November 2009 - Test - lists.nanog.org

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 13 Nov '09

13 Nov '09

Actually thinking about this, I still need to understand the implications of not taking a full routing table to my setup. So what is the likely impact going to be if I take partial instead of full routing table. Would appreciate any feedback on this. My organisation is only looking at using BGP as a means of failover between two separate upstream ISPs. We are not an ISP. Thanks Adel On Mon 1:32 PM , adel(a)baklawasecrets.com wrote: > Thanks, > > I've taken your advice and decided to reconsider my requirement for a > full routing table. I believe I'm being greedy and a partial table will be > sufficient. With regards to Linux/BSD, its not the CLI of quagga that will > be an issue, rather the sysadmin and lack of supporting infrastructure for > Linux boxes within the organisation. So things like package management, > syslog servers, monitoring, understanding of security issues etc. I don't > want to leave them with a linux/bsd solution that they won't be able to > maintain/manage effectively when I am gone. > > Thanks for your comments. Look forward to hearing which solutions come > back into the mix having dropped the full routing table requirement. > > Regards, > > Adel > > On Mon 11:45 AM , Joe Greco wrote: > > > > > > Basically the organisation that I'm working for will not have the > > skills > > > > > in house to support a linux or bsd box. They will have trouble > > > > > with supporting the BGP configuration, however I don't think they > > will be > > > > > happy with me if I leave them with a linux box when they > > > > > don't have linux/unix resource internally. At least with a Cisco > or > > > > > Juniper they are familiar with IOS and it won't be too foreign to > > them. > > > > > > On Sun 11:47 PM , Dale Rumph wrote: > > > > > > > > What does your budget look like? A pair of Cisco 7246vxr's with > G1's > > > > sitting on the edge of the network would be very effective and > still > > allow > > > > expansion. Or you could go up to the 7609. However this gear may be > > > > slightly overkill. You might be ok with a 3660 enterprise and a ton > > of > > > > ram. I have done single sessions on them but not with the level of > HA > > your > > > > looking for. > > > > > > > > Just my 2c > > > > > You will laugh, but the budget at the moment looks like Â£13k. > > > Impossible? Do only linux and openbsd solutions remain in the mix > > > for this pittance? > > > > No, you have the buy-it-off-eBay solutions as well. "Beware the > > fakes." > > > > If they're familiar with IOS, then they can be familiar with Quagga > > about as easily as they could be familiar with a switch or other > > network gizmo that had a Ciscoesque CLI but wasn't actually Cisco. > > > > You've painted yourself into a corner. I have a word for you: > > > > Reconsider. > > > > I don't care what you reconsider, but reconsider something. You can > > reconsider taking BGP with a full table. You can reconsider Quagga. > > Or you can reconsider your budget. This is the end result of the > > "pick any two" problem. > > > > Most end user organizations have no need of full routes in BGP. To > > try to take them dooms TCAM-based equipment at some future point, > > though if you have a lot of money to throw at it, you can make that > > point be years in the future. It is essentially planned obsolescence. > > If you discard the requirement for full routes, you open up a bunch > > of reasonably-priced possibilities. > > > > Finding someone knowledgeable in BSD or Linux isn't that rough. > > Unlike a Cisco 76xx router, the hardest part of a Quagga-based > > solution is finding the right mix of hardware and software at the > > beginning. PC hardware has a lot going for AND against it. There is > > no reason you can't make a good router out of a PC. If you buy the > > Cisco software-based routers, you're essentially buying a prepackaged > > version, except that it'll be specced to avoid any real competition > > with their low-end TCAM-based offerings. A contemporary PC can > > easily route gigabits. Vyatta makes what I hear is a fantastic > > canned solution of some sort, for a reasonable cost, and they will > > sell just software or software/hardware. If you really can't put > > it together yourself, there's someone to do it for you. > > > > Reconsidering your budget is probably the most painful thing to do, > > but also opens up the "just buy big Cisco" option. I think my point > > here would have to be that what you're looking for would have needed > > big Cisco... ten years ago. Now, dealing with a few hundred megs of > > traffic, that's not that big a deal, the thing that's killing you is > > the BGP table size. > > > > Your best option may be to see if you can settle for partial routes > > plus a default. > > > > ... JG > > -- > > Joe Greco - sol.net Network Services - Milwaukee, WI - > http://www.sol.net [1] > > [1] > > "We call it the 'one bite at the apple' rule. Give me one chance [and] > > then I > > won't contact you again." - Direct Marketing Ass'n position on e-mail > > spam(CNN) > > With 24 million small businesses in the US alone, that's way too many > > apples. > > > > > > > > Links: > > ------ > > [1] http://webmail.123-reg.co.uk/parse.php?redirect=http://www.sol.net > [2] > > > > > > > > Links: > ------ > [1] http://webmail.123-reg.co.uk/parse.php?redirect=http://www.sol.net > [2] > http://webmail.123-reg.co.uk/parse.php?redirect=http://webmail.123-reg.co.u > k/parse.php%3Fredirect%3Dhttp://www.sol.net >

