November 2009 - Test - lists.nanog.org

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Thanks Seth and James, Things are getting a lot clearer. The BGP multihoming solution sounds like exactly what I want. I have more questions :-) Now I suppose I would get my allocation from RIPE as I am UK based? Do I also need to apply for an AS number? As the IP block is "mine", it is ISP independent. i.e. I can take it with me when I decide to use two completely different ISPs? Is the obtaining of this IP block, what is referred to as PI space? Of course internally I split the /24 up however I want - /28 for untrust range and maybe a routed DMZ block etc.? Assuming I apply for IP block and AS number, whats involved and how long does it take to get these babies? I know the SSG550's have BGP capabilites. As I have two of these in HA mode, does it make sense to do the BGP on these, or should I get dedicated BGP routers? Fixing the internal routing policy so traffic is directed at the active BGP connection. Whats involved here, preferring one BGP link over the other? Thanks again, I obviously need to do some reading of my own, but all the suggestions so far have been very valuable and definitely seem to be pointing in some fruitful directions. Adel On Sun 6:31 PM , "James Hess" mysidia(a)gmail.com sent: > On Sun, Nov 8, 2009 at 11:34 AM, <adel@ > baklawasecrets.com> wrote:[..] > > connections from different providers I would > still have issues. So> I guess that if my primary Internet goes down I > lose connectivity> to all the publicly addressed devices on that > connection. Like> dmz hosts and so on. I would be interested > to hear how this> can be avoided if at all or do I have to use the > same provider. > You assign multi-homed IP address space to your publicly addressed > devices,which are not specific to either ISP. You announce to both ISPs, and > you accept some routes from both ISPs. > > You get multi-homed IPs, either by having an existing ARIN allocation, > or getting a /22 from ARIN (special allocation available for > multi-homing), or ask for a /24 from ISP A or ISP B for > multihoming. > > > If Link A fails, the BGP session eventually times out and dies: ISP > A's BGP routers withdraw the routes, the IP addresses are then > associated only with provider B. > > And you design your internal routing policy to direct traffic > within your network to the router with an active BGP session. > > Link A's failure is _not_ a total non-event, but a 3-5 minute partial > disruption, while the BGP session times out and updates occur in other > people's routers, is minimal compared to a 3 day outage, if serious > repairs to upstream fiber are required. > > > -- > -J > > >

4 3

Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability
by Cisco Systems Product Security Incident Response Team 09 Nov '09

