November 2012 - Test - lists.nanog.org

APRICOT 2013 in Singapore
by Philip Smith 15 Nov '12

15 Nov '12

Hi everyone, Just to let you know that the call for papers for APRICOT 2013 (in Singapore next February) opened a few days ago. Rather than posting the whole cfp here, you can see it via the programme page on the APRICOT website - www.apricot2013.net/program. NANOG and APRICOT are the network operations conferences for adjacent regions - and indeed both regions have considerable overlap and interests in common. Please give some thought to presenting something topical at APRICOT - the Programme Committee would love to hear from you. You can submit your proposal via http://papers.apricot.net. Thanks! philip (on behalf of the APRICOT PC) --

1 0

Ethernet NID plus POE+ (802.3at)... or POE+ injector with OAM...
by Robert E. Seastrom 14 Nov '12

14 Nov '12

Hi everyone, I'm looking for a gigabit ethernet media converter to go from SFP plugable optics to 802.3at POE+. The application involves wireless access points some distance from a central switch for a venue. Difficulty: in my old age, I've become allergic to installing completely unmanaged bump-in-the-wire devices that can't be monitored in some way. They make for a big nuisance when it comes time to debug the installation. The metro ethernet folks have brought us 802.1ag, 802.3ah, and Y.1731. Even the simplest of these - .1ag L2 ping (LBM/LBR) - is sufficient for my purposes of making sure that we're bidirectionally passing traffic. I'm aware of pluggable optics that do OAM (OEsolution Smart SFP) as well as some piggyback devices from other sources. I'd like to find a single box though that will do my media conversion, POE+ injection, and response to OAM packets all in one convenient tiny enclosure. Bonus points for well-thought-out details such as DIN rail mounting capability and cable retention tricks. Anyone got any pointers? -f

2 1

DHCPv6 and MAC addresses
by Ray Soucy 14 Nov '12

14 Nov '12

Saw yet another attempt at a solution pop up to try and deal with the lack of a MAC address in DHCPv6 messages. I've been giving this some thought about how this should be best accomplished without requiring that host implementations of DHCPv6 be modified. Taking advantage of the relay-agent seems to be the most elegant solution: 1) Any DHCPv6 server on a local segment will already have access to the MAC address; but having a DHCPv6 server on each segment is not ideal. 2) Requests that are relayed flow through a relay-agent, which is on a device that also has access to the MAC address of the client system. Option A: RFC 6422 provides for Realy-Supplied DHCP Options, currently with one option code registered with IANA (OPTION_ERP_LOCAL_DOMAIN_NAME). You can see the list here: http://www.iana.org/assignments/dhcpv6-parameters/dhcpv6-parameters.xml I think the quickest solution would be: 1) Adding an RSOO for the client MAC address 2) Get vendors on board to draft and adopt a standard for it on routers, 3) Modify DHCPv6 servers to have support for MAC identification based on the MAC of the local request OR the MAC of the relayed request when the option is present. Option B: The current RELAY-FORW message already includes the link-local address of the client. Perhaps there should be a modification to the privacy extensions RFC to forbid the use of privacy addressing on the link-local scope; at this point we could modify DHCPv6 servers to be able to determine the MAC address for relayed requests based on their link-local address. Unfortunately, the cat is out of the bag on this one, so it would take time to get host implementations modified. I might be overlooking something critical... thoughts? -- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

2 2

dhcpy6d - a MAC address aware DHCPv6 server
by Henri Wahl 14 Nov '12

14 Nov '12

Hello World, like other people we had the problem that existing DHCPv6 servers do not evaluate the MAC address of clients, following RFC 3315. The IPv4 clients already are managed via their MAC addresses so we wanted to use these identifiers for IPv6 too for our dualstack network. At the end we had to write our own DHCPv6 server dhcpy6d which I want to present here to a larger audience. It runs on Linux, tested on Debian and CentOS. It gets the client MAC addresses from neighbor cache by calling "ip -6 neigh" and caches them itself, allowing to access the already working MAC-based IPv4 infrastructure. This obviously only works on the local subnet but might be worked around with several servers being connected via database storage of clients and leases. Features are: - identifies clients by MAC address, DUID or hostname - generates addresses randomly, by MAC address, by range or by given ID - filters clients by MAC, DUID or hostname - assignes more than one address per client - allows to organize clients in different classes - stores leases in MySQL or SQLite database - client information can be retrieved from database or textfile - dynamically updates DNS (Bind) We run it with ~500 clients without problems. I am interested if it would run in larger environments too. If not, how to make it running. Bugs and ideas how to improve it are welcome too. Packages are not yet available but the Python code should run as is. See further details at http://dhcpy6d.ifw-dresden.de Best regards Henri Wahl -- Henri Wahl IT Department Leibniz-Institut für Festkörper- u. Werkstoffforschung Dresden tel. (03 51) 46 59 - 797 email: h.wahl(a)ifw-dresden.de http://www.ifw-dresden.de Nagios status monitor for your desktop: http://nagstamon.ifw-dresden.de IFW Dresden e.V., Helmholtzstraße 20, D-01069 Dresden VR Dresden Nr. 1369 Vorstand: Prof. Dr. Ludwig Schultz, Dr. h.c. Dipl.-Finw. Rolf Pfrengle

6 8

RE: What is BCP re De-Aggregation: strict filtering /48s out of /32 RIR minimums.
by Ben S. Butler 14 Nov '12

