April 2002 - Test - lists.nanog.org

fibre management
by Stefan Mink 05 Apr '02

05 Apr '02

Hi, I'm currently planing the "communications room" for our new computer center where the equipment of the carriers and our backbone-/ distribution-routers will be installed. To avoid all the pitfalls of unstructured cabling ;) I'd like to realise the cabling as structured as possible. My current scheme uses 3 "fibre cross connects": * one to connect carrier-lines and bb-routers (~500 SM ports) * one to connect bb-router and distr-routers (~400 MM ports) * one to connect distr-routers with access-routers/distribution switches in the rooms where servers are placed (~3000 MM ports) -> * maximum flexibility * connects are only done via short patch cables a) inside the rack of the equipment to a pach panel b) between ports off the cross connect * the way from one port to another is explicit Fibre cross connects which could cope with these port counts seem to be the Telect ADF and the ADC NGF, but they're probably the Ferraris (?) of the fibre management frames and probably quite expensive too (I must admit I have no experience at all with these beasts...) So my questions: * Does the general setup make sene? What could be done in a better way? * Are there some useful resources in the web about cabling structuring? (for other interested: http://stele.adc.com/Library/Literature/842.pdf is quite good IMHO) I'd be happy to hear if somebody did make some positive or negative experience and what vendors are having useful and price worthy products (or products I should avoid for certain reasons ;) ). Even though we'll have few copper lines (for E1/ISDN), I'd be happy about copper-cabling resources/infos too... thanks && tschuess Stefan -- Stefan Mink Schlund + Partner AG Tel: +49 721 91374 0 Netzwerkabteilung Erbprinzenstr. 4-12 Fax: +49 721 91374 212 D-76133 Karlsruhe Mail: mink(a)schlund.net

1 0

RE: Configure SNMP for non udp 161 port
by Tony Rall 04 Apr '02

04 Apr '02

Please explain how. The only form of PAT that I'm familiar with translates source ports, not destination ports. It is the latter that would be required in this situation. Cisco Pix, at least, has a feature that could do this on traffic passing through it - "port redirection". Of course, this would require sending the messages through an additional box. See: http://www.cisco.com/warp/public/707/28.html Tony Rall Sent by: owner-nanog(a)merit.edu To: "'Holmes, Daniel'" <dholmes(a)aprisma.com> cc: "'nanog(a)merit.edu'" <nanog(a)merit.edu> Subject: RE: Configure SNMP for non udp 161 port you could use PAT -----Original Message----- From: Holmes, Daniel [mailto:dholmes@aprisma.com] Sent: Thursday, April 04, 2002 11:37 AM To: nanog(a)merit.edu Subject: Configure SNMP for non udp 161 port Does anyone know off hand how to configure a cisco router to respond to SNMP v1/v2 requests on a udp port other than 161 (default) Thanks - Dan

1 0

RE: Configure SNMP for non udp 161 port
by Casassa, Nathan 04 Apr '02

04 Apr '02

you could use PAT -----Original Message----- From: Holmes, Daniel [mailto:dholmes@aprisma.com] Sent: Thursday, April 04, 2002 11:37 AM To: nanog(a)merit.edu Subject: Configure SNMP for non udp 161 port Does anyone know off hand how to configure a cisco router to respond to SNMP v1/v2 requests on a udp port other than 161 (default) Thanks - Dan

