December 2018 - Test - lists.nanog.org

adding graphs for actually unreachable RPKI INVALID prefixes to RPKI Monitor?
by nusenu 14 Feb '19

14 Feb '19

Dear NIST RPKI Monitor Team, thanks for creating and maintaining the RPKI Monitor https://rpki-monitor.antd.nist.gov/#rpki_adopters I've seen your graphs in multiple routing security presentations :) What do you think about adding graphs that show the amount of actually unreachable prefixes and IP space? (prefix where no alternative valid/unknown announcement exists) I think such graphs would help us focus on those prefixes that we should have to tackle first. This page contains examples of INVALID prefixes that would still be reachable in a route origin validating environment (see the RPKI validator screenshots): https://medium.com/@nusenu/towards-cleaning-up-rpki-invalids-d69b03ab8a8c kind regards, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

5 8

CGNAT
by Ahmed Munaf 07 Feb '19

07 Feb '19

Hi, Any recommendation regarding CGNAT appliance who try it and which brand is the best from his perspective! The throughput which I want to pass through the CGNAT is about 40Gbits and number of subscribers are about 40,000 subscribers. Regards, Ahmed

10 13

BGP Experiment
by Italo Cunha 06 Feb '19

06 Feb '19

NANOG, We would like to inform you of an experiment to evaluate alternatives for speeding up adoption of BGP route origin validation (research paper with details [A]). Our plan is to announce prefix 184.164.224.0/24 with a valid standards-compliant unassigned BGP attribute from routers operated by the PEERING testbed [B, C]. The attribute will have flags 0xe0 (optional transitive [rfc4271, S4.3]), type 0xff (reserved for development), and size 0x20 (256bits). Our collaborators recently ran an equivalent experiment with no complaints or known issues [A], and so we do not anticipate any arising. Back in 2010, an experiment using unassigned attributes by RIPE and Duke University caused disruption in Internet routing due to a bug in Cisco routers [D, CVE-2010-3035]. Since then, this and other similar bugs have been patched [e.g., CVE-2013-6051], and new BGP attributes have been assigned (BGPsec-path) and adopted (large communities). We have successfully tested propagation of the announcements on Cisco IOS-based routers running versions 12.2(33)SRA and 15.3(1)S, Quagga 0.99.23.1 and 1.1.1, as well as BIRD 1.4.5 and 1.6.3. We plan to announce 184.164.224.0/24 from 8 PEERING locations for a predefined period of 15 minutes starting 14:30 GMT, from Monday to Thursday, between the 7th and 22nd of January, 2019 (full schedule and locations [E]). We will stop the experiment immediately in case any issues arise. Although we do not expect the experiment to cause disruption, we welcome feedback on its safety and especially on how to make it safer. We can be reached at disco-experiment(a)googlegroups.com. Amir Herzberg, University of Connecticut Ethan Katz-Bassett, Columbia University Haya Shulman, Fraunhofer SIT Ítalo Cunha, Universidade Federal de Minas Gerais Michael Schapira, Hebrew University of Jerusalem Tomas Hlavacek, Fraunhofer SIT Yossi Gilad, MIT [A] https://conferences.sigcomm.org/hotnets/2018/program.html [B] http://peering.usc.edu [C] https://goo.gl/AFR1Cn [D] https://labs.ripe.net/Members/erik/ripe-ncc-and-duke-university-bgp-experim… [E] https://goo.gl/nJhmx1

35 96

Amazon Peering
by Darin Steffl 30 Jan '19

30 Jan '19

Hey all, Does anyone have a direct contact to get a peering session established with Amazon at an IX? I sent a peering request Dec 2017 and two more times this Sept and Nov with no response. I sent to peering(a)amazon.com and received one automated response back so I know they received my email but nothing since. -- Darin Steffl Minnesota WiFi www.mnwifi.com 507-634-WiFi <http://www.facebook.com/minnesotawifi> Like us on Facebook <http://www.facebook.com/minnesotawifi>

11 18

IPv6 Residential Deployment Survey
by John Curran 24 Jan '19

24 Jan '19

NANOGers - If you are providing residential Internet service with IPv6 (or are a customer of same), please take a moment to complete Jordi’s survey - this will help provide insight into the actual technical practices being used in residential IPv6 deployment. More details in attached email - Thanks! /John Begin forwarded message: From: John Curran <jcurran(a)arin.net<mailto:jcurran@arin.net>> Subject: [arin-ppml] IPv6 Residential Deployment Survey Date: May 22, 2016 at 6:24:17 AM GMT+2 To: ARIN PPML <ppml(a)arin.net<mailto:ppml@arin.net>> Folks - Jordi Palet Martínez is conducting a brief survey regarding IPv6 deployment in residential Internet service. Having insight into the various practices that are in use may help to inform IPv6 number resource policy development, and thus I ask that you take a moment to complete the survey if you are providing such services (whether production or trial basis.) Jordi notes - "The results will be published and updated every month or so - No personal data will be published. (If you know your network, it takes less than 2 minutes to complete it) The survey can be responded even if is not yet a commercial service, and customers can also respond, not just the ISP. However, to avoid duplicate data, make sure to include the country and ISP name.” The IPv6 Residential Deployment Survey may be found here - <http://survey.consulintel.es/index.php/175122> Thanks! /John John Curran President and CEO ARIN

