December 2014 - Test - lists.nanog.org

Netscaler Help
by james jones 18 Dec '14

18 Dec '14

Are there any netscaler experts out there? Please contact me off list.

1 0

Level3 to Savvis/CenturyLink problems?
by Leah Reveliotty 18 Dec '14

18 Dec '14

We have an MPLS backbone from Level3 and are experiencing issues between two of our San Francisco Bay Area locations – namely our HQ in Burlingame, CA and our Savvis/CenturyLink Data Center in Santa Clara, CA. Ping response times between these 2 sites are within the normal range, but our Applications are timing out. We’ve obviously done a ton of troubleshooting on the Application side of things, but everything points back to a circuit issue and after a lot of testing we are scratching our heads trying to narrow down this issue. So I wanted to post to this list to see if anyone else has noticed issues with their Level3 circuits in the Bay Area over the last 2 days as well? Thanks for your feedback! Regards, Leah

2 1

Looking for a contact at Magix as9506 or someone at singtel who has insight into the operation of 9506
by joel jaeggli 18 Dec '14

18 Dec '14

We're have a little bit of trouble reaching your customers with a prefix advertised in SIN and there's little or no visibility from the 9506 vantage point. Thanks in Advance. Joel (as54113)

1 0

Anyone from Nike.com
by Di Li 17 Dec '14

17 Dec '14

Anyone from Nike.com willing to contact me off list to troubleshooting some IP space blocking issues -- Thanks, Di

1 0

automatic / intelligent fiber optic patch panel (iow SDN @ layer 0)
by Arnold Nipper 17 Dec '14

17 Dec '14

I'm looking for a modular, cost-effective automatic / intelligent fibre optic patch panel. I'm not looking at these photonic x-connects, but really for something which does the patching instead of a technician. TIA Arnold -- Arnold Nipper / nIPper consulting, Sandhausen, Germany email: arnold(a)nipper.de phone: +49 6224 5593407 2 mobile: +49 172 2650958 fax: +49 6224 5593407 9

8 13

Fwd: malware.watch rdns
by shawn wilson 17 Dec '14

17 Dec '14

I asked on this on another list I'm on and didn't get any reply, so I figured I might have better luck here Anyone know what malware.watch. is doing? Below is basically everything I could find: http://www.robtex.net/en/advisory/dns/watch/malware/ssl-scanning-015/ They've got a web page, but nothing there: % curl -I malware.watch HTTP/1.1 200 OK Date: Thu, 13 Nov 2014 19:17:29 GMT Content-Type: text/html Connection: keep-alive Set-Cookie: __cfduid= da37b063f68032dfe5adc07ae35fe27031415906249; expires=Fri, 13-Nov-15 19:17:29 GMT; path=/; domain=.malware.watch; HttpOnly X-Frame-Options: sameorigin Server: cloudflare-nginx CF-RAY: 188d4f4cd3cb0eeb-EWR What I saw was ssl-scanning-###.malware.watch, so after that curl I figured I'd start by blowing up their dns :) % printf '%03d\n' {0..999} | while read f; do dig=$(dig "ssl-scanning-${f}.malware.watch" +short); if [ -n "$dig" ]; then echo "$f: $dig"; fi; done ~ swlap1 015: 85.17.239.155 016: 104.200.21.140 017: 195.154.114.206 (It was pointed out to me this could be more easily written as: dig +noall +ans ssl-scanning-{000..999}.malware.watch) So they only have three in that block, on is in the Netherlands, the other is Linode (US), and the last is French: 8 21.28 ms as4436-1-c.111eighthave.ny.ibone.comcast.net (173.167.57.162) 9 17.01 ms vlan-75.ar2.ewr1.us.as4436.gtt.net (69.31.34.129) 10 15.73 ms as13335.xe-7-0-3.ar2.ewr1.us.as4436.gtt.net (69.31.95.70) 11 15.85 ms 104.28.19.47 7 10.07 ms he-1-15-0-0-cr01.350ecermak.il.ibone.comcast.net (68.86.85.70) 8 9.58 ms ae15.bbr02.eq01.wdc02.networklayer.com (75.149.228.94) 9 10.98 ms ae7.bbr01.eq01.wdc02.networklayer.com (173.192.18.194) 10 23.08 ms ae0.bbr01.tl01.atl01.networklayer.com (173.192.18.153) 11 43.01 ms ae13.bbr02.eq01.dal03.networklayer.com (173.192.18.134) 12 43.02 ms po32.dsr02.dllstx3.networklayer.com (173.192.18.231) 13 44.33 ms po32.dsr02.dllstx2.networklayer.com (70.87.255.70) 14 50.71 ms po2.car01.dllstx2.networklayer.com (70.87.254.78) 15 41.94 ms router1-dal.linode.com (67.18.7.90) 16 42.63 ms li799-140.members.linode.com (104.200.21.140) 7 11.36 ms he-0-13-0-1-pe04.ashburn.va.ibone.comcast.net (68.86.87.142) 8 10.95 ms xe-7-0-2.was10.ip4.gtt.net (77.67.71.193) 9 87.79 ms xe-4-2-0.par22.ip4.gtt.net (89.149.182.98) 10 87.80 ms online-gw.ip4.gtt.net (46.33.93.90) 11 91.82 ms 49e-s46-1-a9k1.dc3.poneytelecom.eu (195.154.1.77) 12 88.27 ms ssl-scanning-017.malware.watch (195.154.114.206)