5 5

Resilience - How many BGP providers
by adel＠baklawasecrets.com 12 Nov '09

12 Nov '09

Hi, After recent discussions on the list, I've been thinking about the affects of multiple BGP feeds to the overall resilience of Internet connectivity for my organisation. So originally when I looked at the design proposals, there was a provision in there for four connections with the same Internet provider. Thinking about it and with the valuable input of members on this list, it was obvious that multiple connections from the same provider defeated the aim of providing resilience. So having come to the decision to use two providers and BGP peer with both, I'm wondering how much more resilience I would get by peering with more than two providers. So will it significantly increase my resilience by peering with three providers for example, as both of the upstreams I choose will be multihomed to other providers. Especially as I am only looking at peering out of the UK. Hope the above makes sense. Adel

5 4

qos 3560
by Bogdan 12 Nov '09

12 Nov '09

hello i am playing with qos on some devices - cisco 3560 - cisco 7609 and i have some things that i don't seem to understand. 1. in 3560, i enable mls qos, on the ingress port applyed policy map, classify the packets with acl, mark, all good. on the egress ports i use srr-queue with shape/share, everything is fine, it is working. http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/… 2. reset to defaults the 3560 in 7606 i pick up a vlan, and apply a policy-map and set dscp 40 on egress of that vlan 3560 in uplinked in 7609 in 3560 i can see the "marked" packets, and i have matches on the dscp set earlier (sh mls qos int xx stat). the problem is: when i apply the srr-queue in 3560 on egress (towards the test port), it does not work. if i enable mls qos on 3560, i cannot match anymore the dscp 40 from the 7609 is it normal? do i have to apply the qos stuff (point1) on all switches i want qos on? i mean, i cannot set dscp in one "core" device and use that in the whole network ? thanks

4 5

Minimum IPv6 size
by Seth Mattinen 12 Nov '09

12 Nov '09

Since we're on the topic of what's commonly accepted in IPv4 land (a /24), what's the story in IPv6 land? It seems to me that a /32 is a fur sure thing, but others will accept down to a /48, too. ~Seth

8 11

Spyware and Antivirus detection increase
by Elijah Savage 12 Nov '09

12 Nov '09

All, This may not be the right audience but I do not know of a better set of experts to ask this question. We monitor antivirus and spyware activity very close on our desktop and laptop environment. Often you can correlate this activity with an increase in bandwidth. The bandwidth is not an issue but this month we see a very big spike in antivirus and spyware detection compared to last month, 12,000 detections last month compared to 38,000 so far this month. We have all the data and know what signatures are being tripped and a good idea of where they are coming from. The question I have is this, is anyone else seeing an increase and have any idea why? Is it just the time of the year with it being the holiday season?

1 0

Performance to and from Japan (who to connect to?)
by Operations 12 Nov '09

12 Nov '09

Greetings, Im sure someone here is GREAT with connecting to Japan so I ask the following: We have a POP in 600 West 7th street, Los Angeles. What provider can I cross-connect to there to get better performance to Japan? Are there Japanese providers on net in that building? Anyone want to peer with me there that can give me better routing to Japan? Thank you very much Nanog. NJ Critical Data Network http://www.critical.net

2 1

Re: Gig Throughput on IPSEC
by adel＠baklawasecrets.com 12 Nov '09

12 Nov '09

On second thoughts, thinking about this I am probably looking for some kind of Layer2 encryption devices. This will make things a lot easier for the deployment. Any experiences, thoughts on these types of devices, would be much appreciated. Adel On Wed 9:25 AM , adel(a)baklawasecrets.com sent: Hi, I have a requirement to encrypt data using IPSEC over a p-t-p gig fibre link. In the past I've normally used Juniper to terminate VPNs, as I have found them excellent devices and the route based VPN functionality very useful. However looking at their range, only the ISG will do a gig of IPSEC. I'm leaning towards keeping my exising Juniper SSG550's for firewall/routing capability at each site. Then having a separate encryption devices to handle the site-to-site vpn requiring the gig throughput. Does anyone have any suggestions on devices to use? Adel