09 Nov '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability Advisory ID: cisco-sa-20091109-tls http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml Revision 1.0 For Public Release 2009 November 9 1600 UTC (GMT) Summary ======= An industry-wide vulnerability exists in the Transport Layer Security (TLS) protocol that could impact any Cisco product that uses any version of TLS and SSL. The vulnerability exists in how the protocol handles session renegotiation and exposes users to a potential man-in-the-middle attack. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml. Affected Products ================= Cisco is currently evaluating products for possible exposure to these TLS issues. Products will only be listed in the Vulnerable Products or Products Confirmed Not Vulnerable sections of this advisory when a final determination about product exposure is made. Products that are not listed in either of these two sections are still being evaluated. Vulnerable Products - ------------------- This section will be updated when more information is available. Products Confirmed Not Vulnerable - --------------------------------- The following products are confirmed not vulnerable: * Cisco AnyConnect VPN Client This section will be updated when more information is available. Details ======= TLS and its predecessor, SSL, are cryptographic protocols that provide security for communications over IP data networks such as the Internet. An industry-wide vulnerability exists in the TLS protocol that could impact any Cisco product that uses any version of TLS and SSL. The vulnerability exists in how the protocol handles session renegotiation and exposes users to a potential man-in-the-middle attack. The following Cisco Bug IDs are being used to track potential exposure to the SSL and TLS issues. The bugs listed below do not confirm that a product is vulnerable, but rather that the product is under investigation by the appropriate product teams. Registered Cisco customers can view these bugs via Cisco's Bug Toolkit: http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl +------------------------------------------------------------+ | Product | Bug ID | |----------------------------+-------------------------------| | Cisco Adaptive Security | CSCtd01491 | | Device Manager (ASDM) | | |----------------------------+-------------------------------| | Cisco AON Software | CSCtd01646 | | | | |----------------------------+-------------------------------| | Cisco AON Healthcare for | CSCtd01652 | | HIPAA and ePrescription | | |----------------------------+-------------------------------| | Cisco Application and | CSCtd01529 | | Content Networking System | | | (ACNS) Software | | |----------------------------+-------------------------------| | Cisco Application | CSCtd01480 | | Networking Manager | | |----------------------------+-------------------------------| | Cisco ASA 5500 Series | CSCtd00697 | | Adaptive Security | | | Appliances | | |----------------------------+-------------------------------| | Cisco ASA Advanced | | | Inspection and Prevention | CSCtd01539 | | (AIP) Security Services | | | Module | | |----------------------------+-------------------------------| | Cisco AVS 3100 Series | CSCtd01566 | | Application Velocity | | | System | | |----------------------------+-------------------------------| | Cisco Catalyst 6500 Series | CSCtd06389 | | SSL Services Module | | |----------------------------+-------------------------------| | Firewall Services Module | CSCtd04061 | | FWSM | | |----------------------------+-------------------------------| | Cisco CSS 11000 Series | CSCtd01636 | | Content Services Switches | | |----------------------------+-------------------------------| | Cisco Unified SIP Phones | CSCtd01446 | | | | |----------------------------+-------------------------------| | Cisco Data Center Network | CSCtd02635 | | Manager | | |----------------------------+-------------------------------| | Cisco Data Mobility | CSCtd02642 | | Manager | | |----------------------------+-------------------------------| | Cisco Digital Media | CSCtd01703 | | Encoders | | |----------------------------+-------------------------------| | Cisco Digital Media | CSCtd01692 | | Manager | | |----------------------------+-------------------------------| | Cisco Digital Media | CSCtd01718 | | Players | | |----------------------------+-------------------------------| | Cisco