April 2012 - Test - lists.nanog.org

Colo recommendations for 2001 6th (Westin BLDG) Seattle
by Eric Morin 30 Apr '12

30 Apr '12

Hi I am looking for a few RUs / ¼ rack (~20Amps of VAC) in a carrier neutral location with 24x365 smart hands service at 2001 6th Ave in Seattle. Any recommendations? Thanks in advance Eric RR Morin Internetwork Designer IP Network Engineering & Carrier Relations XplorNet Communications Inc AS22995 506.324.4533 | eric.morin(a)corp.xplornet.com NOTE: My email address has changed! 864 Anderson Dr | Saint John, New Brunswick | Canada E2M 4G3 <http://www.4gsatellite.ca/> This e-mail (including any attachments) is for the sole use of the intended recipient and may contain confidential information protected by duties of confidentiality or privilege. If you are not the intended recipient of this e-mail, please immediately notify us by return e-mail or by telephone, delete this e-mail and destroy any copies. Thank you. ________________________________________________________________________________ Ce message est destiné uniquement à la personne prévue et peut contenir des renseignements confidentiels et/ou privilégiés au titre dune obligation de confidentialité. Si vous n'êtes pas le destinataire visé, veuillez nous en informer sans délai par courriel ou téléphone et détruire ce message ainsi que toute pièce jointe, sans en garder de copie. Merci.

3 2

Re: rpki vs. secure dns?
by Brandon Butterworth 30 Apr '12

30 Apr '12

> Reality check: I don't know that this is all that important, in the end. > So long as you can use an IGP locally with a default route to reach a > copy of the database, whether it be based on DNS, an RPKI, or anything > else, then you can bootstrap your EGP routing. If everything goes down > at the same time, then you would just start rebuilding from the places > where the root servers live, no matter what system's root servers we're > talking about. or you wait for the Elders of the Internet to visit with blessings http://www.youtube.com/watch?v=iDbyYGrswtg brandon

2 1

Re: rpki vs. secure dns?
by Stephane Bortzmeyer 29 Apr '12

29 Apr '12

On Sun, Apr 29, 2012 at 11:28:58AM -0400, Jennifer Rexford <jrex(a)CS.Princeton.EDU> wrote a message of 37 lines which said: > How does this interact with the presence of certificates for > supernets, though? That is, suppose an ISP creates a legitimate ROA > for 12.0.0.0/8, after ensuring that all of its customers have > legitimate ROAs for the various subnets of 12.0.0.0/8. Now, suppose > one of these customers has its legitimate ROA revoked by a court > order. Would the legitimate announcement of that subnet (originated > by the customer's ASN) still result in UNKNOWN status, or would it > look like a sub-prefix hijack because the announcement has a > different ASN than the matching 12.0.0.0/8 prefix? The second (and therefore Alex Band's example is not good). But it depends on the value of the MaxLength attribute in the 12.0.0.0/8 ROA (section 3.3 of RFC 6482). If, in the future, RIRs or operators create ROAs for all the blocks they manage, revocation of a ROA will be deadly.

2 1

Re: rpki vs. secure dns?
by Brandon Butterworth 29 Apr '12

29 Apr '12

> Thus, removing a certificate or ROA *does NOT* result in an RPKI INVALID > route announcement; the result is RPKI UNKNOWN. Which is fine until UNKNOWNs are no longer permitted, a logical next step. It may not apply globally, initially perhaps just a US anti terrorist measure requiring all networks in the USA do it. > The only way a court order could make a route announcement get the > RPKI status *INVALID* would be to: > 1: Remove the original, legitimate ROA > 2: Tamper with the Registry, inject a false ROA authorizing another > AS to make the announcement look like a hijack Domains already get FBI hijacked so this seems plausible too. > All in all, for an RPKI-specific court order to be effective in > taking a network offline, the RIR would have to tamper with the > registry, inject false data and try to make sure it's not detected so > nobody applies a local override. Doesn't need to be undetected, more likely it'll be quite overt and have a big don't mess FBI entry in the RIR similar to www.megaupload.com brandon