3 2

RE: Resilience - How many BGP providers
by adel＠baklawasecrets.com 12 Nov '09

12 Nov '09

I suppose I could take the whole resilience thing further and further and further. One of the replies used a phrase which I thing captured the problem quite nicely: "diminishing returns". Basically I could spend lots and lots of money to try and eliminate all single points of failure. Clearly I don't have the money to do this and what I'm really trying to establish is at what point do the returns start to diminish with regards to obtaining multiple transit providers. The answer appears to be "it depends". So if getting a third BGP peering with divergent paths, separate last mile, separate facility and separate router will increase costs by 5x but only increase resilience by 0.001% is it really worth it? I'm trying to quantify the resilience of my Internet connectivity and quantify the effects of adding more providers. Now to run through my case: - I have one facility to locate BGP routers at. Thats not changing for the moment. - I can afford two BGP routers. - The facility I'm located at tell me they have divergent fibre paths and multiple entries into the facility. (Still need to verify this by getting them to walk the routes with me) - I am going to take transit from two upstreams. - I could ask the question as to whether I can peer with separate routers on each of the upstreams. i.e. to protect against router failures on their side. - I will make sure that neither upstream peers with the other directly. (Does this give me some AS path redundancy?) So from the above: - I have no resilience with regards to datacentre location. i.e. if a plane fell out of the sky etc., I'm done. - I can afford some BGP router resilience on my side. So I should be able to continue working if a router failure which only affects one of my routers occurs. - I have some resilience in terms of actual fibre paths to the facilites where I will be picking up the BGP feeds from. (to be verified) - I have some "AS resilience" if this is the right term. So if the AS of one of my upstreams drops off the face of the Internet, I can still get to the Internet through the AS of my other provider - Peering with separate routers may give me some resilience for router failure on the side of my upstreams? (not totally sure on this) In this situation, if I add another peering with another upstream, am I really getting much return in terms of resilience? Or should I spend this money examining the many other SPOFs in my architecture? I'm perfectly sure there is absolutely no point me peering with 6 providers, but maybe some gains in peering with 3? I'm trying to figure out at what point is adding another peering in my case a waste of money. I haven't gone into switch and power redundancy, because I "think" I understand it. I wanted to concentrate on the multiple upstreams question. Heads starting to whirl right about now. Adel On Wed 5:27 PM , "Dylan Ebner" dylan.ebner(a)crlmed.com sent: > > You question has many caveats. Just having two providers does not > necessarily get you more resiliency. If you have two providers and they are > terminating on the same router, then you still have a SPOF problem. You > also need to look at pysical paths as well. If you have two (or three) > providers and they are using a common carrier, then you have a problem as > well. For example, GLBX has a small prescence in the Minneapolis metro. If > I were to use them as a provider, they would use Qwest as a last mile. If > my other provider is Qwest (which it is), I may not have path > divergence.Facilities are important too. We have three upstreams; Qwest, MCI and ATT. > The facility only has two entrances, so that means two of these are in the > same conduit. IF you only have one entrance, all you connections are going > to run through that conduit, and that makes you susceptable to a rouge > backhoe. > You are on the right track to question your resilancy. Some upstreams can > offer good resilancy with multiple feeds. Others cannot. I would start with > your provider and see what you are getting. Maybe you already have path > divergence, sperate last miles, and multiple paths in the isp core. If you > go with multiple providers, you want to make sure you don't risk losing > something you already have. > > > > -----Original Message----- > From: adel(a)baklawasecrets.com [adel@ > baklawasecrets.com] Sent: Wednesday, November 11, 2009 11:14 AM > To: nanog(a)nanog.o > rgSubject: Resilience - How many BGP providers > > > > Hi, > > After recent discussions on the list, I've been thinking about the > affectsof multiple BGP feeds to the overall resilience of Internet > connectivityfor my organisation. So originally when I looked at the design > proposals, there was a provision in there for four connections with the > same Internet provider. Thinking about it and with the valuable input > ofmembers on this list, it was obvious that multiple connections from the > same provider defeated the aim of providing resilience. > > So having come to the decision to use two providers and BGP peer with > both, I'm wondering how much more resilience I would get by peering > with more than two providers. So will it significantly > increase myresilience by peering with three providers for example, as both of the > upstreams I choose will be multihomed to other providers. Especially > asI am only looking at peering out of the UK. > > Hope the above makes sense. > > Adel > > > > >

3 2

Gig Throughput on IPSEC
by adel＠baklawasecrets.com 12 Nov '09

12 Nov '09

Hi, I have a requirement to encrypt data using IPSEC over a p-t-p gig fibre link. In the past I've normally used Juniper to terminate VPNs, as I have found them excellent devices and the route based VPN functionality very useful. However looking at their range, only the ISG will do a gig of IPSEC. I'm leaning towards keeping my exising Juniper SSG550's for firewall/routing capability at each site. Then having a separate encryption devices to handle the site-to-site vpn requiring the gig throughput. Does anyone have any suggestions on devices to use? Adel

4 3

[NANOG-announce] NANOG 48 Call for Presentations now available
by David Meyer 11 Nov '09

11 Nov '09

Folks, The NANOG 48 Call for Presentations is now available at http://www.nanog.org/meetings/nanog48/index.php. Please take a look at the important dates, and submit your proposals at http://pc.nanog.org. Look forward to seeing you all in Austin. Thanks, Dave (for the NANOG PC) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0