- Test - lists.nanog.org

Re: NSA able to compromise Cisco, Juniper, Huawei switches
by Clay Kossmeyer 02 Jan '14

02 Jan '14

Hi Folks - Clay Kossmeyer here from the Cisco PSIRT. We've published the following document in response to the original (Dec. 29) Der Spiegel article: http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… and are investing the claims in the Dec. 30 Der Spiegel article referencing 'persistent implants' for the PIX and ASA product lines under case number PSIRT-1384943056. Any vulnerabilities we discover will be disclosed via our standard vulnerability handling process documented here: http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy… I'm not currently subscribed to NANOG, so if you have a reply you'd like me to see, please copy me directly. Regards, Clay ----- Found some interesting news on one of the Australia news websites. http://www.scmagazine.com.au/News/368527,nsa-able-to-compromise-cisco-junip… Regards, Steven.

13 24

NSA able to compromise Cisco, Juniper, Huawei switches
by sten rulz 01 Jan '14

01 Jan '14

Found some interesting news on one of the Australia news websites. http://www.scmagazine.com.au/News/368527,nsa-able-to-compromise-cisco-junip… Regards, Steven.

36 75

Re: NSA able to compromise Cisco, Juniper, Huawei switches
by Brandon Butterworth 01 Jan '14

01 Jan '14

> If legal, consider risk to NSA. Official product ran inside company to add > requested feature, hundred of people aware of it. Seems both expensive to > order such feature and almost guaranteed to be exposed by some of the > employees. > > Alternative method is to presume all software is insecure, hire 1 expert whose > day job is to search for vulnerabilities in IOS. Much cheaper, insignificant > risk. > > Which method would you use? I'd also look at having people work in the factory in china designing test or at (/own) the QA/test equipment manufacturer as when they connect the product jtag to test you can give a little extra. Both smaller groups of people and nobody knows what they do anyway but they do get legit access to the product perhaps with low level details handed on a plate. > If this is as widespread as claimed, and if we'll gain knowledge how to see if > you are affected, there are potentially repercussions on geopolitical scale, > as I'm sure many on these lists would go public and share information if > they'd find being targeted. Would they leave them out there gathering data for as long as possible or remove the evidence as soon as people start looking (then put some back later once the fuss has died down)? brandon

1 0

First! [?]
by jamie rishaw 01 Jan '14

01 Jan '14

Happy New Year to all, and to all a good lawful interception.

6 5

Re: Juniper SSL VPN
by Hank Nussbacher 01 Jan '14

01 Jan '14

At 20:55 31/12/2013 -0500, Christopher Morrow wrote: >Had no clue? Didn't they build it? > > > > From what I understood from the tech note, they had no clue this would > > happen on the 31st of December :) Perhaps it is a left over somehow from their Netscreen purchase (April 2004)? -Hank

2 1

Why are we fixated on Multimode fiber for high bandwidth communication?
by eric clark 31 Dec '13

31 Dec '13

I've been working with 40 gig for a few years. When I first ordered a switch, one of the first publicly available with full 40 gig, I was appalled that I was going to have to use 4 pair of multimode fiber for each of my connections. I had planned on using single mode because I can do that with 1 pair. Even today, we're still looking at MM fiber instead of SM, even with the horrendous limitations and cost issues of MM. For instance, if you need to go 301 meters or more, you've got to go OM4 which is very expensive. You have to lay 4 times the number of pairs as SM and when we move to 100G, it'll be even worse because they're still doing things in 6,12,etc... SM can do 100G easily, up to 1K with the lower grade fiber, so in the SM 100G world, you'd be installing 1/12 the strands as you would in multi mode. I just can't figure where this makes sense.... I am aware that single mode has more expensive optics, and I know how much they cost when I first looked at this, but if this were the standard, that price would drop enormously. Anyone know why the industry has their head stuck on MultiMode?

