November 2009 - Test - lists.nanog.org

Pros and Cons of Cloud Computing in dealing with DDoS
by Stefan Fouant 08 Nov '09

08 Nov '09

I'm working on an article on the Pros and Cons of Cloud Computing as an effective strategy for dealing with DDoS. I'd like to open this up for debate and get some perspectives from folks on the list. In a recent article in ITWire titled "DDoS, the biggest threat to Cloud Computing", Roland Dobbins states that "DDoS attacks are one of the most under-rated and ill-guarded against security threats to corporate IT, and in particular the biggest threat facing cloud computing." To a certain extent, I agree with Roland, however, I also believe this perspective is inconsistent with the view that the elasticity of cloud computing and ability to scale resources on demand is a good way of dealing with the problem. The counterpoint to this is that I can also envision the cloud computing model causing a shift from that of a DDoS to what some are calling EDoS (Economic Denial of Sustainability). In an EDoS, the elasticity of the cloud and surplus of available resources might be used in such a way that large botnets generating seemingly legitimate "targeted" requests for service causing the victim to cloudburst in order to keep pace with the scale of the requests. Even though the victim can sustain business operations, the cost of doing so may be so exorbitantly expensive that to do so threatens economic sustainability. Roland also states "The cloud providers emerging as leaders don't tend to talk much about their resiliency to DDoS attacks". Which brings about another point - are there any cloud providers taking a proactive look at dealing with this problem and deploying effective countermeasures for dealing with this in their environments? What motivation would cloud providers have to deploy DDoS mitigation services and/or services which can distinguish between legitimate resource consumption vs. targeted resource consumption, especially if their revenues are driven from service availability and potential expansion of resource utilization? Stefan Fouant GPG Key ID: 0xB5E3803D

