July 2011 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 15 Jul '11

15 Jul '11

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 16 Jul, 2011 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 363652 Prefixes after maximum aggregation: 165367 Deaggregation factor: 2.20 Unique aggregates announced to Internet: 180640 Total ASes present in the Internet Routing Table: 38198 Prefixes per ASN: 9.52 Origin-only ASes present in the Internet Routing Table: 31741 Origin ASes announcing only one prefix: 15260 Transit ASes present in the Internet Routing Table: 5195 Transit-only ASes present in the Internet Routing Table: 132 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 33 Max AS path prepend of ASN (22394) 27 Prefixes from unregistered ASNs in the Routing Table: 917 Unregistered ASNs in the Routing Table: 532 Number of 32-bit ASNs allocated by the RIRs: 1559 Number of 32-bit ASNs visible in the Routing Table: 1262 Prefixes from 32-bit ASNs in the Routing Table: 2910 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 122 Number of addresses announced to Internet: 2477764128 Equivalent to 147 /8s, 175 /16s and 174 /24s Percentage of available address space announced: 66.8 Percentage of allocated address space announced: 66.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 91.1 Total number of prefixes smaller than registry allocations: 151592 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 90715 Total APNIC prefixes after maximum aggregation: 30300 APNIC Deaggregation factor: 2.99 Prefixes being announced from the APNIC address blocks: 87321 Unique aggregates announced from the APNIC address blocks: 37425 APNIC Region origin ASes present in the Internet Routing Table: 4519 APNIC Prefixes per ASN: 19.32 APNIC Region origin ASes announcing only one prefix: 1253 APNIC Region transit ASes present in the Internet Routing Table: 716 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 18 Number of APNIC region 32-bit ASNs visible in the Routing Table: 61 Number of APNIC addresses announced to Internet: 622188352 Equivalent to 37 /8s, 21 /16s and 215 /24s Percentage of available APNIC address space announced: 78.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 55296-56319, 131072-132095 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 141554 Total ARIN prefixes after maximum aggregation: 73093 ARIN Deaggregation factor: 1.94 Prefixes being announced from the ARIN address blocks: 113475 Unique aggregates announced from the ARIN address blocks: 46690 ARIN Region origin ASes present in the Internet Routing Table: 14485 ARIN Prefixes per ASN: 7.83 ARIN Region origin ASes announcing only one prefix: 5538 ARIN Region transit ASes present in the Internet Routing Table: 1526 Average ARIN Region AS path length visible: 4.0 Max ARIN Region AS path length visible: 30 Number of ARIN region 32-bit ASNs visible in the Routing Table: 13 Number of ARIN addresses announced to Internet: 802399872 Equivalent to 47 /8s, 211 /16s and 166 /24s Percentage of available ARIN address space announced: 63.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 86584 Total RIPE prefixes after maximum aggregation: 49219 RIPE Deaggregation factor: 1.76 Prefixes being announced from the RIPE address blocks: 79927 Unique aggregates announced from the RIPE address blocks: 52892 RIPE Region origin ASes present in the Internet Routing Table: 15802 RIPE Prefixes per ASN: 5.06 RIPE Region origin ASes announcing only one prefix: 7878 RIPE Region transit ASes present in the Internet Routing Table: 2504 Average RIPE Region AS path length visible: 4.6 Max RIPE Region AS path length visible: 33 Number of RIPE region 32-bit ASNs visible in the Routing Table: 919 Number of RIPE addresses announced to Internet: 479486528 Equivalent to 28 /8s, 148 /16s and 98 /24s Percentage of available RIPE address space announced: 77.2 