1 0

ARIN's RPKI Relying agreement
by Andrew Gallo 16 Dec '14

16 Dec '14

Greetings: In the past few months, I've spoken with, or heard second hand, from a number of organizations that will not or cannot sign ARIN's RPKI Relying Agreement. Acceptance of this agreement is required in order to gain access to ARIN's Trust Anchor Locator (TAL). Given the size and number of these organizations that can't or wont accept the agreement makes me wonder if this is a show stopper that will prevent the adoption of this technology. I've created a quick survey to get an idea of the community's take on this agreement with the idea that if enough organizations indicate it is unacceptable, maybe we can get this agreement changed, or as with other regions, not explicitly required to use the TAL. https://docs.google.com/forms/d/10RLBBpL05n1c_H4unHitlsVqNM3rZI5aXAX8iSBc_K… Thank you.

18 53

How do I handle a supplier that delivered a faulty product?
by Baldur Norddahl 16 Dec '14

16 Dec '14

Hello, We are a small FTTH provider and our main business is selling 1000/1000 internet. Our network is GPON based. We recently made the mistake of buying a large shipment of Zhone 2301 modems (ONU). We did test this device before purchase, but unfortunately we failed to notice a severe fault with the product. Soon after putting it into production we got many complaints from customers that the modem would crash daily. Turns out that the device can not handle download streams at or near 1000 Mbps. Especially if the download originates with a server that is 10G connected. GPON downstream is actually 2.4 Gbps. The modem has to deliver on an ordinary 1 Gbps ethernet port. This means the packets can arrive faster than the modem can hand it off on the ethernet side. And when that happens, it will simply crash. The vendor then told us to limit download speed to 750 Mbps with a small buffer of 50 KB. Any faster and the modem can crash amongst other issues. When I told them I do not think I can sell 1000/1000 Mbps internet if I limit the modems to 750 Mbps, as that would be false advertising, I was simply told that the 2301 is a low cost solution, so deal with it. They are not going to work more on fixing the issue. The website and the datasheet does not say anything that would warn you that this product can only handle 750 Mbps: http://www.zhone.com/products/ZNID-GPON-2301/ZNID-GPON-2301.pdf So what do I do now? I am thinking Zhone needs to resolve this in a satisfactory way, which is to either return my money or switch the product to something, that actually delivers what was promised. We have some of their 24xx series and that works perfectly well. So we know it is just the 2301 that is bad. Unfortunately we are apparently to small a customer to them. As this is an USA supplier, will suing them help me any? Yes I know, don't ask for legal advice on a mailing list, and I am not - I just want to know some opinions if that is even worth considering. Or if I will just have to eat it and drive the whole shipment into the harbor. Regards, Baldur

9 12

Is there a case for storm control and/or unknown traffic flood control in 'protected' bridge-domain?
by Jason Lixfeld 16 Dec '14

16 Dec '14

Greetings, Conceptually, a layer 2 port that is configured for either port protect mode (a’la Cisco 2950 vintage), UNI port-type (a’la Cisco ME3400 vintage) or EVC + split-horizon (a’la ME3600 vintage) should negate any requirement for features such as storm control or unknown traffic flood control to be configured in conjunction with either of those port modes. In theory then, either of the three aforementioned configuration modes would prevent any and all cross-talk between ports, in the same bridge-domain, notwithstanding traffic hitting the ‘trusted’ port, be it the trunk or uplink port, SVI, routed BD or whatever name your hardware uses to define that trusted port. Assuming that’s an accurate theory, is there a case that I might be missing where one would need to use storm control or unknown traffic flood control in this sort of environment?

