December 2014 - Test - lists.nanog.org

Is there a case for storm control and/or unknown traffic flood control in 'protected' bridge-domain?
by Jason Lixfeld 16 Dec '14

16 Dec '14

Greetings, Conceptually, a layer 2 port that is configured for either port protect mode (a’la Cisco 2950 vintage), UNI port-type (a’la Cisco ME3400 vintage) or EVC + split-horizon (a’la ME3600 vintage) should negate any requirement for features such as storm control or unknown traffic flood control to be configured in conjunction with either of those port modes. In theory then, either of the three aforementioned configuration modes would prevent any and all cross-talk between ports, in the same bridge-domain, notwithstanding traffic hitting the ‘trusted’ port, be it the trunk or uplink port, SVI, routed BD or whatever name your hardware uses to define that trusted port. Assuming that’s an accurate theory, is there a case that I might be missing where one would need to use storm control or unknown traffic flood control in this sort of environment?

1 0

Re: Cisco AnyConnect speed woes!
by Zachary McGibbon 16 Dec '14

16 Dec '14

Hi Roberto, - We have disabled the DTLS compression feature, this has been verified on the client side that compression says 'None' - We are not using the VPN load balancing feature, the two boxes are running in an active/standby configuration - Yes we are tunnelling all traffic however local lan access is available if the user checks the checkbox in their client - We are inspecting the following: dns preset_dns_map, ftp, h323 h225, h323 ras, rsh, rtsp, esmtp, sqlnet, skinny, sunrpc, xdmcp, sip, netbios, tftp, ip-options, icmp - Jumbo frames are not configured - We are using the following encryption methods: AES128 and 2048 bit certificate - We are running ASA 9.2.2.8 on a 5545X - We are pushing the Anyconnect client version 3.1.05182 Also, I should mention what I mean when we see slow speeds. For example, my internet connection at home is a cable modem with 30mb down, 10mb up. I have done a path mtu discovery to my VPN at work and it is 1500. When I run an iperf to a server at the office without vpn I get about 28mb down, 9.5mb up. When I connect to vpn, the iperf to the same server is about 1.2mb down, and 900k up. This is way too slow! - Zachary On Tue, Dec 9, 2014 at 4:39 PM, Roberto <roberto(a)ipnetworks.it> wrote: > > The big issue we are having is that many of our users are complaining of > low speed when connected to the VPN. > Please can you indicate more details ? > > Is it enabled on the ASA the "compression" feature ? > Is it enabled on the ASA the VPN Load Balancing feature ? > Are you using the AnyConnect FULL TUNNEL mode ? > Which are the inspection configured on the ASA for the "remote access" > clients ? > Have you configured the Jumbo MTU on the CISCO ASA interfaces ? > Which encryption are configured on the ASA (are you using Suite B > Algorithms) ? > Which version of ASA are you using ? > Which version of AnyConnect are you using ? > > > Note: > protocols such as L2TP/IPSec are not hardware accelerated -- the IPSec > portion of L2TP/IPSec is hardware-accelerated, but the L2TP portion is not. > Likewise, the SSL portions of SVC and WebVPN use hardware acceleration, > but the application layer protocols are done in software. > > > Best Regards, > > _________________________________ > Roberto Taccon > > e-mail: roberto(a)ipnetworks.it > mobile: +39 340 4751352 > fax: +39 045 4850850 > skype: roberto.taccon > > -----Messaggio originale----- > Da: NANOG [mailto:nanog-bounces@nanog.org] Per conto di Zachary McGibbon > Inviato: martedì 9 dicembre 2014 21.18 > A: Matthew Huff > Cc: NANOG > Oggetto: Re: Cisco AnyConnect speed woes! > > We are trying to use SSLVPN (udp 443) and results are really all over the > place. Most of our complaints are users connecting on Teksavvy however we > haven't been able to reach anyone in their network team to find out if they > are doing any filtering or shaping on their side. > > We don't have a lot of traffic coming through Cogent, most of the users > are local here in Montreal on either Bell or Videotron and they traverse > through the QIX (www.qix.ca) > > On Tue, Dec 9, 2014 at 3:03 PM, Matthew Huff <mhuff(a)ox.com> wrote: > > > Are you using SSLVpn or IPSEC with anyconnect? I have had more luck > > with performance with IPSEC than SSLVpn. > > > > Also, just because your ISP is saying that they aren't > > shaping/filtering, doesn't mean they aren't. > > > > We had major issues with users using AnyConnect when it was > > transversing Cogent. We were getting 5-10% packet loss (although the > > Cisco stats didn't show it), and it was choking on it. > > > > ---- > > Matthew Huff | 1 Manhattanville Rd > > Director of Operations | Purchase, NY 10577 > > OTA Management LLC | Phone: 914-460-4039 > > aim: matthewbhuff | Fax: 914-694-5669 > > > > -----Original Message----- > > From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Zachary > > McGibbon > > Sent: Tuesday, December 9, 2014 2:42 PM > > To: NANOG > > Subject: Cisco AnyConnect speed woes! > > > > I'm looking for some input on a situation that has been plaguing our > > new AnyConnect VPN setup. Any input would be valuable, we are at a > > loss for what the problem is. > > > > We recently upgraded our VPN from our old Cisco 3000 VPN concentrators > > running PPTP and we are now running a pair of Cisco 5545x ASAs in an > > HA active/standby pair. > > > > The big issue we are having is that many of our users are complaining > > of low speed when connected to the VPN. We have done tons of > > troubleshooting with Cisco TAC and we still haven't found the root of > our problem. > > > > Some tests we have done: > > > > - We have tested changing MTU values > > - We have tried all combinations of encryption methods (SSL, TLS, > IPSec, > > L2TP) with similar results > > - We have switched our active/standby boxes > > - We have tested on our spare 5545x box > > - We connected our spare box directly to our ISP with another IP > address > > - We have whitelisted our VPN IP on our shaper (Cisco SCE8000) and our > > IPS (HP Tipping Point) > > - We have bypassed our Shaper and our IPS > > - We made sure that traffic from the routers talking to our ASAs is > > synchronous, OSPF was configured to load balance but this has been > > changed > > by changing the costs on the links to the ASAs > > - We have verified with our two ISPs that they are not doing any kind > of > > filtering or shaping > > - We have noticed that in some instances that if a user is on a low > > speed connection that their VPN speed gets cut by about 1/3. This > > doesn't > > seem normal that the VPN would use this much overhead > > - We do not have the issue when connecting to VPN directly on our own > > network, only connections from the Internet > > > > If you have any ideas on what we could try net, please let me know! > > > > - Zachary > > > >