Emergency Responder | CSCtd02650 | | | | |----------------------------+-------------------------------| | Cisco IOS Software | CSCtd00658 | | | | |----------------------------+-------------------------------| | Cisco IOS XE Software | CSCtd00658 | | | | |----------------------------+-------------------------------| | Cisco IOS XR Software | CSCtd02658 | | | | |----------------------------+-------------------------------| | Cisco IP Communicator | CSCtd02662 | | | | |----------------------------+-------------------------------| | CATOS | CSCtd00662 | | | | |----------------------------+-------------------------------| | Cisco IronPort Appliances | CSCtd02069 | | | | |----------------------------+-------------------------------| | Cisco Unified MeetingPlace | CSCtd02709 | | | | |----------------------------+-------------------------------| | Cisco NAC Appliance (Clean | CSCtd01453 | | Access) | | |----------------------------+-------------------------------| | Cisco NAC Guest Server | CSCtd01462 | | | | |----------------------------+-------------------------------| | Cisco NAC Profiler | CSCtd02716 | | | | |----------------------------+-------------------------------| | Cisco Network Analysis | CSCtd02729 | | Module Software (NAM) | | |----------------------------+-------------------------------| | Cisco Network Registrar | CSCtd02748 | | | | |----------------------------+-------------------------------| | Cisco ONS 15500 Series | CSCtd02769 | | | | |----------------------------+-------------------------------| | Cisco Physical Access | CSCtd02777 | | Gateways | | |----------------------------+-------------------------------| | Cisco Physical Access | CSCtd03912 | | Manager | | |----------------------------+-------------------------------| | Cisco Physical Security | CSCtd03920 | | ISM | | |----------------------------+-------------------------------| | Cisco QoS Device Manager | CSCtd03923 | | | | |----------------------------+-------------------------------| | Cisco Secure Access | CSCtd00725 | | Control Server (ACS) | | |----------------------------+-------------------------------| | Cisco Secure Desktop | CSCtd03928 | | | | |----------------------------+-------------------------------| | Cisco Secure Services | CSCtd03935 | | Client | | |----------------------------+-------------------------------| | Cisco Security Agent CSA | CSCtd02689 | | | | |----------------------------+-------------------------------| | Cisco Security Monitoring, | CSCtd02654 | | Analysis and Response | | | System (MARS) | | |----------------------------+-------------------------------| | Cisco Unified IP Phones | CSCtd04121 | | | | |----------------------------+-------------------------------| | Cisco Service Control | CSCtd04171 | | Subscriber Manager | | |----------------------------+-------------------------------| | Cisco TelePresence Manager | CSCtd01771 | | | | |----------------------------+-------------------------------| | Telepresence for Consumer | CSCtd01752 | | | | |----------------------------+-------------------------------| | Cisco TelePresence | CSCtd01742 | | Recording Server | | |----------------------------+-------------------------------| | Cisco Network Asset | CSCtd04198 | | Collector | | |----------------------------+-------------------------------| | Cisco Unified | CSCtd01282 | | Communications Manager | | | (CallManager) | | |----------------------------+-------------------------------| | Cisco Unified Business | CSCtd05731 | | Attendant Console | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05790 | | Center Enterprise | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05790 | | Center Express | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05755 | | Center Management Portal | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05790 | | Center Products | | |----------------------------+-------------------------------| | Cisco Unified Department | CSCtd05733 | | Attendant Console | | |----------------------------+-------------------------------| | Cisco Unified E-Mail | CSCtd05756 | | Interaction Manager | | |----------------------------+-------------------------------| | Cisco Unified Enterprise | CSCtd05735 | | Attendant Console | | |----------------------------+-------------------------------| | Cisco Unified Mobile | CSCtd05762 | | Communicator | | |----------------------------+-------------------------------| | Cisco Unified Mobility | CSCtd05786 | | | | |----------------------------+-------------------------------| | Cisco Unified Mobility | CSCtd05783 | | Advantage | | |----------------------------+-------------------------------| | Cisco Unified Operations | CSCtd05784 | | Manager | | |----------------------------+-------------------------------| | Cisco Unified Personal | CSCtd05759 | | Communicator | | |----------------------------+-------------------------------| | Cisco Unified Presence | CSCtd05791 | | | | |----------------------------+-------------------------------| | Cisco Unified Provisioning | CSCtd05777 | | Manager | | |----------------------------+-------------------------------| | Cisco Unified Quick | CSCtd05738 | | Connect | | |----------------------------+-------------------------------| | Cisco Unified Service | CSCtd05780 | | Monitor | | |----------------------------+-------------------------------| | Cisco Unified Service | CStCd05778 | | Statistics Manager | | |----------------------------+-------------------------------| | Cisco Unified SIP Proxy | CSCtd05765 | | | | |----------------------------+-------------------------------| | Cisco Unity | CSCtd02855 | | | | |----------------------------+-------------------------------| | Cisco NX-OS Software | CSCtd00699 and CSCtd00703 | | | | |----------------------------+-------------------------------| | Cisco Video Portal | CSCtd04097 | | | | |----------------------------+-------------------------------| | Cisco Video Surveillance | CSCtd02831 | | Media Server Software | | |----------------------------+-------------------------------| | Cisco Video Surveillance | CSCtd02780 | | Operations Manager | | | Software | | |----------------------------+-------------------------------| | Cisco Wide Area File | CSCtd04106 | | Services Software (WAFS) | | |----------------------------+-------------------------------| | Cisco Wireless Control | CSCtd01625 | | System | | |----------------------------+-------------------------------| | Cisco Wireless LAN | CSCtd01611 | | Controller (WLAN) | | |----------------------------+-------------------------------| | Cisco Wireless Location | CSCtd04115 | | Appliance | | |----------------------------+-------------------------------| | CiscoWorks Common Services | CSCtd01597 | | Software | | |----------------------------+-------------------------------| | CiscoWorks Wireless LAN | CSCtd04111 | | Solution Engine (WLSE) | | +------------------------------------------------------------+ This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-3555. Vulnerability Scoring Details +---------------------------- Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * TLS Renegotiation Vulnerability (all Cisco Bugs above) CVSS Base Score - 4.3 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - None Integrity Impact - Partial Availability Impact - None CVSS Temporal Score - 4.1 Exploitability - Functional Remediation Level - Unavailable Report Confidence - Confirmed Impact ====== This section will be updated when more information is available. Software Versions and Fixes =========================== This section will be updated to include fixed software versions for affected Cisco products as they become available. Workarounds =========== Workarounds are being investigated. This section will be updated when more information becomes available. Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts - -------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations - ------------------------------------------------- Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts - ----------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== This vulnerability was initially discovered by Marsh Ray and Steve Dispensa from PhoneFactor, Inc. Cisco is not aware of any malicious exploitation of this vulnerability. Proof-of-concept exploit code has been published for this vulnerability. Status of this Notice: INTERIM ============================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2009-November-9 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. +-------------------------------------------------------------------- Copyright 2008-2009 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- Updated: Nov 09, 2009 Document ID: 111046 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkr4TCsACgkQ86n/Gc8U/uDNWgCfYptXVZhz0qn2DvRh2zUtZ5EF OS4AoJediPm3/t9XqYIdrjR5PNP25iY/ =SkAu -----END PGP SIGNATURE-----

