December 2011 - Test - lists.nanog.org

BGP and Firewalls...
by Gregory Croft 16 Dec '11

16 Dec '11

Hi All, Does anyone have any experience with using firewalls as edge devices when BGP is concerned? Specifically the Palo Alto series of devices. If so please contact me off list. Thank you. Thank you, Gregory S. Croft

11 13

De-bogon not possible via arin policy.
by Cameron Byrne 16 Dec '11

16 Dec '11

Fyi, I just was rejected from arin for an ipv4 allocation. I demonstrated I own ~100k ipv4 addresses today. My customers use over 10 million bogon / squat space ip addresses today, and I have good attested data on that. But all I can qualify for is a /18, and then in 3 months maybe a /17. This is called slow start ? For an established business? Just fyi, de-bogoning , or private rfc 1918 is not really an option even with strong and consistent demonstrate load. Any suggestions on how to navigate this policy ?

17 36

[sort of off topic] An Open Letter From Internet Engineers to the U.S. Congress
by Network IP Dog 16 Dec '11

16 Dec '11

I wonder how this will go in the USA and what trickle effect it might have on us if Senator Conroy gets wind of it. An Open Letter From Internet Engineers to the U.S. Congress. https://www.eff.org/deeplinks/2011/12/internet-inventors-warn-against-sopa-a nd-pipa Ephesians 4:32 & Cheers!!! Andy

1 0

Cybersecurity Investments Survey - request for participation
by Rowe, Brent 16 Dec '11

16 Dec '11

All - See below a solicitation for a NIST-sponsored survey to help identify investments in cyber security that would have the greatest economic impact. All individuals with knowledge of cyber security gaps from an industry perspective are welcome to participate. As an additional incentive, participants will be entered into a raffle for 1 of 10 iPad 2's. Thanks to anyone willing to participate. Feel free to email me with any questions. Brent Rowe, Study Director ------------------------------------------------------------------------ ----------------- ECONOMIC ANALYSIS OF THE U.S. TECHNOLOGY-BASED CYBER SECURITY GAPS - SURVEY INVITATION U.S. industries spend billions of dollars each year securing their information technology (IT) assets. Yet, these businesses still suffer significant economic losses from cyber attacks. Many organizations may not have the technical ability or capacity to identify or address attacks, while other organizations with very complex communications infrastructures may make investments only in response to attacks or breaches. The National Institute of Standards and Technology (NIST) and RTI International are asking IT security managers around the world to participate in a 15-minute survey. Respondents taking the survey will help both the public and private sectors identify inadequacies in the technology-based cybersecurity infrastructure and quantify the economic benefits of these improvements in these areas. Your participation will help ensure that new investments by public agencies and private sector organizations in the cybersecurity infrastructure will be targeted at achieving the greatest economic benefit to organizations such as yours. Go now to https://cybersurvey.rti.org/. To thank you for your participation, you can enter a raffle to win 1 of 10 iPad 2s! We will notify winners by email and telephone in January 2012. For questions or comments about this survey, please contact Igor Pokryshevskiy at (415) 848-1378 (Pacific Time) or igor(a)rti.org. Brent R. Rowe Senior Economist Technology Economics & Policy RTI International 114 Sansome St., Suite 500 San Francisco, CA 94104 (415) 848-1317 (415) 848-1330 fax

1 0

Range using single-mode SFPs across multi-mode fiber
by oliver rothschild 15 Dec '11

15 Dec '11

Thanks to all who responded to my clumsy first question (both on matters of etiquette and technology). The group I work with (we are a small project acting as a last mile provider) was in the midst of deploying this solution when I posed the question. We put the single mode Juniper SFPs (LX) on to a run of approximately 1670 meters. We successfully established a 1G ethernet connection. Testing to date has been meager, but shows that the link is viable. Under significant load there is some minor packet loss. Since the link far exceeds the amount of data it required, we have decided to continue using it. Interestingly neither interface showed any physical errors. v/r, Oliver Rothschild Network Engineer III

7 8

Re: De-bogon not possible via arin policy.
by Scott Weeks 15 Dec '11

15 Dec '11

--- Bryan(a)bryanfields.net wrote: From: Bryan Fields <Bryan(a)bryanfields.net> Now this gets a lot more fun as we get closer to true IPv4 exhaustion. If there is a business case between two or more providers to side step a RIR process and recognize IP allocations that the RIR does not, who really has the power to stop them? -------------------------------------------------- The networking community in general. The usefulness of the space would be very limited. scott

1 0

FREE!!!111 Net Master
by Network IP Dog 15 Dec '11

15 Dec '11

Hey fellow WWW Zombies, Net Master appears to be Free for a limited? time. http://itunes.apple.com/app/net-master/id470646694?mt=8&affToken=55503 Quite a good tool to have on your <insert I device> if you don't already. Wish there was a Android version... ;^( - Network IPdog E = 4:32 & Cheers!!!

