May 2004 - Test - lists.nanog.org

Catalyst6509 GE interface hang without any indication
by Joe Shen 25 May '04

25 May '04

Hi, We are using a Catalyst6509 as distribution layer switch which is connected to M160 by GE interface( OSPF run on both side).. Yesterday we noticed that no traffic occur on that GE link at some special time. When trying to "ping" the other side on either platform, no responds got. But, on either M160 or Catalyst6509 "sh interface" showed no errors information. When checking syslog, there is no error record either. We also checked the configuration record for both system, and found there is no modification in configuration at the time when link load becomes zero. As last resort, we solved this problem by "shutdown" GE VLAN interface on Catalyst6509, and "no shut" consequently, then everything come up. But, today another Catalyst6509 of our system hanged on its uplink GE. We have to restarted the box to solve. Different from the catalyst6509 hanged yesterday, this catalyst6509 have netflow-export enabled for month. ( I included the detailed info at the end ) I tried hard to find out the reason but can't find any information related on Cisco's site. Is there anybody could do me a favor to do some help? Each word will be highly appreciated. regards Joe Shen ///////////////////////////////////////////////// info for the first Catalyst //////////////////////////////////// 6509C-SUP-hz> sh ver WARNING: This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. WS-C6509-NEB Software, Version NmpSW: 7.6(1) Copyright (c) 1995-2003 by Cisco Systems NMP S/W compiled on Apr 16 2003, 18:33:31 System Bootstrap Version: 7.1(1) System Boot Image File is 'bootflash:cat6000-sup2k9.7-6-1.bin' System Configuration register is 0x102 Hardware Version: 3.0 Model: WS-C6509-NEB Serial #: TBM07201366 PS1 Module: WS-CDC-1300W Serial #: SON07221E2W PS2 Module: WS-CDC-1300W Serial #: SON07221E25 Mod Port Model Serial # Versions --- ---- ------------------- ----------- -------------------------------------- 1 2 WS-X6K-SUP2-2GE SAL0725F92G Hw : 4.2 Fw : 7.1(1) Fw1: 6.1(3) Sw : 7.6(1) Sw1: 7.6(1) WS-X6K-SUP2-2GE SAL0725F92G Hw : 4.2 Sw : 2 2 WS-X6K-SUP2-2GE SAL0725F90A Hw : 4.2 Fw : 7.1(1) Fw1: 6.1(3) Sw : 7.6(1) Sw1: 7.6(1) WS-X6K-SUP2-2GE SAL0725F90A Hw : 4.2 Sw : 4 48 WS-X6148-RJ-45 SAL0723ELCS Hw : 1.3 Fw : 5.4(2) Sw : 7.6(1) 5 48 WS-X6148-RJ-45 SAL0723ELEG Hw : 1.3 Fw : 5.4(2) Sw : 7.6(1) 15 1 WS-F6K-MSFC2 SAL0723ENQ9 Hw : 2.5 Fw : 12.1(13)E7 Sw : 12.1(13)E7 16 1 WS-F6K-MSFC2 SAL0723ENPQ Hw : 2.5 Fw : 12.1(13)E7 Sw : 12.1(13)E7 DRAM FLASH NVRAM Module Total Used Free Total Used Free Total Used Free ------ ------- ------- ------- ------- ------- ------- ----- ----- ----- 2 131072K 67144K 63928K 32768K 9043K 23725K 512K 296K 216K Uptime is 260 days, 0 hour, 23 minutes 6509C-SUP-hz> 6509C-msfc-hz>sh hard Cisco Internetwork Operating System Software IOS (tm) MSFC2 Software (C6MSFC2-PO3SV-M), Version 12.1(13)E7, EARLY DEPLOYMENT RELEASE SOFTWARE (fc2) TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2003 by cisco Systems, Inc. Compiled Fri 20-Jun-03 09:24 by hqluong Image text-base: 0x40008C00, data- base: 0x419D8000 ROM: System Bootstrap, Version 12.1(11r)E1, RELEASE SOFTWARE (fc1) BOOTLDR: MSFC2 Software (C6MSFC2-BOOT-M), Version 12.1(8a)EX, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) idc6509C-msfc-hz uptime is 37 weeks, 1 day, 31 minutes System returned to ROM by power-on System restarted at 15:26:41 RPC Mon Sep 8 2003 Running default software cisco Cat6k-MSFC2 (R7000) processor with 114688K/16384K bytes of memory. Processor board ID SAL0723ENPQ R7000 CPU at 300Mhz, Implementation 39, Rev 3.3, 256KB L2, 1024KB L3 Cache Last reset from power-on X.25 software, Version 3.0.0. Bridging software. 16 Virtual Ethernet/IEEE 802.3 interface(s) 509K bytes of non-volatile configuration memory. 32768K bytes of Flash internal SIMM (Sector size 512K). Configuration register is 0x2102 6509C-msfc-hz> //////////////////////////////////////////////////////////////////////// ---- Msg sent via Spymac Mail - http://www.spymac.com

