April 2010 - Test - lists.nanog.org

VPN over Comcast
by Michael Malitsky 28 Apr '10

28 Apr '10

I will probably be laughed at, but I'll ask just in case. We are having particularly bad luck trying to run VPN tunnels over Comcast cable in the Chicago area. The symptoms are basically complete loss of connectivity (lasting minutes to sometimes hours), or sometimes flapping for a period of time. More often than not, a reboot of the cable modem is required. The most interesting ones involve the following: a PIX or ASA configured as an EZvpn client, connecting to a 3000 concentrator, authentication over RADIUS. When I go to look at the RADIUS logs, I see connections from the same box with small intervals. Timeout is 8 hours, so theoretically I should see 3 connections in a 24-hr period. In some cases, I see dozens, in the most egregious cases, thousands over a 24-hour period. I am taking that as an indicator of a really unstable Comcast circuit. We have not had this problem with any other ISP, anywhere in the country. I am pretty much down to telling customers to find another provider... Any thoughts or ideas on the matter will be appreciated. PS. To be fair (?) to Comcast, this is not a ubiquitous problem. It affects about 25% of the installations I get to see. Sincerely, Michael Malitsky

8 7

Re: [dns-operations] Desire to migrate back to BIND
by Phil Regnauld 28 Apr '10

28 Apr '10

Had forgotten to answer the list... On 28/04/2010, at 07.07, Steve Bertrand <steve(a)ipv6canada.com> wrote: > What I ask of the members of the community, is if you can make a > recommendation on a piece of software that can bridge the gap so > that my > colleagues can use the pointy-clicky method of making simple changes > (eg: A/MX, add domain etc) while keeping in mind that budget > considerations are crucial, and there will always be the potential for > someone making changes to the zone files directly (namely me). Hi Steve, There is BIND-DLZ and MyDNS to look at but I think both work directly using a bind db driver so no possibility of editing the zone "by hand" (unless you hack some export/import script using the zone transfer functionality. My company developed something that works with both GUI and text zone edition including versioning, but it's not open source unfortunately. It can drive any auth. nameserver software, not just bind. I'm sure there might be other solutions around that do this as well (though I haven't found one yet ;) Cheers, Phil

3 4

Re: comcast enterprise/carrier services
by Scott Weeks 28 Apr '10

28 Apr '10

--- carlos(a)race.com wrote: Looking for a sales contact for Comcast enterprise/carrier services for ------Original Message------ From: Scott Weeks Please, please, PLEASE do not encourage sales droids like this. --- deleskie(a)gmail.com wrote: ------ I'm wondering how can someone recomend a vendor for X be diffrent from, Can someone recond a box that does Y. I'm no fan of blind calls from sales droids anymore more then the next person but I see this posting as relevant or more then many post here. ----------------------------------------------------- He is not asking for a vendor comparison from list members. He is asking Comcast sales lurkers to contact him. Otherwise, he would've gone to http://business.comcast.com/ethernet/dedicated-internet.aspx and found the info there. scott

2 1

Re: IPv6 rDNS - how will it be done?
by David Pérez 28 Apr '10

28 Apr '10

Hi! In some internal DNS applications, I've missed the so useful pipe feature of the sendmail alias (user: | /script), I mean, being able to forward a DNS request to a script that returns the resolution response. Maybe something similar would be useful in this IPv6 rDNS scenario too. Does anyone of you know if there's any chance to direct a zone to a script instead of to a file? Regards, David. ----------------------- Message: 1 Date: 28 Apr 2010 01:46:57 -0000 From: John Levine <johnl(a)iecc.com> Subject: Re: [Nanog] Re: IPv6 rDNS - how will it be done? To: nanog(a)nanog.org Message-ID: <20100428014657.91479.qmail(a)joyce.lan> Content-Type: text/plain; charset=iso-8859-1 >Hmm. A macro expansion for a /48 would mean >1,208,925,819,614,629,174,706,176 leaves. An interesting stress test >for name servers... :-). My inclination would be to use a wildcard that returns something like not-in-service.some-network.net, and let the clients add records for the addresses they use. For spoof resistance, how about doing a forward lookup on the purported name and only installing it if it gets a matching AAAA record? R's, John

2 1

the alleged evils of NAT, was Rate of growth on IPv6 not fast enough?
by Josh Hoppes 28 Apr '10

28 Apr '10

I'll preface this that I'm more of an end user then a network administrator, but I do feel I have a good enough understanding of the protocols and network administration to submit my two cents. The issue I see with this level of NAT, is the fact that I don't expect that UPNP be implemented at that level. I would see UPNP as being a security risk and prone to denial of service attacks when you have torrent clients attempting to grab every available port. Now that's going to create problems with services like Xbox Live which require UPNP to fully function since at least on one persons connection so they can "host" the game. When you're looking at player counts in the millions I'm fairly sure that they are going to be effected by CGN. That's one application I expect to see break by such large scale NAT implementations.