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 196608-198655 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 176/8, 178/8, 185/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 33534 Total LACNIC prefixes after maximum aggregation: 7585 LACNIC Deaggregation factor: 4.42 Prefixes being announced from the LACNIC address blocks: 32747 Unique aggregates announced from the LACNIC address blocks: 17050 LACNIC Region origin ASes present in the Internet Routing Table: 1481 LACNIC Prefixes per ASN: 22.11 LACNIC Region origin ASes announcing only one prefix: 445 LACNIC Region transit ASes present in the Internet Routing Table: 273 Average LACNIC Region AS path length visible: 4.4 Max LACNIC Region AS path length visible: 19 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 265 Number of LACNIC addresses announced to Internet: 86070528 Equivalent to 5 /8s, 33 /16s and 85 /24s Percentage of available LACNIC address space announced: 57.0 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 8177 Total AfriNIC prefixes after maximum aggregation: 1965 AfriNIC Deaggregation factor: 4.16 Prefixes being announced from the AfriNIC address blocks: 6491 Unique aggregates announced from the AfriNIC address blocks: 1992 AfriNIC Region origin ASes present in the Internet Routing Table: 468 AfriNIC Prefixes per ASN: 13.87 AfriNIC Region origin ASes announcing only one prefix: 146 AfriNIC Region transit ASes present in the Internet Routing Table: 103 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 4 Number of AfriNIC addresses announced to Internet: 24338944 Equivalent to 1 /8s, 115 /16s and 98 /24s Percentage of available AfriNIC address space announced: 36.3 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2469 11044 937 Korea Telecom (KIX) 7545 1554 301 85 TPG Internet Pty Ltd 17974 1543 456 45 PT TELEKOMUNIKASI INDONESIA 4755 1505 635 170 TATA Communications formerly 7552 1283 1064 7 Vietel Corporation 24560 1155 336 187 Bharti Airtel Ltd., Telemedia 9829 1106 923 47 BSNL National Internet Backbo 9583 1064 78 504 Sify Limited 4808 1047 2092 299 CNCGROUP IP network: China169 17488 966 187 106 Hathway IP Over Cable Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3599 3818 241 bellsouth.net, inc. 18566 1913 365 241 Covad Communications 1785 1805 681 121 PaeTec Communications, Inc. 4323 1657 1082 400 Time Warner Telecom 20115 1594 1534 627 Charter Communications 19262 1410 4744 390 Verizon Global Networks 7018 1365 7069 892 AT&T WorldNet Services 22773 1351 2897 88 Cox Communications, Inc. 7029 1291 791 305 Windstream Communications Inc 2386 1260 520 907 AT&T Data Communications Serv Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 34984 535 106 184 BILISIM TELEKOM 6830 510 1780 315 UPC Distribution Services 3292 468 2078 403 TDC Tele Danmark 12479 458 593 7 Uni2 Autonomous System 20940 458 131 354 Akamai Technologies European 8866 449 133 25 Bulgarian Telecommunication C 29049 432 32 47 AzerSat LLC. 3320 423 8151 369 Deutsche Telekom AG 8551 404 354 44 Bezeq International 702 399 1803 312 UUNET - Commercial IP service Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 1549 284 162 TVCABLE BOGOTA 8151 1437 2746 353 UniNet S.A. de C.V. 28573 1277 995 77 NET Servicos de Comunicao S.A 7303 986 511 165 Telecom Argentina Stet-France 6503 749 354 74 AVANTEL, S.A. 14420 690 55 84 CORPORACION NACIONAL DE TELEC 22047 578 322 17 VTR PUNTO NET S.A. 3816 533 230 97 Empresa Nacional de Telecomun 7738 516 986 31 Telecomunicacoes da Bahia S.A 27947 508 53 53 Telconet S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 795 147 36 LINKdotNET AS number 8452 780 445 11 TEDATA 15475 513 74 8 Nile Online 36992 315 415 14 Etisalat MISR 3741 261 937 223 The Internet Solution 6713 241 215 13 Itissalat Al-MAGHRIB 33776 227 13 5 Starcomms Nigeria Limited 24835 175 78 10 RAYA Telecom - Egypt 29571 158 17 11 Ci Telecom