9 16

Anyone using AT&T's ECOMP/ONAP?
by adamv0025＠netconsultings.com 18 Jan '19

18 Jan '19

Hi gents, I'm looking for physical network services orchestration framework for network service providers that could later be used/extended to orchestrate other areas of the business (virtualized services in DC, etc..). So far it appears to me that there's no such ready-made commercial product on the market that would contain all the building blocks I'd be interested in (well especially the easy to use service designer tool). ECOMP and now OANP seem to have it all and much more I'm just curious if anyone is using it in anger (or parts of it for that matter) for orchestration/design/automation of services on physical network. I'd like to hear some stories from trenches with regards to the implementation, but I'd be also interested in your thoughts in case you just assessed the tool for implementation (why did liked not liked about it). Thank you adam netconsultings.com ::carrier-class solutions for the telecommunications industry::

4 4

Announcing Peering-LAN prefixes to customers
by Dominic Schallert 17 Jan '19

17 Jan '19

Hi all, this might be a stupid question but today I was discussing with a colleague if Peering-LAN prefixes should be re-distributed/announced to direct customers/peers. My standpoint is that in any case, Peering-LAN prefixes should be filtered and not announced to peers/customers because a Peering-LAN represents some sort of DMZ and there is simply no need for them to be reachable by third-parties not being physically connected to an IXP themselves. Also from a security point of view, a lot of new issues might occur in this situation. I’ve been seeing a few transit providers lately announcing (even reachable) Peering-LAN prefixes (for example DE-CIX Peering LAN) to their customers. I’m wondering if there is any document or RFC particularly describing this matter? Thanks Dominic

14 20

Stupid Question maybe?
by Aseem Choudhary 17 Jan '19

17 Jan '19

Hi Christian, Discontinuous mask for IPv6 was supported in IOS-XR in release 5.2.2. You can refer below link for details: https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/ip-addresses… Regards, Aseem On Wed, Dec 19, 2018 at 8:32 AM Saku Ytti <saku at ytti.fi <https://mailman.nanog.org/mailman/listinfo/nanog>> wrote: >* On Wed, 19 Dec 2018 at 02:55, Philip Loenneker *>* <Philip.Loenneker at tasmanet.com.au <https://mailman.nanog.org/mailman/listinfo/nanog>> wrote: *>>* > I had a heck of a time a few years back trying to troubleshoot an issue *>* where an upstream provider had an ACL with an incorrect mask along the *>* lines of 255.252.255.0. That was really interesting to talk about once we *>* discovered it, though it caused some loss of hair beforehand... *>>* Juniper originally didn't support them even in ACL use-case but were *>* forced to add later due to customer demand, so people do have *>* use-cases for them. If we'd still support them in forwarding, I'm sure *>* someone would come up with solution which depends on it. I am not *>* advocating we should, I'll rather take my extra PPS out of the HW. *>>* However there is one quite interesting use-case for discontinuous mask *>* in ACL. If you have, like you should have, specific block for customer *>* linknetworks, you can in iACL drop all packets to your side of the *>* links while still allowing packets to customer side of the links, *>* making attack surface against your network minimal. * And unfortunately is still not supported by IOS-XR for IPv6, which could mean not having a scaleable way on your edge to protect your internal network. -- Christian e-mail/xmpp: christian at errxtx.net <https://mailman.nanog.org/mailman/listinfo/nanog> PGP Fingerprint: B458 E4D6 7173 A8C4 9C75315B 709C 295B FA53 2318

2 1

Service Provider NetFlow Collectors
by Erik Sundberg 16 Jan '19

16 Jan '19

Hi Nanog.... We are looking at replacing our Netflow collector. I am wonder what other service providers are using to collect netflow data off their Core and Edge Routers. Pros/Cons... What to watch out for any info would help. We are mainly looking to analyze the netflow data. Bonus if it does ddos detection and mitigation. We are looking at ManageEngine Netflow Analyzer PRTG Plixer - Scrutinizer PeakFlow Kentik Solarwinds NTA Thanks in advance... Erik ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

23 27

IP Dslams
by Nick Edwards 06 Jan '19

06 Jan '19

Howdy, We have a requirement for an aged care facility to provide voice and data, we have the voice worked out, but data, WiFi is out of the question, so are looking for IP-Dslams, preferably a system that is all-in-one, or self contained, as in contains its own BBRAS/LNS/PPP server/Radius, such as has a property managment API, or even just a webpage manager where admin can add in new residents when they arive, or delete when they depart I know these used to be available many years ago, but that vendor has like many vanished, only requirement is for ADSL2+, prefer units with either 48 ports or multiples of (192 etc) and have filtered voice out ports (telco50/rj21 etc) If anyone knows of such units, would appreciate some details on them, brand/model suppliers if known, etc, we can try get out google fu back if we have some steering:) Thank Y'all (resent - original never made it to the list for some gremlin reason)

14 23