6 6

CEF/etherchannel load balancing algorithms or MLPPPoE
by Herro91 31 Dec '13

31 Dec '13

Hello, Looking for feedback/suggestions on a design issue. We have a two ethernet connections in a port channel between two Cisco routers (ASR1k), unfortunately we only have one unique flow between traversing the ether/port channel, so traffic is pinned to just one link. I'm looking for options including whether one of the algorithms available for CEF is able to make a load sharing decision if I expose some upper layer information such as DSCP/ToS to CEF to provide unique flows? I also have been considering MLPPPoE, but it does not seem to support more than one member link from what I can tell. Appreciate thoughts and suggestions. Best, -Doug

1 0

RE : Re: NSA able to compromise Cisco, Juniper, Huawei switches
by Michael Hallgren 31 Dec '13

31 Dec '13

+1, I fully agree. And not only concerning the "domestic" use by country, but also with regards to "information peering" with neighbors, and such. Enjoy '14! mh -------- Message d'origine -------- De : Ray Soucy <rps(a)maine.edu> Date : A : Blair Trosper <blair.trosper(a)gmail.com> Cc : "nanog(a)nanog.org list" <nanog(a)nanog.org> Objet : Re: NSA able to compromise Cisco, Juniper, Huawei switches I think there needs to be some clarification on how these tools get used, how often they're used, and if they're ever cleaned up when no longer part of an active operation. Of course we'll never get that. The amount of apologists with the attitude "this isn't a big deal, nothing to see here, the NSA does this kind of thing" is kind of shocking for this community; especially with the information that's been released over the past few months. This whole backdoor business is a very, very, dangerous game. On Tue, Dec 31, 2013 at 12:19 AM, Blair Trosper <blair.trosper(a)gmail.com>wrote: > To supplement and amend what I said: > > These are the KINDS of things we want the NSA to do; however, the > institutional oversight necessary to make sure it's Constitutional, > warranted, and kept "in bounds" is woefully lacking (if any exists at all). > Even FISA is unsatisfactory. > > At any rate, I agree that the current disposition of the NSA (or, at least, > what's been leaking the last few months) is simply unacceptable and cannot > be allowed. I say that last part from the perspective of a US citizen, > though I'd imagine most people of other nationalities would agree with me, > but probably for different reasons. > > > On Mon, Dec 30, 2013 at 11:08 PM, Jimmy Hess <mysidia(a)gmail.com> wrote: > > > On Mon, Dec 30, 2013 at 10:41 PM, Blair Trosper <blair.trosper(a)gmail.com > >wrote: > > > >> I'm torn on this. On one hand, it seems sinister. On the other, it's > not > >> only what the NSA is tasked with doing, but it's what you'd EXPECT them > to > >> be doing in the role as the NSA. > >> > > [snip] > > > > The NSA's role is not supposed to include subterfuge and undermining the > > integrity or security of domestic enterprise infrastructure > > > > With any luck, we'll hopefully find absolutely nothing, or that it was > > "targetted" backdooring against specific targets only. > > > > And people have a need to know that the security agencies haven't left a > > trail of artificially inserted bugs and backdoors in common IT equipment > > providing critical infrastructures services, and that the agencies > haven't > > prepared a collection of instant-root 0days, that are no more protected > > then the agencies' other poorly guarded "secrets". > > > > There would be a risk that any 'backdoors' are ready to be exploited by > > other unintended nefarious actors! > > Because the NSA are apparently great at prepping the flammables and > > setting fires, but totally incapable of keeping the fires contained, > > once they (or someone else) lights it. > > > > > > It is not the least bit necessary for the NSA itself to be a nefarious > > actor exploiting things or even complicit; for the mere presence of > any > > backdoor or surreptitious code to eventually have the potential for > serious > > damage. > > > > It could well be a rogue ex-employee of the NSA, such as Snowden, or > > others, that happened to be aware of technical details, hackers, or > > members of a foreign nation state, who will just happen to have the time > > and energy to track down open doors waiting for the taking, AND figure > > out how to abuse them for evil purposes. > > > > > > There are enough potential 0day risks, without intentional ones, waiting > > for bad guys to co-opt! > > > > -- > > -JH > > > -- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