1 0

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Thanks, I've taken your advice and decided to reconsider my requirement for a full routing table. I believe I'm being greedy and a partial table will be sufficient. With regards to Linux/BSD, its not the CLI of quagga that will be an issue, rather the sysadmin and lack of supporting infrastructure for Linux boxes within the organisation. So things like package management, syslog servers, monitoring, understanding of security issues etc. I don't want to leave them with a linux/bsd solution that they won't be able to maintain/manage effectively when I am gone. Thanks for your comments. Look forward to hearing which solutions come back into the mix having dropped the full routing table requirement. Regards, Adel On Mon 11:45 AM , Joe Greco <jgreco(a)ns.sol.net> wrote: > > > > Basically the organisation that I'm working for will not have the > skills > > > > in house to support a linux or bsd box. They will have trouble > > > > with supporting the BGP configuration, however I don't think they > will be > > > > happy with me if I leave them with a linux box when they > > > > don't have linux/unix resource internally. At least with a Cisco or > > > > Juniper they are familiar with IOS and it won't be too foreign to > them. > > > > On Sun 11:47 PM , Dale Rumph wrote: > > > > > > What does your budget look like? A pair of Cisco 7246vxr's with G1's > > > sitting on the edge of the network would be very effective and still > allow > > > expansion. Or you could go up to the 7609. However this gear may be > > > slightly overkill. You might be ok with a 3660 enterprise and a ton > of > > > ram. I have done single sessions on them but not with the level of HA > your > > > looking for. > > > > > > Just my 2c > > > You will laugh, but the budget at the moment looks like Â£13k. > > Impossible? Do only linux and openbsd solutions remain in the mix > > for this pittance? > > No, you have the buy-it-off-eBay solutions as well. "Beware the > fakes." > > If they're familiar with IOS, then they can be familiar with Quagga > about as easily as they could be familiar with a switch or other > network gizmo that had a Ciscoesque CLI but wasn't actually Cisco. > > You've painted yourself into a corner. I have a word for you: > > Reconsider. > > I don't care what you reconsider, but reconsider something. You can > reconsider taking BGP with a full table. You can reconsider Quagga. > Or you can reconsider your budget. This is the end result of the > "pick any two" problem. > > Most end user organizations have no need of full routes in BGP. To > try to take them dooms TCAM-based equipment at some future point, > though if you have a lot of money to throw at it, you can make that > point be years in the future. It is essentially planned obsolescence. > If you discard the requirement for full routes, you open up a bunch > of reasonably-priced possibilities. > > Finding someone knowledgeable in BSD or Linux isn't that rough. > Unlike a Cisco 76xx router, the hardest part of a Quagga-based > solution is finding the right mix of hardware and software at the > beginning. PC hardware has a lot going for AND against it. There is > no reason you can't make a good router out of a PC. If you buy the > Cisco software-based routers, you're essentially buying a prepackaged > version, except that it'll be specced to avoid any real competition > with their low-end TCAM-based offerings. A contemporary PC can > easily route gigabits. Vyatta makes what I hear is a fantastic > canned solution of some sort, for a reasonable cost, and they will > sell just software or software/hardware. If you really can't put > it together yourself, there's someone to do it for you. > > Reconsidering your budget is probably the most painful thing to do, > but also opens up the "just buy big Cisco" option. I think my point > here would have to be that what you're looking for would have needed > big Cisco... ten years ago. Now, dealing with a few hundred megs of > traffic, that's not that big a deal, the thing that's killing you is > the BGP table size. > > Your best option may be to see if you can settle for partial routes > plus a default. > > ... JG > -- > Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net > [1] > "We call it the 'one bite at the apple' rule. Give me one chance [and] > then I > won't contact you again." - Direct Marketing Ass'n position on e-mail > spam(CNN) > With 24 million small businesses in the US alone, that's way too many > apples. > > > > Links: > ------ > [1] http://webmail.123-reg.co.uk/parse.php?redirect=http://www.sol.net > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Thanks, Their offering certainly looks appealing. Will be interested to hear user experiences of the Vyatta BGP router range. Having said that I will still be examining the Cisco offering, just because of the support, larger user community and skills base issue. However if I can't meet the price point using Cisco, obviously other solutions are going to come into the picture. Adel On Mon 11:39 AM , Arnold Nipper <arnold(a)nipper.de> wrote: > On 09.11.2009 11:53 adel(a)baklawasecrets.com wrote > > > You will laugh, but the budget at the moment looks like £13k. > > Impossible? Do only linux and openbsd solutions remain in the mix > > for this pittance? > > > > Do you know Vyatta (http://www.vyatta.com/)? [1] CLI and config is > Cisco-ish. Prices e.g. > > Vyatta Appliance, Vyatta 2502, Enterprise Subscription, Basic Warranty, > 1 Year (ships with US Power Cord as standard) (Typically ships in 10-12 > business days) > Price: $2,997.00 > > Best regards, > Arnold > -- > Arnold Nipper / nIPper consulting, Sandhausen, Germany > email: arnold(a)nipper.de phone: +49 6224 9259 299 > mobile: +49 172 2650958 fax: +49 6224 9259 333 > > > > Links: > ------ > [1] > http://webmail.123-reg.co.uk/parse.php?redirect=http://www.vyatta.com/%29%3 > F >