1 1

AT&T - XO Peering (AS7018 and AS2828)
by Patrick Sumby 16 Dec '14

16 Dec '14

Hi, Please could someone from ATT and/or XO contact me off list to discuss some issues we've been seeing on a link between AS7018 and AS2828. Thanks Pat -- --- Patrick Sumby Director of Global Engineering Sohonet

1 0

Cisco AnyConnect speed woes!
by Zachary McGibbon 16 Dec '14

16 Dec '14

I'm looking for some input on a situation that has been plaguing our new AnyConnect VPN setup. Any input would be valuable, we are at a loss for what the problem is. We recently upgraded our VPN from our old Cisco 3000 VPN concentrators running PPTP and we are now running a pair of Cisco 5545x ASAs in an HA active/standby pair. The big issue we are having is that many of our users are complaining of low speed when connected to the VPN. We have done tons of troubleshooting with Cisco TAC and we still haven't found the root of our problem. Some tests we have done: - We have tested changing MTU values - We have tried all combinations of encryption methods (SSL, TLS, IPSec, L2TP) with similar results - We have switched our active/standby boxes - We have tested on our spare 5545x box - We connected our spare box directly to our ISP with another IP address - We have whitelisted our VPN IP on our shaper (Cisco SCE8000) and our IPS (HP Tipping Point) - We have bypassed our Shaper and our IPS - We made sure that traffic from the routers talking to our ASAs is synchronous, OSPF was configured to load balance but this has been changed by changing the costs on the links to the ASAs - We have verified with our two ISPs that they are not doing any kind of filtering or shaping - We have noticed that in some instances that if a user is on a low speed connection that their VPN speed gets cut by about 1/3. This doesn't seem normal that the VPN would use this much overhead - We do not have the issue when connecting to VPN directly on our own network, only connections from the Internet If you have any ideas on what we could try net, please let me know! - Zachary

5 7

Anyone from 10796 (TWC)?
by Josh Baird 15 Dec '14

15 Dec '14

Hi, Could someone from 10796 please contact me off-list? I'm looking for some assistance with problems between 7018 and 10796 that is affecting customers on my network. Thanks, Josh

