November 2000 - Test - lists.nanog.org

RE: ssh access to cisco and "unfriendlies"
by Sutantyo, Danny 28 Nov '00

28 Nov '00

Do you know if ssh is also available or will work on 65xx? DS -----Original Message----- From: Luan M Nguyen [mailto:lmnguyen@UU.NET] Sent: Tuesday, November 28, 2000 12:03 PM To: 'Sutantyo, Danny'; 'theo' Cc: nanog(a)merit.edu Subject: RE: ssh access to cisco and "unfriendlies" Before configuring the SSH server feature, you must configure a hostname and host domain for your router hostname sshunfriendlyrouter ip domain-name sounfriendly.org Before configuring the SSH server, you must generate a RSA key-pair for the router. When you generate an RSA key-pair for the router, you automatically enable SSH. When you delete the RSA key-pair, you automatically disable the SSH server. crypto key generate rsa 1024 (The recommended minimum modulus size is 1024 bits). Then configure the ssh parameters... ip ssh time-out 60 ip ssh authentication-retries 2 basically, you are done. From unix machine logon using ssh -l command. Or I use TeraTerm Pro with ssh works like a charm. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Sutantyo, Danny Sent: Tuesday, November 28, 2000 12:31 PM To: 'theo' Cc: nanog(a)merit.edu Subject: RE: ssh access to cisco and "unfriendlies" So How do you configure to run ssh on the router? instead of telnet? DS -----Original Message----- From: theo [mailto:tb@rimail.com] Sent: Thursday, November 23, 2000 1:41 AM Cc: nanog(a)merit.edu Subject: Re: ssh access to cisco and "unfriendlies" Jim Mercer wrote: > i've been trying to get ssh access to cisco IOS 12.1.2 working, but no > matter what i do, the openssh client says "3des not supported by server". > or you need to recompile your ssh distribution so that it supports des as well (3des is the default option). In that way it works. If you are outside US is very unlikely that you will get a copy of 3des capable software by cisco. They seem to be very strict on export policy regarding that thing. -- theo

1 0

RE: ssh access to cisco and "unfriendlies"
by Sutantyo, Danny 28 Nov '00

28 Nov '00

Thanks to all for your help and response. I appreciate all your help. DS -----Original Message----- From: Luan M Nguyen [mailto:lmnguyen@UU.NET] Sent: Tuesday, November 28, 2000 12:03 PM To: 'Sutantyo, Danny'; 'theo' Cc: nanog(a)merit.edu Subject: RE: ssh access to cisco and "unfriendlies" Before configuring the SSH server feature, you must configure a hostname and host domain for your router hostname sshunfriendlyrouter ip domain-name sounfriendly.org Before configuring the SSH server, you must generate a RSA key-pair for the router. When you generate an RSA key-pair for the router, you automatically enable SSH. When you delete the RSA key-pair, you automatically disable the SSH server. crypto key generate rsa 1024 (The recommended minimum modulus size is 1024 bits). Then configure the ssh parameters... ip ssh time-out 60 ip ssh authentication-retries 2 basically, you are done. From unix machine logon using ssh -l command. Or I use TeraTerm Pro with ssh works like a charm. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Sutantyo, Danny Sent: Tuesday, November 28, 2000 12:31 PM To: 'theo' Cc: nanog(a)merit.edu Subject: RE: ssh access to cisco and "unfriendlies" So How do you configure to run ssh on the router? instead of telnet? DS -----Original Message----- From: theo [mailto:tb@rimail.com] Sent: Thursday, November 23, 2000 1:41 AM Cc: nanog(a)merit.edu Subject: Re: ssh access to cisco and "unfriendlies" Jim Mercer wrote: > i've been trying to get ssh access to cisco IOS 12.1.2 working, but no > matter what i do, the openssh client says "3des not supported by server". > or you need to recompile your ssh distribution so that it supports des as well (3des is the default option). In that way it works. If you are outside US is very unlikely that you will get a copy of 3des capable software by cisco. They seem to be very strict on export policy regarding that thing. -- theo

1 0

Re: SWIP and RWHOIS
by Barrie Jones 28 Nov '00

28 Nov '00

Although SWIP is relatively easy to use, you have more control and (theoretically) privacy with rwhois. It's also not that hard to use, being a flat file format; once you make the initial investment to learn it, you're pretty much set and can write all kinds of scripts to update it as Todd mentioned. --------------------------------------- Barrie E. Jones - barrie(a)pdx.net not speaking for my ISP or my employer. ---------------------------------------

1 0

SWIP and RWHOIS
by Jeff Neuffer 28 Nov '00

28 Nov '00

Pros... Cons... Opinions? We are planning to receive, from ARIN, 32 class C networks. Would it be easier to manage our IP address space via email (SWIP) or setup a RWHOIS server?

2 1

RE: ssh access to cisco and "unfriendlies"
by Sutantyo, Danny 28 Nov '00

28 Nov '00

So How do you configure to run ssh on the router? instead of telnet? DS -----Original Message----- From: theo [mailto:tb@rimail.com] Sent: Thursday, November 23, 2000 1:41 AM Cc: nanog(a)merit.edu Subject: Re: ssh access to cisco and "unfriendlies" Jim Mercer wrote: > i've been trying to get ssh access to cisco IOS 12.1.2 working, but no > matter what i do, the openssh client says "3des not supported by server". > or you need to recompile your ssh distribution so that it supports des as well (3des is the default option). In that way it works. If you are outside US is very unlikely that you will get a copy of 3des capable software by cisco. They seem to be very strict on export policy regarding that thing. -- theo

3 2

Will the lights stay on - Predictions about the US electrical grid
by Sean Donelan 28 Nov '00

