September 2010 - Test - lists.nanog.org

Active Directory requires Microsoft DNS?
by Tom Mikelson 02 Oct '10

02 Oct '10

Presently our organization utilizes BIND for DNS services, with the Networking team administering. We are now being told by the Systems team that they will be responsible for DNS services and that it will be changed over to the Microsoft DNS service run on domain controllers. The reason given is that the Active Directory implementation requires the Microsoft DNS service and dynamic DNS. Not being a Microsoft administrator I do not know the veracity of these claims. Anyone out there had any experiences with a situation like this? I am a bit leery of changing something that is already working.

15 15

RIP Justification
by Jesse Loggins 01 Oct '10

01 Oct '10

A group of engineers and I were having a design discussion about routing protocols including RIP and static routing and the justifications of use for each protocol. One very interesting discussion was surrounding RIP and its use versus a protocol like OSPF. It seems that many Network Engineers consider RIP an old antiquated protocol that should be thrown in back of a closet "never to be seen or heard from again". Some even preferred using a more complex protocol like OSPF instead of RIP. I am of the opinion that every protocol has its place, which seems to be contrary to some engineers way of thinking. This leads to my question. What are your views of when and where the RIP protocol is useful? Please excuse me if this is the incorrect forum for such questions. -- Jesse Loggins CCIE#14661 (R&S, Service Provider)

32 60

Frontier DSL Contact
by Tony Bunce 01 Oct '10

01 Oct '10

Can someone from Frontier DSL (formally Verizon) please contact me off list? It appears Frontier DSL customers (at least in Ohio) can't access websites that we host. I have tried contacting the ISIS NOC, the Ohio NOC and the MCO and they were unable to assist. Or if there is anyone on the list using Frontier DSL if they could send me a traceroute to 208.2.209.110 and/or 208.2.213.96 that might also help me track down the issue. Thanks, Tony -------------------------------------------------------------------------- Tony Bunce: tonyb(a)go-concepts.com Sr. Programming Systems Administrator - GO Concepts Inc.

1 1

BGP next-hop
by Heath Jones 01 Oct '10

01 Oct '10

Hi all, Is there an easy way to see which iBGP routes are not being selected due to next-hop not being in IGP? Before and after IGP route added shown below, note both are marked as valid.. -- BEFORE IGP-- AS5000_LA#show ip bgp BGP table version is 5, local router ID is 10.0.0.5 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * i100.10.0.0/16 10.0.0.10 0 100 0 2000 3000 ? *> 10.0.0.6 0 1000 3000 3000 ? -- AFTER IGP-- AS5000_LA#show ip bgp BGP table version is 6, local router ID is 10.0.0.5 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>i100.10.0.0/16 10.0.0.10 0 100 0 2000 3000 ? * 10.0.0.6 0 1000 3000 3000 ? Cheers Heath ps. I've posted this to cisco-nsp also (a day ago) - so apologies in advance if you are on both and seeing it twice.

11 17

(cisco, or any) acl *reducers* out there?
by George Michaelson 01 Oct '10

01 Oct '10

I have been looking at acl management s/w in the freecode space and I can find lots of tools which manage/distribute and test ACLs in routers. I'm wondering if anyone has written a parser which can construct rule-trees and get rid of the cruft, unusable, order-misorder and other issues in a large ACL pool? Its possible this is NP in the wider sense, but even a partial improvement would be useful something which can take a couple of hundred basic and extended ACLs and tell you these <ten> don't work these <twenty> conflict the remaining <x> have a sequence and can reduce to this basic <x-y> set (we've got the usual "acquisition of rule by accretion" problem across 4 edge/core routers with a mix of public facing, internal, WiFi, guest rules, and I hate to think this is either start from scratch, or intractable. The evidence is that its FRAGILE) -G

8 13

First Data Corporation?
by Leo Woltz 01 Oct '10

01 Oct '10

Anyone on the list from First Data Corporation or familar with there network?