1 0

Juniper MX960 with SCB-E vs Cisco ASR9k with RSP400
by Abdelkader Chikh Daho 29 Apr '12

29 Apr '12

Hi everyone, I wan to ask for your feedback about these two devices : Juniper MX960 with SCB-E and Cisco AS9k with RSP400. Best regards, -- Abdelkader Chikh Daho Network Architect iWeb Technologies Email : achikhdaho(a)iweb.com Web : www.iweb.com Tel : 514-286-4242 ext 2309

2 1

Need spamcop/ironport security contact
by Mike 28 Apr '12

28 Apr '12

I have a security incident to report and need to make contact with a senior level contact responsible for spamcop/ironport immediately. Thank you.

3 2

Re: Need spamcop/ironport security contact
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Fri, Apr 27, 2012 at 11:41:57PM -0400, Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> wrote a message of 33 lines which said: > > I have a security incident to report and need to make contact with > > a senior level contact responsible for spamcop/ironport > > immediately. > > And you need a *senior* level contact, why? He probably meant "someone who has seen an IP address before", not level1-support.

2 1

Re: rpki vs. secure dns?
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Sat, Apr 28, 2012 at 12:34:52PM +0200, Alex Band <alexb(a)ripe.net> wrote a message of 41 lines which said: > In reality, since the RIRs launched an RPKI production service on 1 > Jan 2011, adoption has been incredibly good (for example compared to > IPv6 and DNSSEC). More than 1500 ISPs and large organizations > world-wide have opted-in to the system and requested a resource > certificate using the hosted service, or running an open source > package with their own CA. I have an experience with the deployment of DNSSEC and the problem with DNSSEC was not to have signed zones (many are, now) but to have people *using* these signatures to check the data (i.e. validating in a resolver). RPKI has many ROA (signed objects) but how many operators validate routes on their production routers? Zero? > But it's not just that, these ISPs didn't just blindly get > certificate and walk away. Most of the ROAs are very recent. Again, the experience with DNSSEC shows that starting is easy ("DNSSEC in siw minutes"). It's long term management which is *the* problem. Wait until people start to change the routing data and watch the ROAs becoming less and less correct... > Data quality is really good. It's not what you said: "It is safe to say that overall data quality is pretty bad" <https://labs.ripe.net/Members/AlexBand/resource-certification-rpki-in-the-r…> (good paper, by the way, thanks)

2 1

Re: rpki vs. secure dns?
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Sat, Apr 28, 2012 at 01:17:10PM +0300, Saku Ytti <saku(a)ytti.fi> wrote a message of 27 lines which said: > I think ROVER is better solution, doesn't need any changes to BGP > just little software magic when accepting routes. I like Rover but RPKI+ROA does not change BGP either (it will be a different story with BGPsec). > People might scared to rely on DNS on accepting routes, but is this > really an issue? RPKI+ROA depends on DNS too, since rsync://rpki.ripe.net/repository will work only if DNS works. Not a problem in practice, since route origins do not change every minute and the validating ROA cache can work even if it can no longer update its data. Same thing with Rover: temporary glitches in the DNS are not a practical problem (the router keeps the old info). > routes which fail authorization are logged but accepted if there > wasn't pre-existing covering route. Only drop routes if they fail > authorization _AND_ there is pre-existing covering route. It is a bit more complicated: more-specific attacks, and so on. But, yes, you're right. As Alex Band says, Rover, RPKI and the IRR make (authenticated) statements about route origins. You then do what you want (what your boss wants? what the FBI wants?) with these statements (route-map, etc).

1 0

New IETF I-D: Security Implications of IPv6 on IPv4 networks
by Fernando Gont 28 Apr '12

28 Apr '12

Folks, We've published a new IETF I-D entitled "Security Implications of IPv6 on IPv4 networks". The I-D is available at: <http://www.ietf.org/id/draft-gont-opsec-ipv6-implications-on-ipv4-nets-00.t…> The Abstract of the I-D is: ---- cut here ---- This document discusses the security implications of native IPv6 support and IPv6 transition/co-existence technologies on "IPv4-only" networks, and describes possible mitigations for the aforementioned issues. ---- cut here ---- Any feedback will be very welcome. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 1