Autonomous system 16637 148 441 86 MTN Network Solutions Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3599 3818 241 bellsouth.net, inc. 23456 2910 707 1559 32-bit ASN transition 4766 2469 11044 937 Korea Telecom (KIX) 18566 1913 365 241 Covad Communications 1785 1805 681 121 PaeTec Communications, Inc. 4323 1657 1082 400 Time Warner Telecom 20115 1594 1534 627 Charter Communications 7545 1554 301 85 TPG Internet Pty Ltd 10620 1549 284 162 TVCABLE BOGOTA 17974 1543 456 45 PT TELEKOMUNIKASI INDONESIA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 1785 1805 1684 PaeTec Communications, Inc. 18566 1913 1672 Covad Communications 4766 2469 1532 Korea Telecom (KIX) 17974 1543 1498 PT TELEKOMUNIKASI INDONESIA 7545 1554 1469 TPG Internet Pty Ltd 10620 1549 1387 TVCABLE BOGOTA 23456 2910 1351 32-bit ASN transition 4755 1505 1335 TATA Communications formerly 7552 1283 1276 Vietel Corporation 22773 1351 1263 Cox Communications, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 4323 Time Warner Telecom 32567 UNALLOCATED 12.25.107.0/24 4323 Time Warner Telecom 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.155.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.225.128.0/18 36377 Comcast Telecommunications, I 24.225.192.0/23 36377 Comcast Telecommunications, I 24.225.192.0/18 36377 Comcast Telecommunications, I 24.225.224.0/21 36377 Comcast Telecommunications, I 24.225.237.0/24 36377 Comcast Telecommunications, I 24.225.248.0/21 36377 Comcast Telecommunications, I 41.223.92.0/22 36936 >>UNKNOWN<< 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 62.61.221.0/24 24974 Tachyon Europe BV - Wireless 64.21.192.0/20 11610 Internet Nebraska Corporation Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:20 /9:12 /10:26 /11:80 /12:232 /13:464 /14:795 /15:1396 /16:12005 /17:5876 /18:9821 /19:19496 /20:26056 /21:26209 /22:34865 /23:33683 /24:189377 /25:1057 /26:1247 /27:720 /28:198 /29:9 /30:2 /31:0 /32:6 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2216 3599 bellsouth.net, inc. 18566 1869 1913 Covad Communications 10620 1444 1549 TVCABLE BOGOTA 23456 1423 2910 32-bit ASN transition 11492 1097 1143 Cable One 7011 1056 1158 Citizens Utilities 6478 1055 1084 AT&T Worldnet Services 1785 1053 1805 PaeTec Communications, Inc. 7029 1038 1291 Windstream Communications Inc 22773 865 1351 Cox Communications, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:328 2:44 4:16 5:1 6:3 8:338 12:1967 13:1 14:488 15:15 16:3 17:5 20:10 23:14 24:1679 27:824 31:502 32:64 33:4 34:2 36:4 38:745 40:104 41:2562 42:32 44:3 46:1037 47:3 49:201 50:471 52:13 54:2 55:4 56:2 57:35 58:863 59:479 60:386 61:1123 62:1033 63:1932 64:3954 65:2300 66:3889 67:1872 68:1103 69:3044 70:756 71:389 72:1888 74:2386 75:318 76:341 77:887 78:710 79:457 80:1116 81:840 82:499 83:454 84:691 85:1063 86:523 87:764 88:336 89:1534 90:224 91:3959 92:522 93:1050 94:1337 95:858 96:414 97:260 98:891 99:37 101:77 103:143 106:10 107:22 108:70 109:1022 110:607 111:712 112:305 113:406 114:552 115:686 116:978 117:689 118:832 119:1164 120:313 121:677 122:1608 123:979 124:1300 125:1277 128:245 129:171 130:169 131:575 132:111 133:21 134:213 135:48 136:216 137:137 138:297 139:116 140:482 141:244 142:403 143:416 144:483 145:55 146:452 147:211 148:680 149:248 150:160 151:189 152:342 153:182 154:4 155:397 156:198 157:323 158:138 159:454 160:311 161:202 162:309 163:164 164:499 165:366 166:529 167:433 168:734 169:153 170:847 171:78 172:1 173:1619 174:609 175:375 176:142 177:171 178:1005 180:898 181:23 182:492 183:231 184:344 185:1 186:1284 187:732 188:895 189:939 190:4979 192:5900 193:4975 194:3527 195:3029 196:1238 197:43 198:3581 199:3975 200:5561 201:1492 202:8416 203:8428 204:4235 205:2327 206:2668 207:2811 208:3969 209:3447 210:2693 211:1451 212:2100 213:1737 214:778 215:69 216:4936 217:1633 218:543 219:351 220:1231 221:496 222:337 223:218 End of report