1 0

BGP - Newbie Documentation
by Jason Frisvold 24 May '04

24 May '04

All, Does anyone have some really good in-depth reading material on BGP for beginners? I've been handed the reigns of BGP administration for our network, but I would still consider myself very much a newbie to this... Some decent how-to's and accepted standards would be great... Thanks! -- Jason H. Frisvold PenTeleData

4 4

RE: BGP - Newbie Documentation
by Burton, Chris 24 May '04

24 May '04

Also Internet Routing Architectures (2nd Edition) has always been a favorite of mine. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gabriel Sent: Monday, May 24, 2004 12:03 PM To: nanog(a)merit.edu Subject: Re: BGP - Newbie Documentation I highly recommend Iljitsch's book: BGP Written by Iljitsch van Beijnum Published by O'Reilly and Associates ISBN 0-596-00254-8 It has helped me a lot. Gabriel Jason Frisvold wrote: > All, > > Does anyone have some really good in-depth reading material on BGP > for beginners? I've been handed the reigns of BGP administration for > our network, but I would still consider myself very much a newbie to > this... Some decent how-to's and accepted standards would be great... > > Thanks! > -- Gabriel Cain www.dialupusa.net Senior Systems Administrator gabriel(a)dialupusa.net PGP fingerprint: C0B4 C6BF 13F5 69D1 3E6B CD7C D4C8 2EA4 2B08 1C6D Technology for the sake of business.

1 0

RE: BGP - Newbie Documentation
by Burton, Chris 24 May '04

24 May '04

http://www.cisco.com/cgi-bin/Support/browse/psp_view.pl?p=Technologies:B GP http://www.nanog.org/isp.html#routing Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jason Frisvold Sent: Monday, May 24, 2004 11:54 AM To: nanog(a)merit.edu Subject: BGP - Newbie Documentation All, Does anyone have some really good in-depth reading material on BGP for beginners? I've been handed the reigns of BGP administration for our network, but I would still consider myself very much a newbie to this... Some decent how-to's and accepted standards would be great... Thanks! -- Jason H. Frisvold PenTeleData

1 0

RE: BGP - Newbie Documentation
by Dan Ellis 24 May '04

24 May '04

Jason, Check these sites: http://www.cisco.com/en/US/tech/tk365/tk80/technologies_tech_note09186a0 0800c95bb.shtml The BGP section of the past Nanog talks: http://www.nanog.org/subjects.html And from our weekly celebrity's site, http://www.freedman.net/ - BGP 101 and BGP102 under the tutorial section. A Cisco Press book by Sam Halabi: "internet routing architectures", ISBN: 1-56205-652-2. -- Daniel Ellis, CTO, PenTeleData (610)826-9293 > -----Original Message----- > From: Jason Frisvold > Sent: Monday, May 24, 2004 2:54 PM > To: nanog(a)merit.edu > Subject: BGP - Newbie Documentation > > All, > > Does anyone have some really good in-depth reading material on BGP > for > beginners? I've been handed the reigns of BGP administration for our > network, but I would still consider myself very much a newbie to > this... Some decent how-to's and accepted standards would be great... > > Thanks! > > -- > Jason H. Frisvold > PenTeleData

