December 2013 - Test - lists.nanog.org

Re: [nznog] Web Servers: Dual-homing or DNAT/Port Forwarding?
by Larry Sheldon 11 Dec '13

11 Dec '13

On 12/11/2013 9:21 AM, Tim Franklin wrote: >> Just because something is public doesnÂ¹t mean you have to accept >> ALL traffic, it just means you have to anticipate any potential >> problems based on Larry knowing your address rather than imagining >> him standing at the front gate of your gated community. ;) (letÂ¹s >> torture that analogy!) > > There's still a gated community? I thought that particular piece of > routing joy was long gone... > > Sorry, I'll get my coat. Tim. I'm not sure that was an analogy--it was exploring the exact meanings of two words. In any case, I submit that an address behind a gate is not a "public address". But my point is, my address is in fact public, not behind any gates--displayed once on the post that supports the mail box, again inside the mailbox door for the mail person, and on a sign on the house next to the door. Which public display grants to no one any right of access to the interior of my house (indeed to no part of the property save the path from the street to the front door). Similarly, my IP address could be publicly visible but that does not grant any right of access to the equipment it attaches to. (I might leave my front door wide open--that STILL does not grant any RIGHT of access. It does depend on archaic notions of honest and regard for rights to keep people out.) I'm done. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

What routers do folks use these days?
by Jawaid Desktop 11 Dec '13

11 Dec '13

We're a service provider, and we have a network full of Cat6509's. We are finding that we are outgrowing them from the standpoint of their ability to handle lots of large routing tables. Obviously their switching capability is still superb but one of them with 20 peers is starting to groan a bit and RAM is going to be an issue soon. What do people use these days? Our backbone needs in the next 2-3 years are going to be sub-100Gbps. Jawaid

19 18

Re: BRAS
by Larry Sheldon 11 Dec '13

11 Dec '13

On 12/10/2013 8:21 AM, Nilesh Kahar wrote: > Which is a good BRAS product, to handle 15000 subscribers sessions with full QoS & other features? Victoria's Secret has some nice ones. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

6 5

BRAS
by Nilesh Kahar 11 Dec '13

11 Dec '13

Basically I am facing issues with MX80 LNS scenario. So just to make sure with community whether anyone is having similar problem. Also wanted to know about any other good BRAS product which can act fine for LNS - LAC setup. Thanks for all the responses. Nil.

3 2

RE: Contact for www.army.mil (AS1503 )
by Scott Weeks 11 Dec '13

11 Dec '13

-------- Original message -------- From: Christopher Morrell <christopher.morrell.nanog(a)gmail.com> We are currently having routing issues between one of our customers and www.army.mil<http://www.army.mil> which is originated from AS1503. Does anyone have a contact for AS1503? We've tried the ARIN contacts for AS1503 but have not received any response. --------------------------------------- --- wbailey(a)satelliteintelligencegroup.com wrote: From: Warren Bailey <wbailey(a)satelliteintelligencegroup.com> If memory serves me correctly army.mil is run by DISA. May get more traction with them. ------------------------------------------------------- That's like saying "call the federal government". :-) Poking around a bit I found: http://www.disa.mil/Services/Network-Services/Service-Support but I doubt you'll get very far there, either. nic.mil requires a CAC (www.cac.mil) and is only allowed access from certain IP address ranges AFAIK. scott

4 3

Routing asymetry and RPF check
by Jean Benoit 11 Dec '13

11 Dec '13

Hello, It's probably an old problem which was already debated here. We (130.79/16, AS2259) can't reach 143.104/16 (AS20252). Actually, all packets are dropped on their way back to our network. The probable cause is a conjunction of routing asymetry and uRPF check : - 143.104/16 is behind a US university network. Packets sent *from 143.104/16* to the rest of the Internet are going through National Lambda Rail (NLR), a US. research and education network, - but, as 143.104/16 does not belong to the university but to a hospital (the network has only a couple of hosts related to public research), this prefix is not announced to NLR. So packets from the Internet *to 143.104/16* go through the university commodity Internet link (a mix of different providers). Thus, there is a routing asymetry. - on the other side of the Atlantic, 130.79/16 is behind another research network, RENATER (AS2200). Renater is connected to GEANT, which federates mots of the European research and education networks. GEANT peers with NLR. So the path from 143.104/16 is : Hospital,University(20252),NLR(19401),GEANT(20965),RENATER(2200),Our site(2259) - when a packet arrives from 143.104/16 on a specific RENATER router in Geneva, geneve-rtr-021.noc.renater.fr, it is dropped. - On this router, geneve-rtr-021.noc.renater.fr, RENATER peers with GEANT. - RENATER lookings glass (https://portail.noc.renater.fr/lookingglass/v2/) tells me that the prefix 143.104/16 is not present in this router's routing table (this prefix is not learnt by NLR, and not learnt by GEANT). Moreover, this router seems not to have a full routing table. - On this router, unicast Reverse Path Forwarding check (unsure if it's strict or loose) is enabled on the interface between RENATER and GEANT (PortChannel4.160 to ae14.160 of rt1.gen.ch.geant.net or mx1.gen.ch.geant.net, see https://tools.geant.net/portal/links/lg/) The packets with source IP address 143.104/16 are dropped because the uRPF check fails. So, what do you think should be done ? Thanks for your advice, -- Jean Benoit University of Strasbourg

