May 2015 - Test - lists.nanog.org

Fwd: Question about EX - SRX redundancy
by Anurag Bhatia 14 Jun '15

14 Jun '15

Hello everyone! I have got two Juniper EX series switches (on virtual chassis) and two SRX devices on native clustering. I am trying to have a highly available redundancy between them with atleast 2Gbps capacity all the time but kind of failing. I followed Juniper's official page here <http://kb.juniper.net/InfoCenter/index?page=content&id=KB22474> as well as this detailed forum link here <http://forums.juniper.net/t5/SRX-Services-Gateway/Best-way-of-redundancy-be…> . I wish to have a case where devices are connected criss cross and following the documentation I get two ae bundles in EX side and one single reth bundle on SRX side. Both ae bundles on EX side have identical configuration and VLAN has both ae interfaces called up. If I do not go for criss cross connectivity like this: EX0 (ae1) >> Two Patches to SRX0 (reth1) EX1 (ae2) >> Two Patches to SRX1 (reth1) Then it works all well and redundancy works fine. In this case as long as 1 out of 4 patch is connected connectivity stays live but this has trade off that if one EX goes down then I cannot make use of other corresponding SRX. If I do criss connectivity, something like: EX0 (ae1) >> Two Patches to SRX0 (reth1) EX0 (ae1) >> One patch to SRX1 (reth1) EX1 (ae2) >> Two Patches to SRX1 (reth1) EX1 (ae2) >> One patch to SRX0 (reth1) In this config system behaves very oddly with one ae pair (and it's corresponding physical ports) working well while failover to other ae bundle fails completely. I was wondering if someone can point me out here. Appreciate your time and help! -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter <https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2

11 18

stacking pdu
by shawn wilson 05 Jun '15

05 Jun '15

Is there a way to stack PDUs? like, with 30A 220, we need more plugs than power but I'd like them to communicate to make sure we don't over power the circuit. Do any APC or Triplite systems support this?

15 16

AWS Elastic IP architecture
by Luan Nguyen 05 Jun '15

05 Jun '15

Hi folks, Anyone knows what is used for the AWS Elastic IP? is it LISP? Thanks. Regards, -lmn

26 101

BGP offloading (fixing legacy router BGP scalability issues)
by Frederik Kriewitz 03 Jun '15

03 Jun '15

Hello, We've a lot of customers with Cisco 6500 routers (mostly with SUP720 supervisors) in operation. They are very popular with smaller ISPs in Africa/middle east due to their cheap price on the used marked and their fully sufficient routing performance for the given tasks. In practice the biggest problem with them is their poor BGP scalability due to the CPU/memory limitations. We're looking into options for a cheap fix for this problem. The idea is to offload BGP IPv4/IPv6 RIB calculation from the router to a standard server. All BGP sessions will be handled by the server. The server takes care of the RIB calculation and aggregates the result as much as possible (the aggregation potential of the global tables should be very high if it can completely ignore the AS path and only care about the next hop). The final optimized RIB is then pushed to the Router via an iBGP session (the only BGP session configured on the router). If there's room in the transfer net for the server and the router, the setup is simple (eBGP session is established with the server and next-hop is set to the router). In other peering situations the setup might be more challenging. E.g. with typical IXP constrains (only a single MAC address/IP address allowed) the session would have to be a multihop session and an additional static route (host route for the server) on the peer router should be installed. Another way to make the server appear completely transparent for other peers (no special configuration on the peer side) might be NAT for the BGP port to the server or proxy ARP. But we would like to avoid doing NAT with a SUP720 and proxy ARP would make us the default gateway for any incorrectly configured IXP participant router and a configuration error on our side might cause severe harm to the IXP. And of course both ideas won't work for IPv6 (SUP720 doesn't support NAT for IPv6 or proxy NDP). The only solution to make it fully transparent for IPv4 and IPv6 we came up with it is to configure the IXP router interface as unnumbered + static route for the IXP nets + host routes for the assigned IXP IPs to the server. In that case the server would have to monitor the IXP vlan and take care of responding to ARP and Neighbor Solicitation requests for the IXP IPs (using the MAC of the router). Additionally it might be necessary to inject the ARP/IPv6 neighbors into the cisco using static entries (to avoid sending ARP/NS requests with a non IXP IP). We're wondering if anyone has experience with such a setup? Best Regards, Freddy

25 56

WiFi courses/vendors recommendation
by Abdullah Medhat 03 Jun '15

03 Jun '15

Good day all, We are looking forward to establish MetroWifi network as a new business line in our company, in addition to small/medium events Wifi coverage. I have two questions: 1. What are the required resources/material/training curriculum to let our engineers start educating in this? We are looking for the vendor-agnostic materials that will give our engineers the WiFi essentials/fundamentals to start building a good foundation before evolving to the professional level. 2. What vendors do you recommend? We need to find a cost-effective yet competent option with good pre/post sales service. Thanks, -- Abdullah Medhat

14 15

Capacity/transit costs vs growth
by Jean-Francois Mezei 01 Jun '15

01 Jun '15

I am looking for some rough estimates of the ratio of capacity (equipment) pricing declines versus average increase in end user capacity. For instance, say end user average capcity usage increases 50% over 3 years, would the ISP's costs also increase by 50% ? Or would increased efficency of equipment result in a 50% decrease in capacity costs yielding roughly the same total cost to the service provider ? So I am looking are some sort of ratio of gross costs increases/decreases relative to end user usage increase in usage over time. Context: Wholesale services in Canada are priced linearly and there is a process trying to convince the CRTC to review them ASAP. So if average use grows from 1mbps during peak to 1.2mbps, we are looking at 20% increase in costs in a linear pricing scheme. But if this happens over a period where there have been improvements in equipment/efficiency, then one would think the increase in costs would be less than 20%. So I am looking for any and all information that can help convince the regulator that current linear increase is not right and needs a review. any help appreciated.