1 0

Re: [cee4@packet-pushers.com: Slides for NANOG31 IPsec tutorial]
by Paul Wouters 24 May '04

24 May '04

> Subject: Slides for NANOG31 IPsec tutorial > > If you plan to attend Sunday's hands-on tutorial for using the IPsec > server at NANOG, you may want to have a look at the slides in > advance. You can find them at: http://www.packet-pushers.net/NANOG/ipsec/ Unfortunately, I won't be there. But I looked at your slides, since we are doing a lot of things with IPsec and wireless as well. > The slides contain URLs for sample configuration files and startup > scripts. Those files are also available at the above URL. I wonder why you made your configuration so complex. Why tunnel an extra IP address to the laptops? Why use L2TP when you can fix this with simple X.509 certificates. Why use PSKs when you can trivially use a Certificate Agency and roll out certificates over a webserver on the 'hotspot'? You might want to have a look at the WaveSEC deployment we did at BlackHat in Amsterdam last week. It worked fine for linux, windwos and macosx (racoon) based systems. It provides an easy to use windows interface for adding a X.509 certificate (PKCS12) file into the registry for WinXP/2K. It seems a lot less complex then your setup where everyone has to manually tunnel a single ip address onto their laptop. My slides, as well as the server prototype code (which in its turn provides the client code for windows when needed), are available at: http://www.blackhat.com/html/bh-media-archives/bh-archives-2004.html#EU-2004 Near the end, you will also see a few problems that Windows users can fall into. This does not list the latest problem that has been found yet, that any packet from source port 98 is considered 'secure' by windows, and is allowed to hit the machine regardhless of IPsec policies (but as you said, IPsec is not a firewall) Paul

2 1

FW: Corporate Fax Solution
by Kaveh Sheikholeslami 24 May '04

24 May '04

Hello, Can anyone provide suggestions/recommendations regarding a practical, cost effective corporate fax solution for small/medium size companies? The environments include Microsoft Exchange servers and Windows 98/2000/XP clients. Any input is greatly appreciated. Thanks Best regards, Senior Network Administrator MIS, Inc. "This message (including any attachments) constitutes a confidential communication and/or contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please notify the sender by return email and delete this message and any attachments. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited."

1 0

Re: Lots of big web sites broken...SPOF
by Simar 24 May '04

24 May '04

Here is the latest we got: An isolated issue occurred Monday May 24, 2004 (roughly during the period of 8:00 a.m. - 9:30 a.m. ET), where multiple Akamai customers experienced intermittent performance and availability degradation. This degradation was the result of a bug within one of Akamais backend content control management tools, which allows the expiration of content on the Akamai network. The degradation was not a result of any outside interference with Akamais network (such as Denial of Service or hacking). Upon identification of the bug, Akamai quickly took corrective action which returned customers to normal service levels. Akamai is currently putting measures in place to return the content management tool to its normal working order and is adding safeguards such that the issue will not occur in the future. In the meantime, Akamai customers are able to serve their content through the Akamai Network normally. -- Simar cisco(a)snickers.org

1 0

Lots of big web sites broken...SPOF
by cisco 24 May '04

24 May '04

looks like they are recovering now, akamai noc said its resolved. -- Simar cisco(a)snickers.org

3 2

Lots of big web sites broken...SPOF
by Jon Lewis 24 May '04

24 May '04

Ok...who turned off Akamai? :) Sites that use Akamai for serving their images all seem to be pretty much broken this morning. From here, I'm seeing multiple Akamai servers on multiple networks just not responding to HTTP. They accept connections (some after much delay), but don't reply to requests. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 3