August 2013 - Test - lists.nanog.org

Cisco DMVPN Configuration Question
by Ray Soucy 16 Aug '13

16 Aug '13

Don't usually poke NANOG for a second pair of eyes, but got hit with an urgent need to get connectivity up on a small budget. I've run into a situation where I require multiple DMVPN spokes to be behind a single NAT IP (picture of things to come with CGN?) The DMVPN endpoint works fine behind NAT until a 2nd is added behind the same IP address. At that point the hub gets confused and I start seeing packet loss to the endpoints in a round-robin fashion. As far as I can see Cisco documentation says pretty clearly that each DMVPN spoke requires a unique IP address. Is there any way around this, or do I need to be looking at an alternative VPN solution? Hub config: ----8<---- description DMVPN bandwidth 100000 ip address 10.231.254.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication ! removed ip nhrp map multicast dynamic ip nhrp network-id 1 ip nhrp redirect ip tcp adjust-mss 1360 tunnel source ! removed tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile DMVPN ----8<---- Spoke: ----8<---- interface Tunnel2 description DMVPN bandwidth 100000 ip vrf forwarding DMVPN ip address 10.231.254.10 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication ! removed ip nhrp map multicast ! removed ip nhrp map 10.231.254.1 ! removed ip nhrp network-id 1 ip nhrp nhs 10.231.254.1 ip nhrp shortcut ip tcp adjust-mss 1360 tunnel source FastEthernet0/0 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile DMVPN end ----8<---- -- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

2 1

Re: How big is the Internet?
by Scott Weeks 16 Aug '13

16 Aug '13

Ok, I'll put on my flame-proof undies, have some fun and bite at this one... --- sean(a)donelan.com wrote: From: Sean Donelan <sean(a)donelan.com> :: It seems odd that there are relatively good estimates :: for other communication networks and utilities; i.e. :: how big is the PSTN :: how many television or radio stations, :: how much freight is carried by railroads, trucks and ships. centralized control :: But asking how big is the Internet [...] What so special :: about the Internet that it can't be measured? Not controlled by small groups of people in positions of power. Thus innovation flourishes. Yay! :-) scott

2 1

Re: WaPo writes about vulnerabilities in Supermicro IPMIs
by Larry Sheldon 15 Aug '13

15 Aug '13

On 8/15/2013 8:53 PM, Scott Weeks wrote: > > > On 2013-08-15 19:00, Jay Ashworth wrote: > >> Is anyone here stupid enough not to put the management interfaces >> behind a firewall/VPN? > --------------------------------------------------- > > > Pain is a great teacher... The problem is getting the one that learned to transfer what was learned to the person hired as the replacement for the idiot that did the learning. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: WaPo writes about vulnerabilities in Supermicro IPMIs
by Scott Weeks 15 Aug '13

15 Aug '13

On 2013-08-15 19:00, Jay Ashworth wrote: > Is anyone here stupid enough not to put the management interfaces behind > a firewall/VPN? --------------------------------------------------- Pain is a great teacher... scott

1 0

Re: How big is the Internet?
by Larry Sheldon 15 Aug '13

15 Aug '13

On 8/15/2013 9:05 AM, Leo Bicknell wrote: > > On Aug 14, 2013, at 3:27 PM, Patrick W. Gilmore <patrick(a)ianai.net> > wrote: > >> Once you define what you mean by "how bit is the Internet", I'll be >> happy to spout off about how big it is. :) > > Arbitrary definition time: A Internet host is one that can send and > receive packets directly with at least one far end device addressed > out of RIR managed IPv4 or IPv6 space. > > That means behind a NAT counts, behind a firewall counts, but a true > private network (two PC's into an L2 switch with no other > connections) does not, even if they use IP protocols. Note that > devices behind a pure L3 proxy do not count, but the L3 proxy itself > counts. Isn't that like excluding city streets from the "How many miles of roads?" question--likely to be the bigger fraction of the whole-as-a-traveler-sees-it? -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

Recommendations for dynamic imix traffic generators
by Jason Lixfeld 15 Aug '13

15 Aug '13

Hi folks, I'm trying to put together a test bench to soak some CPE equipment with an imix of eyeball traffic. I'm wondering if anyone has any recommendations on open-source platforms that might be able to accomplish this. I'd like to simulate traffic conditions that various tiers of Internet users might create from behind these CPEs - Casual user, business user, gamer, heavy users, netflix client, Apple TV client, a combination of any of the aforementioned, etc. In a perfect world, I'd love for these traffic patterns to be dynamic; various pps/bps/fps/nat cps rates, various intervals of each and durations of each instead of just continually puking out the same set of packets in an endless loop. I think it would be important for this traffic generator to be intelligent enough to determine whether or not the tests it's performing are successful or not; that is, be cognizant of errors in the tests that would translate into what a user would perceive to be a broken web page or a slow loading web page or a video freezing or a game to lock up, all of which might be attributed to a timeout on a DNS lookup or packet-loss or a bad NAT stack, etc. If anyone has any ideas or experiences they can share on this type of setup, I'd love some feedback or advice. icir.org has a list of tools which I'm making my way through as well. Not sure what is useful for what it I'm trying to do, but I digress. Thanks in advance.