7 10

BGP Multihoming 2 providers full or partial?
by Maqbool Hashim 01 Jun '15

01 Jun '15

Hi, We are an enterprise that are eBGP multihoming to two ISPs. We wish to load balance in inbound and outbound traffic thereby using our capacity as efficiently as possible. My current feeling is that it would be crazy for us to take a full Internet routing table from either ISP. I have read this document from NANOG presentations: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uac… The above document reenforces my opinion that we do not need full routing tables. However I was seeking some clarity as there are other documents which suggest taking a full routing table would be optimal. I "guess" it depends on our criteria and requirements for load balancing: - Just care about roughly balancing link utilisation - Be nice to make some cost savings We have PI space and two Internet routers one for each ISP. Either of our links is sufficient to carry all our traffic, but we want to try and balance utilisation to remain within our commits if possible. I am thinking a "rough" approach for us would be: - Take partial (customer) routes from both providers - Take defaults from both and pref one Maybe we can refine the above a bit more, any suggestions would be most welcome! Many Thanks

11 23

Colo Capacity quote in Renton, WA 98057, USA needed
by Don Gould 01 Jun '15

01 Jun '15

Hi, I have half a dozen servers in a DC in Renton, WA 98057, USA. I'm looking for quotes 7 RU with 100mbit PIR. I do need A and B side power. The pricing from my current provider has got out of hand and they have burnt the relationship. As a result I am interested in hearing from others who might be interested in servicing this small requirement. Cheers Don -- Don Gould 31 Acheson Ave Mairehau Christchurch, New Zealand Ph: + 64 3 348 7235 Mobile: + 64 21 114 0699 Ph: +61 3 9111 1821 (Melb)

2 2

300+ms of hotel wifi bufferbloat - peaking at 1.5 sec!
by Dave Taht 01 Jun '15

01 Jun '15

http://www.dslreports.com/speedtest/578850 I would get a kick out of it if folk here tried this new speedtest periodically (on the "cable" setting) during the nanog conference. ;) There is a hires option for more detail on the resulting charts... (or fiddled with "flent" (flent.org)) -- Dave Täht What will it take to vastly improve wifi for everyone? https://plus.google.com/u/0/explore/makewififast

4 5

Multiple vendors' IPv6 issues
by David Sotnick 31 May '15

31 May '15

Hi NANOG, The company I work for has no business case for being on the IPv6-Internet. However, I am an inquisitive person and I am always looking to learn new things, so about 3 years ago I started down the IPv6 path. This was early 2012. Fast forward to today. We have a /44 presence for our company's multiple sites; All our desktop computers have been on the IPv6 Internet since June, 2012 and we have a few AAAAs in our external DNS for some key services — and, there have been bugs. *Lots* of bugs. Now, maybe (_maybe_) I can have some sympathy for smaller network companies (like Arista Networks at the time) to not quite have their act together as far as IPv6 goes, but for larger, well-established companies to still have critical IPv6 bugs is just inexcusable! This month has just been the most disheartening time working with IPv6. Vendor 1: Aruba Networks. Upon adding an IPv6 address to start managing our WiFi controller over IPv6, I receive a call from our Telecom Lead saying that or WiFi VoIP phones have just gone offline. WHAT? All I did was add an IPv6 address to a management interface which has *nothing* to do with our VoIP system or SSID, ACLs, policies, roles, etc. Vendor 2: Palo Alto Networks: After upgrading our firewalls from a version which has a nasty bug where the IPv6 neighbor table wasn't being cleaned up properly (which would overflow the table and break IPv6), we now have a *new* IPv6 neighbor discovery bug where one of our V6-enabled DMZ hosts just falls of the IPv6 network. The only solution: clear the neighbor table on the Palo Alto or the client (linux) host. Vendor 3: Arista Networks: We are seeing a very similar ND bug with Arista. This one is slightly more interesting because it only started after upgrading our Arista EOS code — and it only appears to affect Virtual Machines which are behind our RedHat Enterprise Virtualization cluster. None of the hundreds of VMware-connected hosts are affected. The symptom is basically the same as the Palo Alto bug. Neighbor table gets in some weird state where ND breaks and the host is unreachable until the neighbor table is cleared. Oh, and the final straw today, which is *almost* leading me to throw in the IPv6 towel completely (for now): On certain hosts (VMs), scp'ing a file over the [Arista] LAN (10 gigabit LAN) takes 5 minutes over IPv6 and <1 second over IPv4. What happened? It really saddens me that it is still not receiving anywhere near the kind of QA (partly as a result of lack of adoption) that IPv4 has. Oh, and let's not forget everybody's "favorite" vendor, Cisco. Why is it, Cisco, that I have to restart my IPv6 OSPF3 process on my ASA every time my Palo Alto firewall crashes and fails over, otherwise none of my VPN clients can connect via IPv6? Why do you hurt me so, IPv6? I just wanted to be friends, and now I just want to break up with you. Maybe we can try to be friends again when your vendors get their shit together. -David

10 9