1 0

BGP Design question.
by Bret Palsson 15 Jul '11

15 Jul '11

Here is my current setup in ASCII art. (Please view in a fixed width font.) Below the art I'll write out the setup. +--------+ +--------+ | Peer A | | Peer A | <-Many carriers. Using 1 carrier +---+----+ +----+---+ for this scenario. |eBGP | eBGP | | +---+----+iBGP+----+---+ | Router +----+ Router | <-Netiron CERs Routers. +-+------+ +------+-+ |A `.P A.' |P <-A/P indicates Active/Passive | `. .' | link. | :: | +-+------+' `+------+-+ |Act. FW | |Pas. FW | <-Firewalls Active/Passive. +--------+ +--------+ To keep this scenario simple, I'm multihoming to one carrier. I have two Netiron CERs. Each have a eBGP connection to the same peer. The CERs have an iBGP connection to each other. That works all fine and dandy. Feel free to comment, however if you think there is a better way to do this. Here comes the tricky part. I have two firewalls in an Active/Passive setup. When one fails the other is configured exactly the same and picks up where the other left off. (Yes, all the sessions etc. are actively mirrored between the devices) I am using OSPFv2 between the CERs and the Firewalls. Failover works just fine, however when I fail an OSPF link that has the active default route, ingress traffic still routes fine and dandy, but egress traffic doesn't. Both Netiron's OSPF are setup to advertise they are the default route. What I'm wondering is, if OSPF is the right solution for this. How do others solve this problem? Thanks, Bret Note: Since lately ipv6 has been a hot topic, I'll state that after we get the BGP all figured out and working properly, ipv6 is our next project. :)

14 24

NANOG - Call for Volunteers
by Michael K. Smith - Adhost 14 Jul '11

14 Jul '11

Hello All: Given the issues we had with the mailing list transition, we would like to solicit volunteers to assist in testing the "new" configuration. Please note, we are just moving the existing Mailman configuration to a new server under our control, but we have to move the list due to contractual obligations. Here's the basic scenario. 1) Build replica of existing NANOG Mailman server and configuration, except we are updating all of the underlying applications, including the actual OS. 2) Create a test(a)mailtest.nanog.org mailing list 3) Have volunteers hammer the list and make sure the software setup is correct 4) Sync the existing list data to the new server 5) Flip DNS so that nanog(a)nanog.org is now served from the new server If you are available and willing to assist in this test, please send me an email directly with the address you would like to use. I will add you to the new list when the software is configured and you will receive the usual welcome message. Our timeline is tight for this transition; we have to be moved over to the new server no later than July 31st, so active testing and reporting is key. Thank You, Mike -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

1 0

Re: NANOG List Update - Moving Forward
by Mattias Ahnberg 14 Jul '11

14 Jul '11

On 2011-07-12 07:19, Michael K. Smith - Adhost wrote: > If you have any questions or concerns please let me know. I miss proper List-Id headers for identifying and filtering the list easily. I might have missed some discussion; but why are we moving away from mailman, and what software is in the new system? -- /ahnberg.