1 0

RE: de-peering and peering
by Kris Foster 04 Apr '02

04 Apr '02

> Let us say Network A has a peering Agreement with Network B. > Now let us > say Network X wants to reach Network B. X and B do not have a peering > agreement. Can Network A use the peering Link between A nd B to route > the traffic of network X. If there is an agreement in place (ie. A and B exchanging customer prefixes and X is a customer of A). > What are the mechanisms in place in B's network to detect > that Network A > is transiting the data( in this case network B looser) from Network X? You should be able to filter. RADB is one solution that may make it more manageable. But if your not filtering it will still require a transit provider to get the traffic back to X (think asymmetry). Kris > masquerading transit data as if its originating from its own n > Steve Naslund wrote: > > > Peering arrangements are when networks make connections > between each other. > > Usually networks of > > equal size (traffic wise) will try to peer with each other. > Although this > > may not be technically correct here > > are the basics. > > > > Peering - connections between networks that our > cooperative, there is no > > cost other than the physical > > connection itself. That cost might be shared or the > smaller network may pay > > for the physical connection. > > Carries traffic that terminates on one of the two networks. > i.e. you can't > > go through the peering connection > > you have with my network to get to another network. > Consider peering > > connections to be express routes between > > two networks. You generally can get this type of > connection if you are a > > service provider or public institution. > > It is harder to get if you are a private entity unless you > can show a > > benefit for me in peering with you. In > > other words, I would like the traffic flow to be as > symmetric as possible or > > improve service for an important > > customer. > > > > Transit - connections between networks that I pay for an > allow me to get to > > anything on the Internet. These > > are generally very expensive but allow you to reach anyone, > anywhere. > > Consider transit connections to be the > > superhighway with exits to everywhere but with a lot of > traffic. Anyone who > > buys service from an upstream > > provider has a transit connection although they usually > refer to full BGP > > sessions. > > > > Now you can see that if I am paying for a transit > connection through say > > UUnet and I have a ton of traffic going > > to say Exodus, it is in my best interest to try to > establish a peering > > agreement with Exodus so that I don't have > > to use my expensive bandwidth from UUnet. I can also get a > more direct > > route to where my customers want to go and > > avoid congestion. > > > > Peering and de-peering have a huge impact on traffic > engineering because > > lack of peering means that most traffic > > is being carried by the biggest transit providers like > UUnet and Cable & > > Wireless. Peering makes the Internet > > more redundant and reliable and evens out the loads better. Traffic > > engineering is all about peering and which > > paths are preferred over others. I your only connections > are transit then > > there are not many options for > > traffic engineering. > > > > Steve > > > > > >>-----Original Message----- > >>From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of >>Shashi Kumar >>Sent: Tuesday, April 02, 2002 12:36 PM >>To: nanog(a)merit.edu >>Subject: de-peering and peering >> >> >>Dear List: >> >> Sorry for a naive question. Could some one on the list explain what is >>peering and de-peering ? and how peering and de-peering influence >>traffic engineering?. ( data traffic or otherwise..) >> >>thanks in advance, >>shashi >> >> >> > >

1 0

Exodus Contact
by Gyorfy, Shawn 04 Apr '02

04 Apr '02

Please can someone that deals with routing issues at Exodus.net contact me off the list, or if anyone knows of a good contact at Exodus.net please contact me off the list. Thanks in advance. Shawn.

1 0

Configure SNMP for non udp 161 port
by Holmes, Daniel 04 Apr '02

04 Apr '02

Does anyone know off hand how to configure a cisco router to respond to SNMP v1/v2 requests on a udp port other than 161 (default) Thanks - Dan

1 0

Qwest Transit
by Andy Dills 04 Apr '02

04 Apr '02

Ok, we have an opportunity to get Qwest bandwidth amazingly cheap. I can't disclose the details (NDA), but bottom line is it looks like the cheapest in the industry and because there is no loop involved, it could be one hell of a deal on a ds3. I'm not a fan of Qwest, traditionally. I've had some (somewhat famous) run-ins with their sales people, and I personally know plenty of companies who over several years have had tons of complaints with various aspects of their organization. However, I'm not interested in all of that at the moment. I need to evaulate, without all of my longheld bias, whether or not Qwest can provide quality DS3 transit. The traditional knock on Qwest is that they're an over-built under-peered network with poor support. But a lot of time has passed, so surely they would have addressed the peering issues by now? I can deal with poor support...the circuit is a simple cross connect, and our bgp filter changes are fairly uncommon. Can anybody speak positively or negatively about the quality of Qwest transit? We ordered a metered ds3 for a backup circuit, but with the pricing I'm seeing, I'm really tempted to localpref and prepend our announcements such that most of the traffic flows through Qwest. I plan on trying it out regardless, but I'd like to hear from the list first. Thanks, Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