10 18

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

I think partial routes makes perfect sense, makes sense that traffic for customers who are connected to each of my upstreams should go out of the correct BGP link as long as they are up! Now I need to start thinking of BGP router choices, sure I have a plethora of choices :-( On Sun 10:01 PM , Seth Mattinen <sethm(a)rollernet.us> wrote: > adel(a)baklawasecrets.com wrote: > > Hi, > > > > Ok thanks for clearing that up. I'm getting some good feedback on > applying for PI and ASN through Ripe LIRs over on the UKNOF so I think I > have a handle on this. > > With regards to BGP and using separate BGP routers. I am announcing my > PI space to my upstreams, but I don't need to carry a full Internet > routing table, correct? > > So I can get away with some "lightweight" BGP routers not being an ISP > if that makes sense? > > > > Most will give you three choices: full routes, partial routes (internal, > their customers) with default, and default only. If you can't swing full > routes then I would go for partial routes as it will at least send > traffic for each ISP and their customers directly to them rather than > randomly over the other link. It all depends on what you're going to use > as your BGP speaking platform. > > ~Seth > > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Hi, Ok thanks for clearing that up. I'm getting some good feedback on applying for PI and ASN through Ripe LIRs over on the UKNOF so I think I have a handle on this. With regards to BGP and using separate BGP routers. I am announcing my PI space to my upstreams, but I don't need to carry a full Internet routing table, correct? So I can get away with some "lightweight" BGP routers not being an ISP if that makes sense? Adel On Sun 9:26 PM , Ken Gilmour <ken.gilmour(a)gmail.com> wrote: > Hey, > > Yes you apply to RIPE for your allocation. You should ask them for a > /20 since it's the same price for that as a /24 if you can justify it > (at least with LACNIC where i now get my allocations)... > > You will also need to apply for an ASN > > Correct- the block belongs to you and as long as you contact the > transit provider from the address listed in WHOIS then you should be > able to set up a new agreement easily. > > Yes the block is PI space (provider independent) > > It can take up to 1 month to get your assignments. > > I would recommend getting some different routers for this. I use > OpenBSD in some of my locations which is extremely easy to work with. > I also have some old NS-208 devices running ScreenOS for internal BGP > in one other location. I would not recommend using any router with > less than 1GB of RAM for BGP. in HA Mode you can connect the two > tails, one to each SSG (if they are in active active mode) and > announce it that way (check out anycast), we also do this :). > > The way BGP works is that both connections are active at the same > time, there is no primary and backup, if one goes down you just have > one less to receive traffic over and more traffic on the other, but > unless you stop announcing from one connection traffic will go over > both. > > Regards, > > Ken > > 2009/11/8 : > > Don't think I sent the below to the list, so resending: > > > > Thanks Seth and James, > > > > Things are getting a lot clearer. The BGP multihoming solution > sounds like exactly what I want. I have more questions :-) > > > > Now I suppose I would get my allocation from RIPE as I am UK based? > > > > Do I also need to apply for an AS number? > > > > As the IP block is "mine", it is ISP independent. i.e. I can take > it with me when I decide to use two > > completely different ISPs? > > > > Is the obtaining of this IP block, what is referred to as PI space? > > > > Of course internally I split the /24 up however I want - /28 for > untrust range and maybe a routed DMZ block > > etc.? > > > > Assuming I apply for IP block and AS number, whats involved and how > long does it take to get these babies?> > > > > I know the SSG550's have BGP capabilites. As I have two of these in > HA mode, does it make sense to do the BGP > > on these, or should I get dedicated BGP routers? > > > > Fixing the internal routing policy so traffic is directed at the > active BGP connection. Whats involved here, > > preferring one BGP link over the other? > > > > Thanks again, I obviously need to do some reading of my own, but > all the suggestions so far have been very valuable > > and definitely seem to be pointing in some fruitful directions. > > > > Adel > > > > > > > > > > On Sun 6:31 PM , James Hess wrote: > > > >> On Sun, Nov 8, 2009 at 11:34 AM, wrote: > >> [..] > >> > connections from different providers I would still have issues. So > >> > I guess that if my primary Internet goes down I lose connectivity > >> > to all the publicly addressed devices on that connection. Like > >> > dmz hosts and so on. I would be interested to hear how this > >> > can be avoided if at all or do I have to use the same provider. > >> > >> You assign multi-homed IP address space to your publicly addressed > >> devices, > >> which are not specific to either ISP. You announce to both ISPs, and > >> you accept some routes from both ISPs. > >> > >> You get multi-homed IPs, either by having an existing ARIN allocation, > >> or getting a /22 from ARIN (special allocation available for > >> multi-homing), or ask for a /24 from ISP A or ISP B for > >> multihoming. > >> > >> If Link A fails, the BGP session eventually times out and dies: ISP > >> A's BGP routers withdraw the routes, the IP addresses are then > >> associated only with provider B. > >> > >> And you design your internal routing policy to direct traffic > >> within your network to the router with an active BGP session. > >> > >> Link A's failure is _not_ a total non-event, but a 3-5 minute partial > >> disruption, while the BGP session times out and updates occur in other > >> people's routers, is minimal compared to a 3 day outage, if serious > >> repairs to upstream fiber are required. > >> > >> -- > >> -J > >> > >> > >> > > > > > > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Hi, Thanks for the info on UKNOF. I've started a thread there with regards to RIPE and obtaining ASN numbers and so on., as this is I guess quite UK specific. Adel On Sun 8:40 PM , Arnold Nipper <arnold(a)nipper.de> wrote: > Hi Adel, > > On 08.11.2009 21:24 Ken Gilmour wrote > > > There are companies like packet exchange (www.packetexchange.net [1]) > > I could also comment on PacketExchange, but I do not. If you get more UK > specific now you may perhaps want to post to UKNOF > (http://lists.uknof.org.uk/cgi-bin/mailman/listinfo/uknof/) [2] as well. > > For _independant_ consultancy you may want to have a look at Netsumo > (http://www.netsumo.com/) [3] Ask for Andy Davidson. > > Best regards, > Arnold > -- > Arnold Nipper / nIPper consulting, Sandhausen, Germany > email: arnold(a)nipper.de phone: +49 6224 9259 299 > mobile: +49 172 2650958 fax: +49 6224 9259 333 > > > > Links: > ------ > [1] > http://webmail.123-reg.co.uk/parse.php?redirect=http://www.packetexchange.n > et[2] > http://webmail.123-reg.co.uk/parse.php?redirect=http://lists.uknof.org.uk/c > gi-bin/mailman/listinfo/uknof/%29[3] > http://webmail.123-reg.co.uk/parse.php?redirect=http://www.netsumo.com/%29 > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Don't think I sent the below to the list, so resending: Thanks Seth and James, Things are getting a lot clearer. The BGP multihoming solution sounds like exactly what I want. I have more questions :-) Now I suppose I would get my allocation from RIPE as I am UK based? Do I also need to apply for an AS number? As the IP block is "mine", it is ISP independent. i.e. I can take it with me when I decide to use two completely different ISPs? Is the obtaining of this IP block, what is referred to as PI space? Of course internally I split the /24 up however I want - /28 for untrust range and maybe a routed DMZ block etc.? Assuming I apply for IP block and AS number, whats involved and how long does it take to get these babies?> I know the SSG550's have BGP capabilites. As I have two of these in HA mode, does it make sense to do the BGP on these, or should I get dedicated BGP routers? Fixing the internal routing policy so traffic is directed at the active BGP connection. Whats involved here, preferring one BGP link over the other? Thanks again, I obviously need to do some reading of my own, but all the suggestions so far have been very valuable and definitely seem to be pointing in some fruitful directions. Adel On Sun 6:31 PM , James Hess <mysidia(a)gmail.com> wrote: > On Sun, Nov 8, 2009 at 11:34 AM, wrote: > [..] > > connections from different providers I would still have issues. So > > I guess that if my primary Internet goes down I lose connectivity > > to all the publicly addressed devices on that connection. Like > > dmz hosts and so on. I would be interested to hear how this > > can be avoided if at all or do I have to use the same provider. > > You assign multi-homed IP address space to your publicly addressed > devices, > which are not specific to either ISP. You announce to both ISPs, and > you accept some routes from both ISPs. > > You get multi-homed IPs, either by having an existing ARIN allocation, > or getting a /22 from ARIN (special allocation available for > multi-homing), or ask for a /24 from ISP A or ISP B for > multihoming. > > If Link A fails, the BGP session eventually times out and dies: ISP > A's BGP routers withdraw the routes, the IP addresses are then > associated only with provider B. > > And you design your internal routing policy to direct traffic > within your network to the router with an active BGP session. > > Link A's failure is _not_ a total non-event, but a 3-5 minute partial > disruption, while the BGP session times out and updates occur in other > people's routers, is minimal compared to a 3 day outage, if serious > repairs to upstream fiber are required. > > -- > -J > > >