1 0

Re: Looking for piece of undersea cable
by C. A. Fillekes 15 Dec '14

15 Dec '14

No, silly! These are the wrecked ones, those great balls of twisted-up frayed cable that wash up on the beach. Not a live wire! They're kind of haunting and atmospheric -- but should be able to get a good slice out of them somewhere. On Mon, Dec 15, 2014 at 5:17 AM, Jeroen Wunnink | Hibernia Networks < jeroen.wunnink(a)hibernianetworks.com> wrote: > > And rubber gloves if you don't want to die, there's a few thousand volts > of DC current on these things ;-) > > > > On 14/12/14 14:55, C. A. Fillekes wrote: > >> Bring a hacksaw >> > > > -- > > Jeroen Wunnink > IP NOC Manager - Hibernia Networks > Main numbers (Ext: 1011): USA +1.908.516.4200 | UK +44.1704.322.300 > Netherlands +31.208.200.622 | 24/7 IP NOC Phone: +31.20.82.00.623 > jeroen.wunnink(a)hibernianetworks.com > www.hibernianetworks.com > > This e-mail and any attachments thereto is intended only for use by the > addressee(s) named herein and may be proprietary and/or legally privileged. > If you are not the intended recipient of this e-mail, you are hereby > notified that any dissemination, distribution or copying of this email, and > any attachments thereto, without the prior written permission of the sender > is strictly prohibited. If you receive this e-mail in error, please > immediately telephone or e-mail the sender and permanently delete the > original copy and any copy of this e-mail, and any printout thereof. All > documents, contracts or agreements referred or attached to this e-mail are > SUBJECT TO CONTRACT. The contents of an attachment to this e-mail may > contain software viruses that could damage your own computer system. While > Hibernia Networks has taken every reasonable precaution to minimize this > risk, we cannot accept liability for any damage that you sustain as a > result of software viruses. You should carry out your own virus checks > before opening any attachment. >

1 0

Relative cost of ONT and UPS for FTTP
by Jean-Francois Mezei 15 Dec '14

15 Dec '14

At recent hearings, I stuck my foot deep into my mouth (as I often do). So I am now tasked to find the relative cost of the ONT/UPS compared to the cost of the FTTP drop to the home (in a Flexnap environment). >From what I had read in the past, the ONT/UPS represent a major portion of the costs to connect a home to an existing Flexnap FTTP system as the drop itself is now dirt cheap to install with unskilled workforce (no need for laser splicing since flexnap is plug and play). I know that the Aussie NBN had considered ditching the UPS to greatly reduce the cost to reduce homes, so I have to hunt down those documents (which predate existing pro-copper govt). Does ayone have numbers for ONT/UPS or could point me to such ? I assume manpower to install the ONT/UPS in homes is a large part of the cost inside the home ? And is there any evidence that the actual drop to the home with Flexnap FTTP is cheaper than a drop using copper from the splice panel on pole to the home ? Any/all information would be helpful. (this is convince the regulator that an independent ISP who buys the ONT/UPS to be used by one of its customers relieves the incumbent telco from a major portion of the cost to connect a home, which, according to telcos, represent 1/3 of total cost of FTTP deployment.

3 4

Looking for piece of undersea cable
by Colin McIntosh 14 Dec '14

14 Dec '14

Hey all, I'm looking for a piece of undersea cable to use for educational purposes and was hoping somebody would have a section they can part with. Doesn't need to be a big piece, really any size will work. I can pay for shipping and the cable, if needed. Thanks! -Colin

6 6

DNS ops: please refresh gov.on.ca and ontario.ca
by Mark E. Jeftovic 13 Dec '14

13 Dec '14

Hello all, Earlier I sent out a request for resolver operators to refresh their cache for gov.on.ca (thank you to all who did). Can you also make sure you refresh ontario.ca? Correct IP for www.gov.on.ca is 54.208.81.96 Correct IPs for gov.on.ca nameservers are: Name servers: ens1.gov.on.ca 204.41.8.240 ens2.gov.on.ca 204.41.4.240 Correct IP for ontario.ca is 54.208.81.96 Thank you all. - mark -- Mark E. Jeftovic <markjr(a)easydns.com> Founder & CEO, easyDNS Technologies Inc. +1-(416)-535-8672 ext 225 Read my blog: http://markable.com

1 0

resolver ops: please refresh gov.on.ca
by Mark E. Jeftovic 13 Dec '14

13 Dec '14

All resolver nameserver operators, if you could refresh your caches for gov.on.ca There has been an incident where the government of ontario nameservers were briefly hijacked We will post details to follow in the meantime, if you can refresh your caches, the proper records should be: ens2.gov.on.ca 204.41.4.240 ens1.gov.on.ca 204.41.8.240 thank you all - mark -- Mark E. Jeftovic <markjr(a)easydns.com> Founder & CEO, easyDNS Technologies Inc. +1-(416)-535-8672 ext 225 Read my blog: http://markable.com

1 0