3 2

Re: Mail Submission Protocol
by Tony Finch 28 Apr '10

28 Apr '10

On 22 Apr 2010, at 00:07, Franck Martin <franck(a)genius.com> wrote: > Consider also smtps port which should be treated like smtp port and > not like submission port, or simply do not listen on smtps as TLS is > available on smtp port via esmtp. Er, no. TLS-on-connect aka smtps (as opposed to STARTTLS) is only used to support Microsoft MUAs that are more than a couple of years old. They only supported STARTTLS on port 25 and insisted on using the deprecated TLS-on-connect mode on all other ports. This meant they could not support standard Message Submission on port 587. Therefore you should treat smtps (TLS-on-connect on port 465) as the special Microsoft version of RFC 4409 message submission. That is, treat the protocols exactly the same wrt authentication, authorization, firewalls, address validation, etc. Tony. -- f.anthony.n.finch <dot(a)dotat.at> http://dotat.at/

3 3

iabelle francois
by Charles Morris 27 Apr '10

27 Apr '10

http://www.os-bc.de/home.php -- Charles Morris cmorris(a)cs.odu.edu, cmorris(a)occs.odu.edu Network Security Administrator, Software Developer Office of Computing and Communications Services, CS Systems Group Old Dominion University http://www.cs.odu.edu/~cmorris

5 6

Re: comcast enterprise/carrier services
by deleskie＠gmail.com 27 Apr '10

27 Apr '10

I'm wondering how can someone recomend a vendor for X be diffrent from, Can someone recond a box that does Y. I'm no fan of blind calls from sales droids anymore more then the next person but I see this posting as relevant or more then many post here. ------Original Message------ From: Scott Weeks To: nanog(a)nanog.org ReplyTo: surfer(a)mauigateway.com Subject: Re: comcast enterprise/carrier services Sent: Apr 27, 2010 4:29 PM --- carlos(a)race.com wrote: From: "Carlos Alcantar" <carlos(a)race.com> Looking for a sales contact for Comcast enterprise/carrier services for there Ethernet product thanks. -------------------------------------- Please, please, PLEASE do not encourage sales droids like this. It is evident to me you have never been hounded to death by the droids trolling this list. As usual, I encourage everyone to tell any droids that you absolutely will not buy from them when they contact you from your NANOG postings. I have gone through it many times over the years and always get to the point of yelling in email "WHAT PART OF NO DO YOU NOT UNDERSTAND!" before they finally stop. My apologies for yelling, but I want to get the point across that if we encourage them the list value is decreased by orders (plural) of magnitude. scott Sent from my BlackBerry device on the Rogers Wireless Network

1 0

NANOG Operational Audit of IPv4+ End-to-End L3 Transport in North America
by IPv3.com 27 Apr '10

27 Apr '10

NANOG Operational Audit of IPv4+ End-to-End L3 Transport in North America 1. To deploy and operate a network there may be network elements (aka NATs) that are used by network operators to upgrade versions & to help with audits. 2. L3 "End-to-End" is only part of the story. What about Hop Count ? Lag Latency...band-width 3. In North America the Customer DeMarc is commonly to a Linux-based CPE Router (WRT-54GL is one example) 4. For FCC purposes and other audits, the DeMarc for L3 IPv4+ has to be consistent to avoid comparing apples and oranges. 5. It may be that large parts of the IPv4+ Spectrum allocated to North America no longer qualifies as part of the L3 End-to-End Transport (and never did?). http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml 6. Before ISPs run off chasing the IPv6 Brokers-duJour, it may be prudent to first make sure their IPv4+ networks still are part of the L3 End-to-End Transport. NANOG Operational Audit of IPv4+ End-to-End L3 Transport in North America

2 1

Re: comcast enterprise/carrier services
by Scott Weeks 27 Apr '10

27 Apr '10

--- carlos(a)race.com wrote: From: "Carlos Alcantar" <carlos(a)race.com> Looking for a sales contact for Comcast enterprise/carrier services for there Ethernet product thanks. -------------------------------------- Please, please, PLEASE do not encourage sales droids like this. It is evident to me you have never been hounded to death by the droids trolling this list. As usual, I encourage everyone to tell any droids that you absolutely will not buy from them when they contact you from your NANOG postings. I have gone through it many times over the years and always get to the point of yelling in email "WHAT PART OF NO DO YOU NOT UNDERSTAND!" before they finally stop. My apologies for yelling, but I want to get the point across that if we encourage them the list value is decreased by orders (plural) of magnitude. scott

1 0