRP for unix would work nicely, though i've not found anything similar, except for IRDP (rfc1285), however it doesnt seem to be supported by anyone, in so far as i've been able to tell. i'm aware of commercial solutions, but i'm hoping to find something in the public domain as most of them are overkill and/or expensive. i'd like to avoid doing something with gated/ospf (or another suitably featured routing daemon/protocol), as the environment may include NT, 95, and other boxes that dont easily listen to any sufficiently useful routing protocol, as far as i know. i'm open to just about any suggestion, including an L2 solution, except for something that would depend on clientside software, because of the OS limitations. respond privately, and i'll summarize to the list if necessary. -foo

1 0

Re: ARIN?
by John Fraizer 10 Nov '98

10 Nov '98

At 06:58 PM 11/10/98 -0500, Jeff Mcadams wrote: >>An _address_allocation_ that small just doesn't >>require that level of public contact visibility." > >Here I disagree. As I (and others have pointed out) there are people >with /32's that have just as much administrative control over their IP >"space" as someone with a /25 might have. I have *several* customers, >and we're not all that big of an ISP, that have *full* administrative >control over their IP space with the one exception of reverse lookups. I was quoting someone else and merely replaced the word "network" with "address_allocation." Why don't they have reverse lookups? in-addr.arpa records control is the only reason I care about having address space under my maintainer ID to start with. ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

3 2

Re: ARIN?
by Jeff Mcadams 10 Nov '98

10 Nov '98

Thus spake John Fraizer >OK. How about I re-word this a bit and see how it goes: >>> >I think this misses the point. ARIN doesn't require or want you to SWIP >>> >your /30 and /32 allocations. A network that small just doesn't require >>> >that level of public contact visibility. >...should read: >"I think this misses the point. ARIN doesn't require or want you to SWIP >your /30 and /32 allocations. First sentence wasn't in dispute of course. :) >An _address_allocation_ that small just doesn't >require that level of public contact visibility." Here I disagree. As I (and others have pointed out) there are people with /32's that have just as much administrative control over their IP "space" as someone with a /25 might have. I have *several* customers, and we're not all that big of an ISP, that have *full* administrative control over their IP space with the one exception of reverse lookups. >Now, can we all agree that /30's and /32's are small allocations in the >grand scheme of it all and that the size or the organizations/networks that >use addresses in those allocations can not be accurately determined by the >size of the allocation alone? Good. I do definitely agree with this. :) -- Jeff McAdams Email: jeffm(a)iglou.com Head Network Administrator Voice: (502) 966-3848 IgLou Internet Services (800) 436-4456

1 0

Re: ARIN?
by John Fraizer 10 Nov '98

10 Nov '98

OK. How about I re-word this a bit and see how it goes: >> >I think this misses the point. ARIN doesn't require or want you to SWIP >> >your /30 and /32 allocations. A network that small just doesn't require >> >that level of public contact visibility. ...should read: "I think this misses the point. ARIN doesn't require or want you to SWIP your /30 and /32 allocations. An _address_allocation_ that small just doesn't require that level of public contact visibility." Now, can we all agree that /30's and /32's are small allocations in the grand scheme of it all and that the size or the organizations/networks that use addresses in those allocations can not be accurately determined by the size of the allocation alone? Good. ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

1 0