1 0

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

You will laugh, but the budget at the moment looks like £13k. Impossible? Do only linux and openbsd solutions remain in the mix for this pittance? On Sun 11:47 PM , Dale Rumph <daler(a)ibbs.com> wrote: > What does your budget look like? A pair of Cisco 7246vxr's with G1's > sitting on the edge of the network would be very effective and still allow > expansion. Or you could go up to the 7609. However this gear may be > slightly overkill. You might be ok with a 3660 enterprise and a ton of > ram. I have done single sessions on them but not with the level of HA your > looking for. > > Just my 2c > > ----- Original Message ----- > From: adel(a)baklawasecrets.com > To: nanog(a)nanog.org > Sent: Sun Nov 08 18:36:31 2009 > Subject: Re: Failover how much complexity will it add? > > Basically the organisation that I'm working for will not have the skills > in house to support a linux or bsd box. They will have trouble > with supporting the BGP configuration, however I don't think they will be > happy with me if I leave them with a linux box when they > don't have linux/unix resource internally. At least with a Cisco or > Juniper they are familiar with IOS and it won't be too foreign to them. > > On Sun 11:30 PM , "Renato Frederick" wrote: > > > There are any problems with quagga+BSD/Linux that you know or something > > > like that? > > > > Or in your scenario a "cisco/juniper box" is a requirement? > > > > I'm asking this because I'm always running BGP with upstreams providers > > > using quagga on BSD and everything is fine until now. > > > > -------------------------------------------------- > > From: > > Sent: Sunday, November 08, 2009 8:39 PM > > To: > > Subject: Re: Failover how much complexity will it add? > > > > > > > > So if my requirements are as follows: > > > > > > - BGP router capable of holding full Internet routing table. (whether > I > > > > > go for partial or full, I think I want something with full > capability). > > > > > > - Capable of pushing 100meg plus of mixed traffic. > > > > > > What are my options? I want to exclude openbsd, or linux with quagga. > > > > Probably looking at Cisco or Juniper products, but interested > > > in any other alternatives people suggest. I realise this is quite a > > broad > > > question, but hoping this will provide a starting point. Oh and > > > if I have missed any specs I should have included above, please let > me > > > know. > > > > > > Thanks > > > > > > Adel > > > > > > > > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Looking at two 100Mbit/s BGP connections, so I think I want something that will do more than 100 but nowhere close to a gig. So full routing table capability with throughput of mixed traffic around 200Mbit/s. If that makes sense. Do the 2850s fall into that sort of price point? Adel On Mon 11:13 AM , Joe Abley <jabley(a)hopcount.ca> wrote: > On 2009-11-09, at 19:53, adel(a)baklawasecrets.com wrote: > > > You will laugh, but the budget at the moment looks like £13k. > > Impossible? Do only linux and openbsd solutions remain in the mix > > for this pittance? > > I don't see an indication of the traffic you need to push (maybe I > deleted a message too enthusiastically) but check the 2800 series from > cisco. The 2850 will take full tables and has gigabit interfaces, but > don't expect them to do wire speed. Other 2800s suffer from reduced > RAM, but perhaps you don't need full tables. > > Also look at Juniper J-series boxes, and maybe Force10 S-series boxes. > > There's a healthy market in used cisco gear in most places I have ever > visited, if you don't need new. > > Joe > > >

1 0

[NANOG-announce] Communications Committee members
by Steve Feldman 09 Nov '09

09 Nov '09

Kris Foster and Michael K. Smith have been chosen to fill two year terms on the Communications Committee (formerly known as the Mailing List Committee.) They join Randy Epstein and Tim Yocum, who are starting the second year of their terms, and Sue Joiner, who is the Merit appointee to the CC. The Steering Committee would also like to thank Simon Lyall for his service on the MLC. His diligence and attention to refining and documenting the committee's processes was greatly appreciated. For the SC, Steve Feldman (chair) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Congress may require ISPs to block fraud sites H.R.3817
by Bryan King 08 Nov '09