3 2

Re: [nznog] Web Servers: Dual-homing or DNAT/Port Forwarding?
by Larry Sheldon 11 Dec '13

11 Dec '13

On 12/10/2013 4:30 PM, Geraint Jones wrote: >>> Number 1 gets you thinking along the IPv6 route (no pun, and imho :) ) >>> since you have to treat each boxes as if it was public. >> >> I see this kind of statement surprisingly often. Having a public address >> doesn't make a device public. > > Yes it does, Glad to hear that. We (the family, 8 of us, and the 4 dogs will be arriving at your house, with its public address, in time for your Christmas dinner and we will be staying at least through your New Years eve party--maybe longer depending on the weather here. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

4 3

Re: Contact for www.army.mil (AS1503 )
by Christopher Morrell 11 Dec '13

11 Dec '13

Tried that. No response by email. I haven't tried that phone number yet. > On Dec 10, 2013, at 23:18, bmanning(a)vacation.karoshi.com wrote: > > > have you tried: > > DoD NIC Registry Services > DoD Network Information Center > 3990 East Broad Street > Columbus Ohio 43213 > United States > Email: disa.columbus.ns.mbx.nic-networks(a)mail.mil > Voice: (800)365-3642 > Fax: (614)692-3452 > > (always worked for me) > /bill > > >> On Tue, Dec 10, 2013 at 08:36:06PM -0500, Christopher Morrell wrote: >> Hi, >> >> We are currently having routing issues between one of our customers and >> www.army.mil which is originated from AS1503. >> >> Does anyone have a contact for AS1503? We've tried the ARIN contacts for >> AS1503 but have not received any response. >> >> Thanks, >> >> Chris >> Fibrenoire AS22652

1 0

Re: BRAS
by Larry Sheldon 11 Dec '13

11 Dec '13

On 12/11/2013 12:16 AM, Andrew Jones wrote: > On 11.12.2013 17:11, Nick Cameo wrote: >> Sir whatever that is an acronym for, you have my undivided. >> >> This is going to make for an interesting thread in about 6 hours..... > > http://en.wikipedia.org/wiki/Broadband_Remote_Access_Server May not be believed, but I DID search using "BRAS" and qualifiers like "network" and "communication" and got nothing but lingerie-related stuff, before I posted MY wise a remark. I have led a sheltered life. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: [nznog] Web Servers: Dual-homing or DNAT/Port Forwarding?
by Alex White-Robinson 11 Dec '13

11 Dec '13

Wotcha, >Number 1 gets you thinking along the IPv6 route (no pun, and imho :) ) >since you have to treat each boxes as if it was public. I see this kind of statement surprisingly often. Having a public address doesn't make a device public. I don't really see a drive to have devices exposed to the internet without a stateful device in front of them in IPv6 world. People shouldn't allow unsolicited connections to hit your internal workstation on any address scheme. Cheers, Alex. Date: Tue, 10 Dec 2013 05:56:41 +1300 From: Pieter De Wit <pieter(a)insync.za.net> To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Web Servers: Dual-homing or DNAT/Port Forwarding? Message-ID: <52A5F649.7070904(a)insync.za.net> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Hi, I normally use a combination of "1" and "2". I prefer 1 for weird and "not nat friendly" protocols, like SIP or some other application. The general rule of thumb is to use number 2 in other cases. In both setups, remember to deploy local firewalls as well. This will help for the case when a box on the subnet is hacked. My other twist is to deploy "1" without the private NIC, along with local firewalls (and as you said, dedicated FW). Number 1 gets you thinking along the IPv6 route (no pun, and imho :) ) since you have to treat each boxes as if it was public. Cheers, Pieter

5 4