28 Nov '00

A selection of postive and negative outlooks for the reliability of the north american electric power grid. George Bush, Jr. has cited the growth of the Internet as one cause for power shortages. "Electric system resources will be adequate to meet projected electricity demand in North America this winter. Of course, extreme weather conditions and unexpected equipment problems may produce demands that exceed generation and transmission margins" source: ftp://www.nerc.com/pub/sys/all_updl/docs/pubs/winter2000.pdf "Californians are getting a two-fold warning at the first sign of cold weather: The state says there may be blackouts and a major utility is warning of sharply higher bills." source: http://dailynews.yahoo.com/h/ap/20001115/us/california_power_woes_2.html "Barring excessive heat, California should have enough electricity supply to meet its demand next summer, according to new -- and disputed -- projections from the California Energy Commission." source: http://dailynews.yahoo.com/h/sddt/20001121/lo/optimistic_electricity_foreca… "Responding to concerns about deterioration of the U.S. electric power grid, Congress within the next five years will enact legislation mandating minimum standards for reducing downtime and improving system reliability, a panel of utility industry analysts and journalists predicted here this week." source: http://www.ces.com/experts_predict.html

2 1

Re: Limits of reliability or is 99.999999999% realistic
by Sean Donelan 28 Nov '00

28 Nov '00

On Mon, 27 November 2000, Allan Carscaddon wrote: > At 05:44 PM 11/27/00, Sean Donelan wrote: > >http://www.whatsdown.com/ > > The proper address is http://whatsdown.net, although the performance of > porn sites might be a leading indicator of network health ;-). Just checking to see if people were awake! I think I received more mail about this error, than any other error I've made so far in my life. So much for my 99.999% typing accuracy. Yes, you are correct, the tld should be .net.

2 1

90% capacity loss - Business as usual?
by Sean Donelan 28 Nov '00

28 Nov '00

Perhaps the opposite of an 99.999% SLA, just how bad do things need to get before its a problem? Time after time, I've seen networks incapable of carrying 90%+ of its normal traffic, or unusable for its intended purpose. But the PR spokespeople never admit its an "outage." "Larry Plumb, Verizon spokesperson, said that as of Monday there had been no network outages in the Northeast region, just some slow throughput problems. This, despite a voice mail message at its main customer support number telling customers to remain patient until technicians resolved the problem. Repeated requests for information were ignored" http://www.internetnews.com/isp-news/article/0,,8_518561,00.html Ok, so the word "outage" is verboten for PR people. The electric utility industry has the same issue with the word "blackout." Instead there are sustained service anomalies. Which lets utilities say with a straight face they've had no blackouts. Instead of an SLA, do we need a SLG (Service Level Glossary)?

1 0

Re: Limits of reliability or is 99.999999999% realistic
by Toby_Williams＠enron.net 28 Nov '00

28 Nov '00

I think SLAs should always be supplied with a service and those that do not offer one, miss a vital point about the service infrastructure they've put in place. There's not one single, ideal level of service that everyone should be striving for with IP networks. We know this because no two applications have exactly the same network requirements, hence consumer A will have subtley different requirements from consumer B. End consumers *may* want a generalist service, that can do a bit of everything, but as an ASP would your applications have the same network requirements as a video/VoIP provider? Would someone doing backup services share these requirements? There's a vast (and growing) space for differentiation of services and this can only occur with valid SLAs. >From a legal perspective: If I sell someone transit for a month, then the service is "down" that month, and heh I didn't offer an SLA. Then you still have to pay me for the service and I pay you nothing back. OK I'd lose my customers, but: I'd be considerably richer having sold bandwidth for a month and not used any myself, than I should be considering I've just ripped my customers off. That's why the SLA exists. It is a necessary part of the contract that defines the quality of the product to be sold. Toby All-- In a perfect world, your provider says the service is always on, the service is always on. In the real world, we have to deal with outages -- some kids vandalise a phone box, new tech trips over some cables, some idiot telco misimplements MPLS and brings your service down for a day.... These things happen, and sometimes we all just have to suck it down and deal with it. But if it happens continuously, you have to ask your provider for some assurance that it won't keep happening. This is what SLAs are for. In my experience, a company that delivers reasonable levels of service has no need for SLAs with their clients. The service is up, everybody is happy. SLAs are like your parent telling you to do the dishes again "and get it right this time, or else you go to bed with no jell-o!" Which s why, in looking for a vendor, I ask for an SLA. If they have one as a standard offering, then I know that they've messed up a lot in the past, and will probably be messing up more than I like in the future. It's like the kid who never did his homework coming up to the teacher on the last day of school asking for extra credit. NO YOU FOOL! You should have done it right the last 180 days! Anyway, just my thoughts.

1 0

RE: I think I jinxed Sprint
by Mathew Butler 28 Nov '00

28 Nov '00

I thought that routers were supposed to send ICMP Source-Quench messages when they got congested? Or is this something that the proponents of QoS didn't decide on? -Mat -----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] Sent: Friday, November 24, 2000 8:58 AM To: 'Sean Donelan'; nanog(a)merit.edu Subject: RE: I think I jinxed Sprint The internet is a lot less forgiving wrt outages then the telco. The telco can have a circut outage, re-route to another circuit, and the customer never sees an availability gap. Also, a total outage, during reduced traffic times, and no customer ever misses a dial-tone because they aren't trying to get one, is not an outage in telco terms. The internet, on the other hand, may have similar issues, unless we start talking streaming video, streaming audio, and voice over IP. In those cases, packet losses can make a serious mess of things. Also, congestion is treated differently between the two systems. Telcos will actually return a fast-busy when a switch becomes congested. The internet simply starts dropping packets. You can actually hear the latter when using www.dialpad.com or MS-Netmeeting (both of which, I use extensively).

4 3