1 0

RE: /128 IPv6 prefixes in the wild?
by Brian Johnson 15 Dec '11

15 Dec '11

I think you will learn a lot of /128s from IGP, but not from eBGP. I consider the "wild" to be the DFZ or similar type of network and in that case, you should not see advertisements for anything longer than a /48. This is not hard and fast, but please correct me if I'm wrong. - Brian J. >-----Original Message----- >From: Mark Tinka [mailto:mtinka@globaltransit.net] >Sent: Thursday, December 15, 2011 12:30 AM >To: nanog(a)nanog.org >Subject: Re: /128 IPv6 prefixs in the wild? > >On Thursday, December 15, 2011 01:54:56 PM Glen Kent wrote: > >> In an IP/MPLS world, core routers in the service provider >> network learn the /32 loopback IPv4 addresses so that >> they can establish BGP/Targetted LDP sessions with >> those. > >That's right - not sure how things would have been if >'draft-swallow-mpls-aggregate-fec-01' had gained some >traction. > >> They then establish LSPs and VPN tunnels. > >Indeed. > >> Since >> we dont have RSVP for IPv6 and LDP for IPv6 (not yet >> RFC) we cannot form MPLS tunnels in a pure IPv6 only >> network. GIven this, would v6 routers have large number >> of /128 prefixes? >> >> What are the scenarios when IPv6 routers would learn a >> large number of /128 prefixes? > >I suspect ISP's that choose to assign broadband customers >/128 addresses because "they only ever need one address" may >be a situation where you see rise given to this. > >> I would presume that most IPv6 prefixes that the routers >> have to install are less than /64, since the latter 64 >> is the host part. Is this correct? > >This is certainly going to re-open some "wounds", but no, >not all providers are assigning /64 to interfaces. Some >(like us) are using longer prefix lengths such as /112 and >/126. > >But as for /128 prefix lengths, aside from the fact that >Loopbacks will be floating around the network, whether >you're using them to signal MPLS LSP's or setup iBGP >sessions, you will see them with ISP's that assign them to >customers and choose not to aggregate them at specific edge >routers. > >Cheers, > >Mark.

2 1

/128 IPv6 prefixs in the wild?
by Glen Kent 15 Dec '11

15 Dec '11

Hi, In the service provider networks, would we usually see a large number of /128 prefixs in the v6 FIB tables? In an IP/MPLS world, core routers in the service provider network learn the /32 loopback IPv4 addresses so that they can establish BGP/Targetted LDP sessions with those. They then establish LSPs and VPN tunnels. Since we dont have RSVP for IPv6 and LDP for IPv6 (not yet RFC) we cannot form MPLS tunnels in a pure IPv6 only network. GIven this, would v6 routers have large number of /128 prefixes? What are the scenarios when IPv6 routers would learn a large number of /128 prefixes? I would presume that most IPv6 prefixes that the routers have to install are less than /64, since the latter 64 is the host part. Is this correct? Glen

5 4

Multiple ISP Load Balancing
by Holmes,David A 15 Dec '11

15 Dec '11

>From time to time some have posted questions asking if BGP load balancers such as the old Routescience Pathcontrol device are still around, and if not what have others found to replace that function. I have used the Routescience device with much success 10 years ago when it first came on the market, but since then a full BGP feed has become much larger, Routescience has been bought by Avaya, then discontinued, and other competitors such as Sockeye, Netvmg have been acquired by other companies. Doing some research on how load balancing can be accomplished in 2011, I have come across Cisco's performance routing feature, and features from load balancing companies such as F5's Link Controller. I have always found BGP to be easy to work with, and an elegant, simple solution to load balancing using a route-reflector configuration in which one BGP client (Routescience Pathcontrol in my background) learns the best route to destination networks, and then announces that best route to BGP border routers using common and widely understood BGP concepts such as communities and local pref, and found this to lead to a deterministic Internet routing architecture. This required a knowledge only of IETF standards (common BGP concepts and configurations), required no specialized scripting, or any other knowledge lying outside IETF boundaries, and it seemed reasonable to expect that network engineers should eagerly and enthusiastically want to master this technology, just as any other technology must be mastered to run high availability networks. So I am wondering if anyone has experience with implementing load balancing across multiple ISP links in 2011, and if there have been any comparisons between IETF standards-based methods using BGP, and other proprietary methods which may use a particular vendor's approach to solving the same problem, but involves some complexity with more variables to be plugged in to the architecture. David ________________________________ This communication, together with any attachments or embedded links, is for the sole use of the intended recipient(s) and may contain information that is confidential or legally protected. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, dissemination, distribution or use of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return e-mail message and delete the original and all copies of the communication, along with any attachments or embedded links, from your system.

7 8