1 0

Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

HI, I was recently brought onto a project where some failover is desired, but I think that the number of connections provisioned is excessive. Also hoping to get some guidance with regards to how well I can get the failover to actually work. So currently 4 X 100Mb/s Internet connections have been provisioned. One is to be used for general Internet, out of the organisation, it also terminates VPNs from remote sites belonging to the organisation and some publicly accessible servers -routed DMZ and translated IPs. Second Internet connection to be used for a separate system which has a site-to-site VPN to a third party support vendor. Internet connections 3 and 4 are currently thought of as providing backups for one and two. Both connections firewalled by a Juniper SSG of some description. Now I couldn't get any good answers as to why Internet connections 1 and 2 need to be separate. I think the idea was to make sure that there was enough bandwidth for the third party support VPN. I feel that I can consolidate this into one connection and just use rate limiting to reserve some portion of the bandwidth on the connection and this should be fine. Now if I was to do this then I can make a case for just having one backup Internet connection. However I'm still concerned about failover and reliability issues. So my questions regarding this are: - Should I make sure that the backup Internet connection is from a separate provider? - How can I acheive a failover which doesn't require me to change all the remote VPN endpoints in case of a failover? Its possible to configure failover VPNs on the Junipers, which should take care of this, but how do I take care of the DMZ hosts and external translation? - In fact I think I'm asking what are my options with regard to failover between one Internet connection and the other? I'm hoping to figure out whether adding an extra Internet connection actually gives us that much, in fact whether it justifies the complexity and spend. Many Thanks for your comments. Adel