4 4

Re: NANOG List Update - Moving Forward
by Steve Feldman 13 Jul '11

13 Jul '11

We're aware of the spam problem and have our top people working on it. Reports of other lingering issues from the change would be appreciated, though. Thanks, Steve On Jul 12, 2011, at 5:03 AM, jim deleskie wrote: > +1 > > On Tue, Jul 12, 2011 at 8:32 AM, William Pitcock > <nenolod(a)systeminplace.net> wrote: >> On Tue, 12 Jul 2011 10:50:38 +0100 (BST) >> Tim Franklin <tim(a)pelican.org> wrote: >> >>>> Thankfully, the current test has been a success. >>> >>> Including stopping non-members from posting to the list, and other >>> anti-spam? >>> >>> I've got a sudden influx this morning of spam addressed to >>> nanog(a)nanog.org :( >>> >> >> Ditto. Getting lots of crap here. >> >> William >> >

9 11

ipv6 address family with vrf
by harbor235 13 Jul '11

13 Jul '11

Has anyone been able to configure ipv4 and ipv6 AFI with VRF instances simultaneously? Using the 7200 and 12.4(25e), under the ipv6 address family the VRF sub commands are not visible, must be a feature? thanx in advance, Mike

4 4

Answer to: Hello List Easy Cisco question.
by bill＠kruchas.com 13 Jul '11

13 Jul '11

Hello, and thanks for all the help. What the issue boiled down to, I was creating the access list just like the static command. Which means I was using the source and destination ports when creating it. You just need the destination port, actually because the firewall "catches" the packet on a different port and un encapsulates the packet and passes it through. The different port was causing the accesslist to reject the packet. so this is what I had: >access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 This is what worked :) >access-list Etherpoint_access_in extended permit tcp any host outside-ip eq 5900 A complete example if anyone who needs it to route external request to an internal host: * access list to permit traffic in access-list Etherpoint_access_in extended permit tcp any host outside-ip eq 5900 *static command to setup the relationship form outside interface to inside host static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 * command to bind the accesslist to the outside interface access-group Etherpoint_access_in in interface Etherpoint Thanks again list Bill Kruchas Below is the full question and details. ***************************************************************** Hello List, First let me say I'm not a heads down network guy, but I have setup several cisco firewalls from pix's some 831's, and now I'm trying to get a asa 5505 configured. ver 7.2 and 5.2 on the ASDM. This has been in and working for some time, granting outbound access. There is only one external useable ip address so everything is using PAT to get out, (although whoever set it up set it up like a nat with a global address pool). I have been trying to get an inbound static command to work, with no luck. First I wonder if I can do a static mapping for ingress on the same IP that is being used for PAT/NAT for egress. And if that is possible why can't I get through, I'm pretty sure the static command is right, and I needed to add two acl's (any to outside) (outside to inside) to get the packet trace in asdm to let the packet into the inside host, but still the translate isn't passing the packet tracing. Please any insight would be greatly appreciated. The log shows the port coming in as something different than what I expect: the 66.152.132.32/1064 should be 66.152.132.32/5900 (for vnc, which is the client I am testing with). These are the lines from the log: >4 Jul 12 2011 11:27:13 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0] >4 Jul 12 2011 11:27:07 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0] >4 Jul 12 2011 11:27:04 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by These are the appropriate lines from the config: >access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 >access-list Etherpoint_access_in extended permit tcp host outside-ip eq 5900 host 192.168.125.8 eq 5900 >global (Etherpoint) 2 interface >nat (Inside) 0 access-list Inside_nat0_outbound >nat (Inside) 2 192.168.125.0 255.255.255.0 >static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 >no threat-detection statistics tcp-intercept >access-group Inside_access_in in interface Inside >access-group Etherpoint_access_in in interface Etherpoint Thanks In Advance Bill Kruchas