14 Nov '12

Hi, Yes, but a multi-homing customer would have PI space from an appropriately filtered block allowing /24 PI v4 or /48 PI v6. An ISP would have their own RIR PA allocation /22 to /19 v4 or /29, /32 v6 block that are from blocks that follow along the lines of minimum assignment size for that block. This is not a problem created by the registries or by the filters. The problem comes with ASes that don’t have a backbone interconnecting all of their POPs / islands and are therefore unable to add a covering route and do not provide a route via any transit provide for the whole ip block at the RIR minimum boundary. In some ways whether people should: 1> Have a network of none interconnected islands that take IP space from the same IP block below RIR minimum? 2> Should we filter these networks? 3> Should the /32 be visible in the route table somewhere if the intention that component /48s are going to be visible on the Internet. I don’t like the IRR answer particularly as it requires a level of third party trust that I am not entirely comfortable with, nor configuring separate filters for each BGP peering session. Ben From: Suresh Ramasubramanian [mailto:ops.lists@gmail.com] Sent: 14 November 2012 13:25 To: Ben S. Butler Cc: NANOG Subject: Re: What is BCP re De-Aggregation: strict filtering /48s out of /32 RIR minimums. On Wed, Nov 14, 2012 at 6:40 PM, Ben S. Butler <Ben.Butler(a)c2internet.net<mailto:Ben.Butler@c2internet.net>> wrote: 3> Don't use filters, generate it from an IRR? Given there is no "right" answer what is considered to be the best fit one? This sounds like your best bet. Assuming you can find an IRR with comprehensive enough coverage. The other option is of course "don't filter based solely on RIR minimum assignments" .. I know at least some ISPs (like swisscom) do this for v4 too, but that simply means people who try to multihome with anything less than a /19 in level3 land aren't going to succeed. http://v-authoring.ip-plus.net/documents/BIS_TI_Router_Filter_Policy_EN.pdf ip prefix-list martians seq 8000 permit 8.0.0.0/7<http://8.0.0.0/7> le 19 [etc] Not so much of a problem in v4 but as you saw for yourself, you risk not seeing prefixes at all if you try this. -- Suresh Ramasubramanian (ops.lists(a)gmail.com<mailto:ops.lists@gmail.com>)

1 0

High CPU utilization w/VRF NAT - Cat6500
by Rodrick Brown 13 Nov '12

13 Nov '12

~80 or so static NAT's configured, multiple versions of IOS tested. Most of the traffic is being punted to the CPU through the NAT interfaces causing high CPU utilization. Increasing fast aging timers had 0 benefit, TCAM utilization is less than 5% Does anyone have any thoughts on other configuration tweaks I should try? I think we're at the point where new hardware maybe FWSM or another platform for NAT should be explored. --RB

3 2

Cisco IT class on groupon!?
by JC Dill 13 Nov '12

13 Nov '12

http://www.groupon.com/deals/g1mm-it-university-online-san-jose-ca "$99 for a Complete Cisco Network Training Bundle ($3,295 Value) The Complete Cisco Network Training Bundle includes five training courses designed to provide the skills needed for the CCNA and CCNP suite of certifications. Each bundle includes instructor-led training, hands-on exercises, multimedia presentations, and exam simulators."

4 3

Re: dhcpy6d - a MAC address aware DHCPv6 server
by Henri Wahl 13 Nov '12

13 Nov '12

Hi Owen, > |ioctl(sock, SIOCGIFADDR, &ifr)| > > Shouldn't that do the trick? I don't know if Python can do that or not, but if it can't, that's pretty weak. > > As far as I was able to find out this only gives back the local MAC address which is of no use here. To be independent of external call I at least for Linux managed to access neighbor cache via netlink socket as the "ip" command itself does. Thus no external call is necessary anymore. Regards Henri -- Henri Wahl IT Department Leibniz-Institut für Festkörper- u. Werkstoffforschung Dresden tel. (03 51) 46 59 - 797 email: h.wahl(a)ifw-dresden.de http://www.ifw-dresden.de http://nagstamon.ifw-dresden.de http://dhcpy6d.ifw-dresden.de IFW Dresden e.V., Helmholtzstraße 20, D-01069 Dresden VR Dresden Nr. 1369 Vorstand: Prof. Dr. Ludwig Schultz, Dr. h.c. Dipl.-Finw. Rolf Pfrengle

1 0

Verizon wireless (cdma/LTE) compatible ethernet connectable OOB access device.
by Eric J Esslinger 13 Nov '12

13 Nov '12

We have Verizon Wireless as our provider of choice for our company, and I've convinced those who are they that I need a completely OOB method for getting back in the NOC, as we don't have a full time NOC staff and internet coverage can be spotty around here in general, as we're a small town. The people who need the OOB management access are getting 4G Myfi devices with static IP addresses. What I need at our NOC is a 3 or 4G (our area only has 3G atm) Verizon compatible device with an wired ethernet link. I'm looking at several but wondered if anyone has any familiarity with such units. I just need a basic wwan-ethernet modem/bridge, I will be handling vpn termination, firewalling, access control, and such with my existing firewall. Off-list is fine. __________________________ Eric Esslinger Information Services Manager - Fayetteville Public Utilities http://www.fpu-tn.com/ (931)433-1522 ext 165 This message may contain confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.

5 4

Whats so difficult about ISSU
by Kasper Adel 12 Nov '12

12 Nov '12

Hello, We've been hearing about ISSU for so many years and i didnt hear that any vendor was able to achieve it yet. What is the technical reason behind that? If i understand correctly, the way it will be done would be simply to have extra ASICs/HW to be able to build dual circuits accessing the same memory, and gracefully switch from one to another. Is that right? Thanks, Kim

23 45