7 6

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Thanks for all your comments guys. With regards to bgp I did think about placing two bgp routers in front of the ssg's. However my limited understanding makes me think that if I had two bgp connections from different providers I would still have issues. So I guess that if my primary Internet goes down I lose connectivity to all the publicly addressed devices on that connection. Like dmz hosts and so on. I would be interested to hear how this can be avoided if at all or do I have to use the same provider. I should add that we currently have provisioned two ssg in ha mode. Also is terminating bgp on the ssg also an option? I really like the flexibility of route based VPN with addresable tun interfaces. Thanks adel On Sun 3:47 PM , "Joe Maimon" jmaimon(a)ttec.com sent: > > > adel@ > baklawasecrets.com wrote:> HI, > > > > > > Now I couldn't get any good answers as to why > Internet connections 1 and 2 need to be separate. I think the idea was to > make sure that there was enough bandwidth for the third party support VPN. > I feel that I can consolidate this into one connection and just use rate > limiting to reserve some portion of the bandwidth on the connection and > this should be fine. Now if I was to do this then I can make a case for > just having one backup Internet connection. However I'm still concerned > about failover and reliability issues. So my questions regarding this > are:> > > I wouldnt jump to any conclusions that everything will work properly if > you are terminating multiple connections directly on the SSG, what with > egress likely being different than the ingress, even if you are using > the same IP range (BGP) on all the links. > > You could really be asking for trouble if you are planning on using a > different ISP provided IP range on each connection for each purpose. > > Front it all with routers that can policy route, whether or not you also > use BGP. > > > Joe > > > > >

2 1

Re: HE.net, Fremont-2 outage?
by William Pitcock 08 Nov '09

08 Nov '09

Yeah. They had yet another power outage. The fourth in 16 months. Luckily we have already begun plans to leave their facility. William ------Original Message------ From: Tico To: nanog(a)nanog.org Subject: HE.net, Fremont-2 outage? Sent: Nov 3, 2009 1:50 PM Hey guys, I can't get through to Hurricane Electric, and they seem to be having an outage at their Fremont-2 facility again (as of 17:30 UTC or thereabouts) -- ticket system is unanswered, phones go to voicemail, all equipment is unreachable. Does anyone here have a presence at 48233 Warm Springs Blvd, that can provide any information about this? I got hit by the ATS failure last month, so I guess it's possible that that equipment may have flaked again. -t -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

37 59

Speed Testing and Throughput testing
by Mark Urbach 07 Nov '09

07 Nov '09

Anyone have a good solution to get "accurate" speed results when testing at 10/100/1000 Ethernet speeds? Do you have a server/software that customer can test too? Thanks, Mark Urbach PinPoint Communications, Inc. 100 N. 12th St Suite 500 Lincoln, NE 68508 402-438-6211 ext 1923 Office 402-660-7982 Cell mark.urbach(a)pnpt.com [cid:image003.jpg@01CA5BD5.1A5CEE20]

18 20

Re: Interesting Point of view - Russian police and RIPE accused of aiding RBN
by Jeffrey Lyon 07 Nov '09

07 Nov '09

Kanak, Can you please detail your plans to correct the malware issues on your network? (reference: http://google.com/safebrowsing/diagnostic?site=AS:44571 ). Best regards, Jeff [offlist communication snipped for privacy] > > Kanak > > Akrino Abuse Team > -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications of The IRC Company, Inc. Platinum sponsor of HostingCon 2010. Come to Austin, TX on July 19 - 21 to find out how to "protect your booty."

2 1