September 2003 - Test - lists.nanog.org

[resend] OT: operators script writers' experience wanted
by Eliot Lear 10 Sep '03

10 Sep '03

[For some reason, the first message ended up in the bit bucket] Dear all, Over the last few years, a bunch of us from the vendor community have sought your opinion about doing programmatic configuration to routers, switches, and the like. Over the last few months, the NETCONF working group was formed in the IETF. This working group started with a draft that uses BEEP as a transport. We heard from you that you want an SSH and for that matter a serial interface to the protocol. Our goal is to meet operator needs while at the same time providing sufficient formalism that scripts won't break so easily. In the latest iteration of the draft we've split the NETCONF protocol from the transport mapping and defined several transport protocol mappings, including SSH. I'd like to raise with you some concerns the working group has had with SSH, and gather your opinions about how to proceed. As implementors we're very concerned about prompts and asynchronous messages. To address this, we plan to implement the transport mapping through the subsystem facility, so that you don't get MOTDs, and you don't get prompts or other stuff that make scripts go crazy. It's all that other stuff that you script writers end up having to special case in expect(1). Several of the working group members have extensive SSH experience, however. They have expressed concerns regarding the applications used, and in particular OpenSSH. Specifically, the concern is about whether people would end up having to use expect(1) with an SSH application due to messages the local program generates. We are in particular not talking about messages generated by the remote end (e.g, the router) but the SSH program itself. Question number 1: does this behavior present current script writers problems? How have you gotten around this? Is it not an issue? The other issue we have is that we wonder whether what is really wanted is a way to prototype on the TTY, while still being able to use a more formal interface once things are debugged. If the idea is to be able to cut and paste "netconf" stuff into the TTY, this doesn't mandate a formal protocol definition. Vendors can just "do it". On the other hand, question # 2 if that leaves the one protocol as NETCONF over BEEP with an informal way to get to NETCONF over SSH, does that present operators problems? For instance, are you relying on SSH public/private user keys as your authentication mechanism? BEEP uses TLS and at least server-side certificates (TLS is nearly identical to SSL). For TTY access, is it sufficient that the protocol be usable on the TTY for cut and paste purposes? This would be the equivalent of /usr/sbin/sendmail -bs or typing "xml" at the command prompt. If you could respond to me, I'll be happy to summarize. Thanks for your comments, Eliot

1 0

Fibertech Networks Contact
by Robert Blayzor 10 Sep '03

10 Sep '03

Is anyone from Fibertech Networks lurking? Could you contact me off list please. Thanks. -- Robert Blayzor, BOFH INOC, LLC rblayzor(a)inoc.net PGP: http://www.inoc.net/~dev/ Key fingerprint = A445 7D1E 3D4F A4EF 6875 21BB 1BAA 10FE 5748 CFE9 Never underestimate the bandwidth of a station wagon full of tapes. - Jackson

1 0

Dynamic Internet Maps based on BGP table / AS_PATH
by H. Michael Smith, Jr. 10 Sep '03

10 Sep '03

Hello All, A few months ago someone posted a URL to a tool that maps the Internet from the perspective of any (inputted) AS Number. Could someone send this URL (on- or off-list)? I've searched the archives, but I cannot find it. Thanks, Michael

4 4

(Slightly OT) Bandwidth in Belize
by Marius Strom 10 Sep '03

10 Sep '03

Can anyone here point me to T1 bandwidth providers in Belize, specifically Belize City, San Pedro, and Caye Caulker? (Preferably not via BTL, and not satellite links) -- /-------------------------------------------------> Marius Strom | Always carry a short length of fibre-optic cable. Professional Geek | If you get lost, then you can drop it on the System/Network Admin | ground, wait 10 minutes, and ask the backhoe http://www.marius.org/ | operator how to get back to civilization. \-------------| Alan Frame |---------------------->

3 4

MPLS over Multilink PPP or Multilink Frame Relay
by Wayne Bogan 10 Sep '03

10 Sep '03

Hello All, Does anyone have any experience with MPLS tunnels and vpns while using Multilink PPP or FR bundles? We're looking to see if this is a viable option for one of our deployments and if there are operational issues related to this configuration. Regards, Wayne

1 0

Large DMZ Security Designs ?
by tad pedley 09 Sep '03

09 Sep '03

I'm looking for references to "best practices" for large DMZ designs incorporating both functionality and security. Is segmentation based on port traffic the best approach or something else. All responses appreciated. Thanks, T --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software

1 0

Cable & Wireless, Verio and/or Level 3 port blocking?
by William Devine, II 09 Sep '03

09 Sep '03

Can anyone from these three carriers tell me if you're doing port blocking on the Windows file/print ports (135-139, 445 & 593) ? A client of ours (in the US), against our recommendation, still wants to connect to their Exchange server in the UK without a VPN. We're not blocking their IP#'s from anything but somewhere in between it's getting blocked. We use C&W directly and Verio/Level3 through a peer. Thanks! william

8 9

RE: Dynamic Internet Maps based on BGP table / AS_PATH
by Mike Damm 09 Sep '03

09 Sep '03

This is the only one that comes to mind, http://www.fixedorbit.com/search.htm -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: H. Michael Smith, Jr. [mailto:michael@awtechnologies.com] Sent: Tuesday, September 09, 2003 2:02 PM To: nanog(a)merit.edu Subject: Dynamic Internet Maps based on BGP table / AS_PATH Hello All, A few months ago someone posted a URL to a tool that maps the Internet from the perspective of any (inputted) AS Number. Could someone send this URL (on- or off-list)? I've searched the archives, but I cannot find it. Thanks, Michael

1 0

paging AS226 : 63/8 does not belong to you
by Kai Schlichting 09 Sep '03

09 Sep '03

(whois.arin.net once again resolves, thanks Rodney Joffe who seems to have gotten this fixed before I could reply to him) Now today: route-views.oregon-ix.net>sh ip bgp 63.0.0.0/8 BGP routing table entry for 63.0.0.0/8, version 1548358 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 7500 2516 226 202.249.2.86 from 202.249.2.86 (210.173.176.242) Origin incomplete, localpref 100, valid, external, best Now: what is ln.net's excuse for not updating the ARIN registration for AS 226 since 1991? An AS with this amount of IP space advertised: (http://bgp.potaroo.net/cgi-bin/as-report?as=226&view=4637) Rank AS Type Originate Addr Space (pfx) Transit Addr space (pfx) Description 224 AS226 ORG+TRN Originate: 739584 /12.50 Transit: 922880 /12.18 LOS-NETTOS-AS Los Nettos ...can't keep it's own ASN record up to date? bye,Kai

2 1

Re: Microsoft distributes free CDs in Japan to patch Windows
by Michael.Dillon＠radianz.com 09 Sep '03

09 Sep '03

> And getting the lead time down to 4-6 weeks would be a challenge - remember you > have to *ship* the re-mastered patch CD to every retailer and get it on the > shelves. That's going to hit your bottom line. Ever heard of Windows 98? How about Windows 98 SE (Second Edition)? They've done it before, they can do it again. --Michael Dillon

7 12