1 0

Re: NANOG List Update - Moving Forward
by Robert Bonomi 13 Jul '11

13 Jul '11

Cc: nanog(a)nanog.org.r-bonomi.com In-Reply-To: <1BE304A1-0DA0-4558-83AD-0E4F08F8146D(a)twincreeks.net> > Subject: Re: NANOG List Update - Moving Forward > From: Steve Feldman <feldman(a)twincreeks.net> > Date: Tue, 12 Jul 2011 07:00:51 -0700 > > We're aware of the spam problem and have our top people working on it. > > Reports of other lingering issues from the change would be appreciated, > though. You asked for it, you got it: 1) You broke *all* the mailing-list support addresses. 'nanog-owner' ,etc. *BOUNCE* "user unknown" see mark's inbox for a smoking gun 2) You let non-members post to the list. see mark's inbox for a smoking gun 3) You broke the mailing-list *submission* address itself, for subscribers. Although you let non-member *SPAM* through. 4) You have dropped _all_ the the received lines _before_ the message gets to the list. see mark's inbox for a smoking gun -- one of the spam messages 5) You are *NOT* using 'custom 'From ' lines, meaning you cannot tell who the subscriber is when a forwarded message bounces. see mark's inbox for a smoking gun -- one of the spam messages 6) You dropped *ALL* the list-management info headers. see mark's inbox for a smoking gun -- one of the spam messages 7) You rolled changes out with _NOBODY_AROUND_ to take complaints from users who noticed problems. 8) You are mailing to "undisclosed recipients". This indicates "less than competent", *lazy*, mailing-list management practices. AND making it impossible for the recipient to determine _what_ e-mail address the message was actually sent to, *if* for instance they need to change their subscription information on a 'forwarded' (or worse, _multiply-forwarded_) subscription address. see mark's inbox for a smoking gun -- one of the spam messages 9) Others report you lost some, if not all, of the established mailing 'preferences' for subscribers. *AND* all this was on the *second* attempt, having already utterly botched the first one. Reports were being sent to Mark's email (he who posted the announcement, the 'test' and the notice saying things were 'apparently working') roughly 2-1/2 hours after the -first- problem surfaced. SIX hours later the problem was still occuring. "Asleep at the switch" would seem to apply. Considering =ALL= of the above the statement that you have your "top people" working on the matter is not in the least reasurring. One *also* has to "wonder" -- considering all the other things that were 'lost', if the existing suppression filters -- specifically those which keep 'banned' traffic off the list -- were *also* 'lost'. One _really_ has to wonder "why" things are being moved off a tested, reliable, and fully reliable platform, to an "obviously" flawed implementation. Methinks the decision-makers owe the list subscribers _some_ explanation with regard to the 'advantages' to be gained by this migration, and why it is necessary.

4 4

NANOG Updates - Important
by Michael K. Smith - Adhost 13 Jul '11

13 Jul '11

Thank you for your patience as we moved forward with our NANOG transition. We are excited to announce the opening of NANOG 53 registration. You will notice a new format and the need to create a user id and password to complete your registration. We are confident you will find the new system very intuitive and helpful as we continue to move forward. As always, there are opportunities to improve. Feel free to send any questions, suggestions, or concerns to nanog-support(a)nanog.org With respect to NANOG list services. The NANOG Board has decided not to move forward with the mail list and archive transition from Mailman to ARO at this time. For the time being we are operating on our existing hardware in Ann Arbor, MI. We will however, be preparing for a move to an alternate site. As we confirm further details we will be sure to send them along to you. Again, if you have any questions, suggestions, or concerns please send them to nanog-support(a)nanog.org. Sincerely, Michael K. Smith NANOG CC Chair

1 0

using NESSUS to prepare for PenTest Sec. Audit
by Mike Gatti 12 Jul '11

12 Jul '11

Has anyone used Nessus PF (www.nessus.org) as a tool to run a self audit preparing for a PenTest Audit? I wanted to get your opinion on the tool and if it was useful preparing for a PenTest Audit? Thanks, -- Michael Gatti cell.949.735.5612 ekim.ittag(a)gmail.com (UTC-8)

2 1