5 4

RE: Qwest Transit
by Fred Heutte 04 Apr '02

04 Apr '02

Bear in mind that the financial situation at Qwest is bad. They are getting ready to take an estimated $20 to $30 billion writeoff on accounting restatements (mostly of "goodwill") and will probably be sanctioned by the SEC, as indicated in wire stories today. http://www.salon.com/tech/wire/2002/04/02/qwest/index.html Their Portland office is across the street from me, and my phone and DSL is dependent on them of course, so this is of direct concern in my case! I should mention that despite its deserved reputation for greedy management (whether as Pacific Northwest Bell, U S West or now Qwest), ops has generally been pretty good and the retail (consumer/ small business) DSL service, from my personal experience, is top notch. (Of course, they run it on FreeBSD so that should tell you something :) We certainly know from experience that a major financial upheaval can affect operations at least indirectly (loss of management attention, budget cuts, deferred maintenance, cutbacks in monitoring and response systems, etc.). On the other hand, it's not a good idea to overreact to news like this. So I would proceed with due caution concerning Qwest transit. As a wise person once said, don't put all your routes in one pipe. Fred

7 6

Re: How to get better security people
by blitz 04 Apr '02

04 Apr '02

>Problem is, some feces for brains boss is always going to come along and >tell you to do what you know is not in the best interest of security. And >when the problem rears its ugly head, YOU take the heat, not the idiot who >insisted you go against proper procedure. All I can advise, is document, document, document, then when it does come down, and they point the fickle finger of fate at you, you can always produce the documentation that 'da bozz' made ya do it... >Hmm. Incredibly biased opinion follows... > >A basic security mindset is a combination of paranoia, a talent for >contingency planning, and an understanding of business need. > >However, the paranoia must not be so extensive as to be crippling, >the contingency planning must not be so obsessive as to be paralysing, >and the understanding of business need should not interfere with the >periodic difficult and unpopular decisions that must be made to >protect the greater good.

8 10

RE: How to get better security people
by Zimmerman, David 03 Apr '02

03 Apr '02

In a former life as well as my current one, we had a primary Information Security officer, and myself acting as corporate firewall engineer. I found that my own role was best performed as a network security "conductor" of the "orchestra" of sysadmins who actually built and operated our Internet systems. You build a mailing list and forward interesting stuff from CERT/CIAC/Bugtraq/etc; you try to keep everyone informed, and guide them along the way with reasonably well-stated firewall guidelines ("I'll do this, I won't do that" with some give-and-take, and a little heartache over the purity of the architecture). And you get involved with the business as much as you can to spread the network security gospel. At some level it becomes less of a pure technical security issue, and more a social engineering challenge. Ultimately, it's all about risk management, and minimizing your risk by maximizing the knowledge flow and relationships that you build within the company. I recognized that generally I knew more about network security and IP/TCP/UDP than the people running the systems, and at some level you only get so much system security given the knowledge of the folks involved. So you back it up with as much of a secure network environment as you can negotiate v.s. the needs of the business, and make sure that the top Security dog is on the same page as you are. Ultimately you'll have an incident in spite of your best efforts -- no matter how totalitarian you are in your security policies -- and the most important thing is to educate everyone about the factors driving the security architecture. Maybe you make fundamental changes in response to the incident, or maybe you just try to educate everyone a little better, but hopefully in either case learn something along the way. dp -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Tuesday, April 02, 2002 10:18 PM To: Christopher E. Brown Cc: NANOG Subject: Re: How to get better security people On Tue, 2 Apr 2002, Christopher E. Brown wrote: > I think it comes down to being able to deal creatively with a > lack of total control, and find ways to limit what you cannot > eliminate. Security specialists can't be everywhere, can't do everything, and can't stop every bad thing. The reality is the people who have the biggest impact on security don't have security in their job title. Instead of a neighborhood watch do we need a network watch? While we need a few people with "deep" security knowledge, we also need to spread a thin layer of security pixie dust throughout the entire organization. Is it really a lack of control. While some security specilists carry a big stick, on most projects security is just one of many specialities required to work together. If you are a security specialist, just getting invited to a project before its finished is a major accomplishment.

1 0