1 0

Re: Cisco AnyConnect speed woes!
by Zachary McGibbon 16 Dec '14

16 Dec '14

Hi Roberto, - We have disabled the DTLS compression feature, this has been verified on the client side that compression says 'None' - We are not using the VPN load balancing feature, the two boxes are running in an active/standby configuration - Yes we are tunnelling all traffic however local lan access is available if the user checks the checkbox in their client - We are inspecting the following: dns preset_dns_map, ftp, h323 h225, h323 ras, rsh, rtsp, esmtp, sqlnet, skinny, sunrpc, xdmcp, sip, netbios, tftp, ip-options, icmp - Jumbo frames are not configured - We are using the following encryption methods: AES128 and 2048 bit certificate - We are running ASA 9.2.2.8 on a 5545X - We are pushing the Anyconnect client version 3.1.05182 Also, I should mention what I mean when we see slow speeds. For example, my internet connection at home is a cable modem with 30mb down, 10mb up. I have done a path mtu discovery to my VPN at work and it is 1500. When I run an iperf to a server at the office without vpn I get about 28mb down, 9.5mb up. When I connect to vpn, the iperf to the same server is about 1.2mb down, and 900k up. This is way too slow! - Zachary On Tue, Dec 9, 2014 at 4:39 PM, Roberto <roberto(a)ipnetworks.it> wrote: > > The big issue we are having is that many of our users are complaining of > low speed when connected to the VPN. > Please can you indicate more details ? > > Is it enabled on the ASA the "compression" feature ? > Is it enabled on the ASA the VPN Load Balancing feature ? > Are you using the AnyConnect FULL TUNNEL mode ? > Which are the inspection configured on the ASA for the "remote access" > clients ? > Have you configured the Jumbo MTU on the CISCO ASA interfaces ? > Which encryption are configured on the ASA (are you using Suite B > Algorithms) ? > Which version of ASA are you using ? > Which version of AnyConnect are you using ? > > > Note: > protocols such as L2TP/IPSec are not hardware accelerated -- the IPSec > portion of L2TP/IPSec is hardware-accelerated, but the L2TP portion is not. > Likewise, the SSL portions of SVC and WebVPN use hardware acceleration, > but the application layer protocols are done in software. > > > Best Regards, > > _________________________________ > Roberto Taccon > > e-mail: roberto(a)ipnetworks.it > mobile: +39 340 4751352 > fax: +39 045 4850850 > skype: roberto.taccon > > -----Messaggio originale----- > Da: NANOG [mailto:nanog-bounces@nanog.org] Per conto di Zachary McGibbon > Inviato: martedì 9 dicembre 2014 21.18 > A: Matthew Huff > Cc: NANOG > Oggetto: Re: Cisco AnyConnect speed woes! > > We are trying to use SSLVPN (udp 443) and results are really all over the > place. Most of our complaints are users connecting on Teksavvy however we > haven't been able to reach anyone in their network team to find out if they > are doing any filtering or shaping on their side. > > We don't have a lot of traffic coming through Cogent, most of the users > are local here in Montreal on either Bell or Videotron and they traverse > through the QIX (www.qix.ca) > > On Tue, Dec 9, 2014 at 3:03 PM, Matthew Huff <mhuff(a)ox.com> wrote: > > > Are you using SSLVpn or IPSEC with anyconnect? I have had more luck > > with performance with IPSEC than SSLVpn. > > > > Also, just because your ISP is saying that they aren't > > shaping/filtering, doesn't mean they aren't. > > > > We had major issues with users using AnyConnect when it was > > transversing Cogent. We were getting 5-10% packet loss (although the > > Cisco stats didn't show it), and it was choking on it. > > > > ---- > > Matthew Huff | 1 Manhattanville Rd > > Director of Operations | Purchase, NY 10577 > > OTA Management LLC | Phone: 914-460-4039 > > aim: matthewbhuff | Fax: 914-694-5669 > > > > -----Original Message----- > > From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Zachary > > McGibbon > > Sent: Tuesday, December 9, 2014 2:42 PM > > To: NANOG > > Subject: Cisco AnyConnect speed woes! > > > > I'm looking for some input on a situation that has been plaguing our > > new AnyConnect VPN setup. Any input would be valuable, we are at a > > loss for what the problem is. > > > > We recently upgraded our VPN from our old Cisco 3000 VPN concentrators > > running PPTP and we are now running a pair of Cisco 5545x ASAs in an > > HA active/standby pair. > > > > The big issue we are having is that many of our users are complaining > > of low speed when connected to the VPN. We have done tons of > > troubleshooting with Cisco TAC and we still haven't found the root of > our problem. > > > > Some tests we have done: > > > > - We have tested changing MTU values > > - We have tried all combinations of encryption methods (SSL, TLS, > IPSec, > > L2TP) with similar results > > - We have switched our active/standby boxes > > - We have tested on our spare 5545x box > > - We connected our spare box directly to our ISP with another IP > address > > - We have whitelisted our VPN IP on our shaper (Cisco SCE8000) and our > > IPS (HP Tipping Point) > > - We have bypassed our Shaper and our IPS > > - We made sure that traffic from the routers talking to our ASAs is > > synchronous, OSPF was configured to load balance but this has been > > changed > > by changing the costs on the links to the ASAs > > - We have verified with our two ISPs that they are not doing any kind > of > > filtering or shaping > > - We have noticed that in some instances that if a user is on a low > > speed connection that their VPN speed gets cut by about 1/3. This > > doesn't > > seem normal that the VPN would use this much overhead > > - We do not have the issue when connecting to VPN directly on our own > > network, only connections from the Internet > > > > If you have any ideas on what we could try net, please let me know! > > > > - Zachary > > > >

1 1