1 0

Level3 L2VPN service
by harbor235 15 Aug '13

15 Aug '13

Anybody have any experiences they want to share with Level3's L2VPN service? I am looking for performance, stability, and support issues? thank you, Mike

1 0

SMTP Authentication for Local Domain in Postfix
by Shahab Vahabzadeh 15 Aug '13

15 Aug '13

Dear friends, I have problem with my postfix configuration, I have enable SASL for postfix and now authentication works well for my clients but right now anyboy can send email from my local domain to local domain without authentication and cause of that I have lots of attacks. How can I force that if sender is my localdomain it must authenticate?! Here is my postfix configuration: main.cf: smtpd_sasl_auth_enable = yes > smtpd_sasl_local_domain = $myhostname > smtpd_sasl_security_options = noanonymous > broken_sasl_auth_clients = yes > smtpd_sasl_authenticated_header = yes > smtpd_client_restrictions = > permit_mynetworks, > permit_sasl_authenticated, > reject_unauth_pipelining, > reject_rbl_client zen.spamhaus.org, > smtpd_helo_restrictions = > permit_mynetworks, > #reject_non_fqdn_hostname, > reject_invalid_hostname > smtpd_sender_restriction = > permit_mynetworks, > permit_sasl_authenticated, > check_sender_access hash:/etc/postfix/access_table > reject_unknown_sender_domain, > reject_non_fqdn_sender > smtpd_recipient_restrictions = > permit_mynetworks, > permit_sasl_authenticated, > reject_invalid_hostname, > reject_unauth_pipelining, > reject_non_fqdn_sender, > reject_unknown_sender_domain, > reject_non_fqdn_recipient, > reject_unknown_recipient_domain, > reject_unverified_recipient, > reject_unauth_destination, > check_policy_service unix:private/policy-spf, > permit master.cf: smtp inet n - - - - smtpd > -o content_filter=spamassassin > submission inet n - - - - smtpd > -o smtpd_tls_security_level=may > -o smtpd_sasl_auth_enable=yes > -o smtpd_client_restrictions=permit_sasl_authenticated,reject > -o milter_macro_daemon_name=ORIGINATING > -o content_filter=spamassassin > smtps inet n - - - - smtpd > -o smtpd_tls_wrappermode=yes > -o smtpd_sasl_auth_enable=yes > -o smtpd_client_restrictions=permit_sasl_authenticated,reject > -o milter_macro_daemon_name=ORIGINATING > spamassassin > unix - n n - - pipe > user=nobody argv=/usr/bin/spamc -e /usr/sbin/sendmail -oi -f ${sender} > ${recipient} > policy-spf unix - n n - - spawn > user=nobody argv=/usr/bin/perl /usr/sbin/postfix-policyd-spf-perl access_table: mydomain.com REJECT You're not me! Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

2 1

Re: How big is the Internet?
by Paul Ferguson 15 Aug '13

15 Aug '13

On Wed, Aug 14, 2013 at 9:27 PM, <bmanning(a)vacation.karoshi.com> wrote: > On Thu, Aug 15, 2013 at 12:19:38AM -0400, Sean Donelan wrote: >> >> Either there is a lot of traffic missing, or market concentration is much >> greater than assumed. >> > > I'd argue that its both. > I don't want to argue, but perhaps a Hilbert Graph? :-) - ferg -- "Fergie", a.k.a. Paul Ferguson fergdawgster(at)gmail.com

1 0

CNN broadcasting online free? Hogging my bandwidth...
by Zachary McGibbon 14 Aug '13

14 Aug '13

I noticed my bandwidth graphs were a little out of whack tonight and after much digging through pcap files I found that my chrome tab with 'cnn.com' had a live stream of cnn playing on the right side halfway down. It seems this started around 8am this morning and it was a macromedia tcp flash stream on port 1935. Did they decide to give free CNN to everyone today? Or is this a goof? Either way it chewed up a lot of my bandwidth which doesn't come cheap here in Canada, eh? Also, sometimes it says: Watch CNN will resume momentarily on the feed but it's still pushing traffic. What a pain! Turning off the 'free' Piers Morgan feed now... - Zachary

3 2