July 2011 - Test - lists.nanog.org

BGP Design question.
by Bret Palsson 15 Jul '11

15 Jul '11

Here is my current setup in ASCII art. (Please view in a fixed width font.) Below the art I'll write out the setup. +--------+ +--------+ | Peer A | | Peer A | <-Many carriers. Using 1 carrier +---+----+ +----+---+ for this scenario. |eBGP | eBGP | | +---+----+iBGP+----+---+ | Router +----+ Router | <-Netiron CERs Routers. +-+------+ +------+-+ |A `.P A.' |P <-A/P indicates Active/Passive | `. .' | link. | :: | +-+------+' `+------+-+ |Act. FW | |Pas. FW | <-Firewalls Active/Passive. +--------+ +--------+ To keep this scenario simple, I'm multihoming to one carrier. I have two Netiron CERs. Each have a eBGP connection to the same peer. The CERs have an iBGP connection to each other. That works all fine and dandy. Feel free to comment, however if you think there is a better way to do this. Here comes the tricky part. I have two firewalls in an Active/Passive setup. When one fails the other is configured exactly the same and picks up where the other left off. (Yes, all the sessions etc. are actively mirrored between the devices) I am using OSPFv2 between the CERs and the Firewalls. Failover works just fine, however when I fail an OSPF link that has the active default route, ingress traffic still routes fine and dandy, but egress traffic doesn't. Both Netiron's OSPF are setup to advertise they are the default route. What I'm wondering is, if OSPF is the right solution for this. How do others solve this problem? Thanks, Bret Note: Since lately ipv6 has been a hot topic, I'll state that after we get the BGP all figured out and working properly, ipv6 is our next project. :)

14 24

NANOG - Call for Volunteers
by Michael K. Smith - Adhost 14 Jul '11

14 Jul '11

Hello All: Given the issues we had with the mailing list transition, we would like to solicit volunteers to assist in testing the "new" configuration. Please note, we are just moving the existing Mailman configuration to a new server under our control, but we have to move the list due to contractual obligations. Here's the basic scenario. 1) Build replica of existing NANOG Mailman server and configuration, except we are updating all of the underlying applications, including the actual OS. 2) Create a test(a)mailtest.nanog.org mailing list 3) Have volunteers hammer the list and make sure the software setup is correct 4) Sync the existing list data to the new server 5) Flip DNS so that nanog(a)nanog.org is now served from the new server If you are available and willing to assist in this test, please send me an email directly with the address you would like to use. I will add you to the new list when the software is configured and you will receive the usual welcome message. Our timeline is tight for this transition; we have to be moved over to the new server no later than July 31st, so active testing and reporting is key. Thank You, Mike -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

1 0

Re: NANOG List Update - Moving Forward
by Mattias Ahnberg 14 Jul '11

14 Jul '11

On 2011-07-12 07:19, Michael K. Smith - Adhost wrote: > If you have any questions or concerns please let me know. I miss proper List-Id headers for identifying and filtering the list easily. I might have missed some discussion; but why are we moving away from mailman, and what software is in the new system? -- /ahnberg.

4 4

Re: NANOG List Update - Moving Forward
by Steve Feldman 13 Jul '11

13 Jul '11

We're aware of the spam problem and have our top people working on it. Reports of other lingering issues from the change would be appreciated, though. Thanks, Steve On Jul 12, 2011, at 5:03 AM, jim deleskie wrote: > +1 > > On Tue, Jul 12, 2011 at 8:32 AM, William Pitcock > <nenolod(a)systeminplace.net> wrote: >> On Tue, 12 Jul 2011 10:50:38 +0100 (BST) >> Tim Franklin <tim(a)pelican.org> wrote: >> >>>> Thankfully, the current test has been a success. >>> >>> Including stopping non-members from posting to the list, and other >>> anti-spam? >>> >>> I've got a sudden influx this morning of spam addressed to >>> nanog(a)nanog.org :( >>> >> >> Ditto. Getting lots of crap here. >> >> William >> >

9 11

ipv6 address family with vrf
by harbor235 13 Jul '11

13 Jul '11

Has anyone been able to configure ipv4 and ipv6 AFI with VRF instances simultaneously? Using the 7200 and 12.4(25e), under the ipv6 address family the VRF sub commands are not visible, must be a feature? thanx in advance, Mike

4 4

Answer to: Hello List Easy Cisco question.
by bill＠kruchas.com 13 Jul '11

13 Jul '11

Hello, and thanks for all the help. What the issue boiled down to, I was creating the access list just like the static command. Which means I was using the source and destination ports when creating it. You just need the destination port, actually because the firewall "catches" the packet on a different port and un encapsulates the packet and passes it through. The different port was causing the accesslist to reject the packet. so this is what I had: >access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 This is what worked :) >access-list Etherpoint_access_in extended permit tcp any host outside-ip eq 5900 A complete example if anyone who needs it to route external request to an internal host: * access list to permit traffic in access-list Etherpoint_access_in extended permit tcp any host outside-ip eq 5900 *static command to setup the relationship form outside interface to inside host static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 * command to bind the accesslist to the outside interface access-group Etherpoint_access_in in interface Etherpoint Thanks again list Bill Kruchas Below is the full question and details. ***************************************************************** Hello List, First let me say I'm not a heads down network guy, but I have setup several cisco firewalls from pix's some 831's, and now I'm trying to get a asa 5505 configured. ver 7.2 and 5.2 on the ASDM. This has been in and working for some time, granting outbound access. There is only one external useable ip address so everything is using PAT to get out, (although whoever set it up set it up like a nat with a global address pool). I have been trying to get an inbound static command to work, with no luck. First I wonder if I can do a static mapping for ingress on the same IP that is being used for PAT/NAT for egress. And if that is possible why can't I get through, I'm pretty sure the static command is right, and I needed to add two acl's (any to outside) (outside to inside) to get the packet trace in asdm to let the packet into the inside host, but still the translate isn't passing the packet tracing. Please any insight would be greatly appreciated. The log shows the port coming in as something different than what I expect: the 66.152.132.32/1064 should be 66.152.132.32/5900 (for vnc, which is the client I am testing with). These are the lines from the log: >4 Jul 12 2011 11:27:13 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0] >4 Jul 12 2011 11:27:07 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0] >4 Jul 12 2011 11:27:04 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by These are the appropriate lines from the config: >access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 >access-list Etherpoint_access_in extended permit tcp host outside-ip eq 5900 host 192.168.125.8 eq 5900 >global (Etherpoint) 2 interface >nat (Inside) 0 access-list Inside_nat0_outbound >nat (Inside) 2 192.168.125.0 255.255.255.0 >static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 >no threat-detection statistics tcp-intercept >access-group Inside_access_in in interface Inside >access-group Etherpoint_access_in in interface Etherpoint Thanks In Advance Bill Kruchas