08 Nov '09

Did I miss a thread on this? Has anyone looked at this yet? http://m.news.com/2166-12_3-10390779-38.html Section 508 of H.R.3817: SEC. 508. PENALTY FOR MISREPRESENTATION OF SIPC MEMBERSHIP OR PROTECTION. Section 14 of the Securities Investor Protection Act of 1970 (15 U.S.C. 78jjj) is amended by adding at the end the following new subsection: `(d) Misrepresentation of SIPC Membership or Protection- `(1) IN GENERAL- Any person who falsely represents by any means (including, without limitation, through the Internet or any other medium of mass communication), with actual knowledge of the falsity of the representation and with an intent to deceive or cause injury to another, that such person, or another person, is a member of SIPC or that any person or account is protected or is eligible for protection under this Act or by SIPC, shall be liable for any damages caused thereby and shall be fined not more than $250,000 or imprisoned for not more than five years. `(2) INTERNET SERVICE PROVIDERS- Any Internet service provider that, on or through a system or network controlled or operated by the Internet service provider, transmits, routes, provides connections for, or stores any material containing any misrepresentation of the kind prohibited in paragraph (1) shall be liable for any damages caused thereby, including damages suffered by SIPC, if the Internet service provider-- `(A) has actual knowledge that the material contains a misrepresentation of the kind prohibited in paragraph (1), or `(B) in the absence of actual knowledge, is aware of facts or circumstances from which it is apparent that the material contains a misrepresentation of the kind prohibited in paragraph (1), and upon obtaining such knowledge or awareness, fails to act expeditiously to remove, or disable access to, the material. `(3) INJUNCTIONS- Any court having jurisdiction of a civil action arising under this Act may grant temporary injunctions and final injunctions on such terms as the court deems reasonable to prevent or restrain any violation of paragraph (1) or (2). Any such injunction may be served anywhere in the United States on the person enjoined, shall be operative throughout the United States, and shall be enforceable, by proceedings in contempt or otherwise, by any United States court having jurisdiction over that person. The clerk of the court granting the injunction shall, when requested by any other court in which enforcement of the injunction is sought, transmit promptly to the other court a certified copy of all papers in the case on file in such clerk's office.'.

15 21

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Basically the organisation that I'm working for will not have the skills in house to support a linux or bsd box. They will have trouble with supporting the BGP configuration, however I don't think they will be happy with me if I leave them with a linux box when they don't have linux/unix resource internally. At least with a Cisco or Juniper they are familiar with IOS and it won't be too foreign to them. On Sun 11:30 PM , "Renato Frederick" <frederick(a)dahype.org> wrote: > There are any problems with quagga+BSD/Linux that you know or something > like that? > > Or in your scenario a "cisco/juniper box" is a requirement? > > I'm asking this because I'm always running BGP with upstreams providers > using quagga on BSD and everything is fine until now. > > -------------------------------------------------- > From: > Sent: Sunday, November 08, 2009 8:39 PM > To: > Subject: Re: Failover how much complexity will it add? > > > > > So if my requirements are as follows: > > > > - BGP router capable of holding full Internet routing table. (whether I > > > go for partial or full, I think I want something with full capability). > > > > - Capable of pushing 100meg plus of mixed traffic. > > > > What are my options? I want to exclude openbsd, or linux with quagga. > > Probably looking at Cisco or Juniper products, but interested > > in any other alternatives people suggest. I realise this is quite a > broad > > question, but hoping this will provide a starting point. Oh and > > if I have missed any specs I should have included above, please let me > > know. > > > > Thanks > > > > Adel > > >

1 0

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

So if my requirements are as follows: - BGP router capable of holding full Internet routing table. (whether I go for partial or full, I think I want something with full capability). - Capable of pushing 100meg plus of mixed traffic. What are my options? I want to exclude openbsd, or linux with quagga. Probably looking at Cisco or Juniper products, but interested in any other alternatives people suggest. I realise this is quite a broad question, but hoping this will provide a starting point. Oh and if I have missed any specs I should have included above, please let me know. Thanks Adel On Sun 10:18 PM , Seth Mattinen <sethm(a)rollernet.us> wrote: > adel(a)baklawasecrets.com wrote: > > I think partial routes makes perfect sense, makes sense that traffic > for customers who are connected to each of my upstreams should go out of > > the correct BGP link as long as they are up! Now I need to start > thinking of BGP router choices, sure I have a plethora of choices :-( > > > > Personally I'll always go for full routes if the router has enough > memory (software based) or TCAM space (hardware based). Cheaper to do on > software platforms though. An entry level Cisco 2811 can take full > tables from multiple upstreams with 786MB RAM or even 512. It won't push > 100 meg of mixed traffic though. > > ~Seth > > >

2 1