2 1

Re: LISP Works - Re: Facebook Issues/Outage in Southeast?
by Job W. J. Snijders 01 Oct '10

01 Oct '10

Dear Cameron, On Wed, Sep 29, 2010 at 3:27 AM, Cameron Byrne <cb.list6(a)gmail.com> wrote: >> The fact that LISP does help in IPv6 Transition solutions (due to its inherent AF agnostic design), is compelling. As you say, real edge 2 edge is the goal - and LISP helps here, regardless of the AF. (you'll will still want to do multi-homing in IPv6, and ingress TE, and mobility, etc.). >> > > Sorry, when i said e2e w.r.t IPv6 i was talking about end to end, not > edge to edge. I think there is a big difference. Oops, i meant end to end too, don't know why I typed edge2edge. :-) > IMHO, ILNP is the more interesting solution and avoids expensive > encapsulation and questionable assumptions about ISP MTU, all my ISP > links are GigE and 10GigE and they are all set to default 1500 bytes > ... good or bad, this is just how they roll off the line from every > ISP in every city i buy transit... and LISP tunnels do not work so > well with 1500 byte MTU. I beg to differ, LISP works excellent with 1500 byte MTU. But you point out a significant aspect of LISP; hosts behind LISP rely a bit on path MTU discovery, with all it's benefits and drawbacks. But that's not a show stopper i've seen on the lisp beta network. We live in a world where PMTUD is daily practice, ILNP will not make PMTUD go away. My major concern with ILNP is that eventually all hosts need to be upgraded/changed to take advantage of ILNP. If we take a hard look at something like SCTP... it never was really populair in the wild even though it's in the Linux kernel. I'd rather load new software on hundreds CPE's then change ten thousands of hosts, with all variations, versions, servicepacks. Another example: the rate at which IPv6 has been adopted in operating systems is horrible, we cannot wait another 10 or so years. So I actually consider it one of the best features of LISP that hosts don't need to be changed and the scope has been reduced to just the 'edge' or 'CPE'. In this sense one might even consider LISP to be more backwards compatible then ILNP. :-) Last, ILNP has no viable plan for IPv4, an address family we cannot easily discard. The critique in draft-irtf-rrg-recommendation-14 on ILNP's hIPv4 is heavy, and can be summerized with: "It appears that hIPv4 involves major practical difficulties which mean that in its current form it is not suitable for IETF development.." Kind regards, Job Snijders

2 3

Re: L3 Issues this Morning?
by Khurram Khan 30 Sep '10

30 Sep '10

Learn something new everyday, that's awesome. We've got several data centers between San Diego, Denver, Tulsa, Chicago, Washington DC. All of the circuit's between those POP's , and all are L3, just dropped traffic. On Thu, Sep 30, 2010 at 11:35 AM, James Smith <james(a)smithwaysecurity.com> wrote: > None Down here in Canada > > Sent from my iPhone > > On Sep 30, 2010, at 2:32 PM, Khurram Khan <brokenflea(a)gmail.com> wrote: > >> Hello All, >> >> This is my first time writing to this list and wanted to check if >> anyone experienced issues with L3 circuits between 12:50 ET and 13:05 >> ET. All our core backbone circuits re-converged and we saw a >> significant drop in traffic. >> >> Regards, >> >> Khurram >> > -- Please use the following public key for encrypted transport. —–BEGIN PGP SIGNATURE—– Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGZO+K6ECuipL6LVERAjSvAJsFslrQU61la+yCqD2bfDSW/OGKigCg0QOK LQTWZQDmFma6eh7onZfi99A= =LlU0 —–END PGP SIGNATURE—–

2 1

Cogent security contact for non-BGP issue?
by Neal Rauhauser 30 Sep '10

30 Sep '10

Can someone from Cogent responsible for security contact me? I'm seeing some troubles that appear to originate within Cogent itself. What I am seeing does not effect global BGP at all, it's some other area. Thanks in advance ...

1 0

L3 Issues this Morning?
by Khurram Khan 30 Sep '10

30 Sep '10

Hello All, This is my first time writing to this list and wanted to check if anyone experienced issues with L3 circuits between 12:50 ET and 13:05 ET. All our core backbone circuits re-converged and we saw a significant drop in traffic. Regards, Khurram

1 0