1 0

Re: NANOG List Update - Moving Forward
by Robert Bonomi 13 Jul '11

13 Jul '11

Cc: nanog(a)nanog.org.r-bonomi.com In-Reply-To: <1BE304A1-0DA0-4558-83AD-0E4F08F8146D(a)twincreeks.net> > Subject: Re: NANOG List Update - Moving Forward > From: Steve Feldman <feldman(a)twincreeks.net> > Date: Tue, 12 Jul 2011 07:00:51 -0700 > > We're aware of the spam problem and have our top people working on it. > > Reports of other lingering issues from the change would be appreciated, > though. You asked for it, you got it: 1) You broke *all* the mailing-list support addresses. 'nanog-owner' ,etc. *BOUNCE* "user unknown" see mark's inbox for a smoking gun 2) You let non-members post to the list. see mark's inbox for a smoking gun 3) You broke the mailing-list *submission* address itself, for subscribers. Although you let non-member *SPAM* through. 4) You have dropped _all_ the the received lines _before_ the message gets to the list. see mark's inbox for a smoking gun -- one of the spam messages 5) You are *NOT* using 'custom 'From ' lines, meaning you cannot tell who the subscriber is when a forwarded message bounces. see mark's inbox for a smoking gun -- one of the spam messages 6) You dropped *ALL* the list-management info headers. see mark's inbox for a smoking gun -- one of the spam messages 7) You rolled changes out with _NOBODY_AROUND_ to take complaints from users who noticed problems. 8) You are mailing to "undisclosed recipients". This indicates "less than competent", *lazy*, mailing-list management practices. AND making it impossible for the recipient to determine _what_ e-mail address the message was actually sent to, *if* for instance they need to change their subscription information on a 'forwarded' (or worse, _multiply-forwarded_) subscription address. see mark's inbox for a smoking gun -- one of the spam messages 9) Others report you lost some, if not all, of the established mailing 'preferences' for subscribers. *AND* all this was on the *second* attempt, having already utterly botched the first one. Reports were being sent to Mark's email (he who posted the announcement, the 'test' and the notice saying things were 'apparently working') roughly 2-1/2 hours after the -first- problem surfaced. SIX hours later the problem was still occuring. "Asleep at the switch" would seem to apply. Considering =ALL= of the above the statement that you have your "top people" working on the matter is not in the least reasurring. One *also* has to "wonder" -- considering all the other things that were 'lost', if the existing suppression filters -- specifically those which keep 'banned' traffic off the list -- were *also* 'lost'. One _really_ has to wonder "why" things are being moved off a tested, reliable, and fully reliable platform, to an "obviously" flawed implementation. Methinks the decision-makers owe the list subscribers _some_ explanation with regard to the 'advantages' to be gained by this migration, and why it is necessary.

4 4

NANOG Updates - Important
by Michael K. Smith - Adhost 12 Jul '11

12 Jul '11

Thank you for your patience as we moved forward with our NANOG transition. We are excited to announce the opening of NANOG 53 registration. You will notice a new format and the need to create a user id and password to complete your registration. We are confident you will find the new system very intuitive and helpful as we continue to move forward. As always, there are opportunities to improve. Feel free to send any questions, suggestions, or concerns to nanog-support(a)nanog.org With respect to NANOG list services. The NANOG Board has decided not to move forward with the mail list and archive transition from Mailman to ARO at this time. For the time being we are operating on our existing hardware in Ann Arbor, MI. We will however, be preparing for a move to an alternate site. As we confirm further details we will be sure to send them along to you. Again, if you have any questions, suggestions, or concerns please send them to nanog-support(a)nanog.org. Sincerely, Michael K. Smith NANOG CC Chair

1 0

using NESSUS to prepare for PenTest Sec. Audit
by Mike Gatti 12 Jul '11

12 Jul '11

Has anyone used Nessus PF (www.nessus.org) as a tool to run a self audit preparing for a PenTest Audit? I wanted to get your opinion on the tool and if it was useful preparing for a PenTest Audit? Thanks, -- Michael Gatti cell.949.735.5612 ekim.ittag(a)gmail.com (UTC-8)

2 1

ep.net contact?
by Chris Griffin 12 Jul '11

12 Jul '11

Could someone involved in ep.net contact me off list in regard to a DNS issue. Usual contact methods have failed to date. Thanks Chris --- Chris Griffin cgriffin(a)ufl.edu Sr. Network Engineer - CCNP Phone: (352) 273-1051 CNS - Network Services Fax: (352) 392-9440 University of Florida/FLR Gainesville, FL 32611

1 1