1 0

Re: turning on comcast v6
by Victor Kuarsingh 31 Dec '13

31 Dec '13

Leo, On Mon, Dec 30, 2013 at 6:24 PM, Leo Bicknell <bicknell(a)ufp.org> wrote: > > On Dec 30, 2013, at 2:49 PM, Lee Howard <Lee(a)asgard.org> wrote: > > > I'm not really an advocate for or against DHCP or RAs. I really just > want > > to understand what feature is missing. > > I encourage you to try this simple experiment in your lab, because this > happens all day long on corporate networks around the world, and > illustrates the differences quite nicely. While not a complete treatment > of the operational differences, it's an important illustration. > > Configure up a simple network topology of three boxes representing a hub > and spoke network: > > DHCP SVR > | > --lan--r1--wan--hubrtr--wan--r2--lan > > > ..... > > Here's what you will soon find: > > 1) The IPv6 pings on both machines cease to work. > > 2) The IPv4 network continues to work just fine. > > > Yes, in this very specific case, you may get this result. However, this is a very specific case with very specific parameters and conditions. There are also many cases (again specific in nature) which would cause the IPv4 connection to have problems and not the IPv6 connection. As an example, say the failure is now over and we have running state with r1 and r2 as two potential routers out of the LAN to a common WAN for IPv4 and IPv6 connectivity. The DHCPv4 server provides only the address of the r2 router (original on that LAN). Both r1 and r2 provide RAs and the client works over r2 for IPv6 for now. r1 fails, the machines will lose IPv4 connectivity but IPv6 will keep working (as the hosts will detect r1 as unreachable and then use r2). There are a number of assumptions in this use case - but that's the point. One may say that without IPv4, perhaps we have a problem anyway (since I am sure many networks will have some level of dependance on IPv4 for a while) - but the designers of IPv6 will then say that the IPv6 protocol needs to be free from IPv4 baggage to truly succeed IPv4. I am not fighting against the case of the DHCPv6 option, but I am not sure if use cases like the one you mentioned will convince the right audiences that the option is needed. For reference, this concept has died on the vine before - draft-droms-dhc-dhcpv6-default-router-00 as an example. (where technical comments were made to diminish the technical value of using DHCPv6 as an option to provide default gateway information). We can also reference draft-ietf-mif-dhcpv6-route-option from the MIF working group. I think a new initiative to revive this concept will need to address the [negative] points from those previous experiences and contrast them to the operational benefits of having it available. I am willing to help out here, but we need some folks willing to put the use cases together which make a strong case (oh and they will need email stamina). regards, Victor K > -- > Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 > PGP keys at http://www.ufp.org/~bicknell/ > > > > > >

2 1

Re: The Making of a Router
by sten rulz 29 Dec '13

29 Dec '13

Hello Baldur, Your design regarding proxy arp for every VLAN might hit some issues. If you look at the nanog history you will find people having issues with proxy arp for large number of VLANs, what is your requirement for proxy arp? Doing something at the access switch will most likely be better for you such as PVLAN or Brocade IP follow ve statement. If you are planning to put clients on the same subnet what are you planning to put in place to limit client stealing each other’s IPs? Only a few Brocade devices support the ARP ACLs rules which are a really nice feature, IP Source Guard works reasonable if using a DHCP server otherwise you need to specify the MAC address. Some other brand switches support filtering the ARP packets per access port. Regards, Steven. Date: Sat, 28 Dec 2013 02:18:55 +0100 From: Baldur Norddahl <baldur.norddahl(a)gmail.com> To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: Re: The Making of a Router Message-ID: <CAPkb-7C2+pebvp+WwYx0S3DLwQmy_hDPbZgqipvQ_sFj_3uNUQ(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Sat, Dec 28, 2013 at 12:56 AM, Jon Sands <fohdeesha(a)gmail.com> wrote: > Yes, and in that world, one should probably not start up a FTTH ISP when > one has not even budgeted for a router, among a thousand other things. And > if you must, you should probably figure out your cost breakdown beforehand, > not after. Baldur, you mention $200k total to move 10gb with Juniper (which > seems insanely off to me). Look into Brocades CER line, you can move 4x > 10gbe per chassis for under 12k. > I was saying $100k for two Juniper routers total. Perhaps we could get back on track, instead of trying to second guess what we did or did not budget for. You have absolute no information about our business plans. The Brocade BR-CER-2024F-4X-RT-AC - Brocade NetIron CER 2024F-4X goes for about $21k and we need two of them. That is enough to buy a full year of unlimited 10G internet. And even then, we would be short on 10G ports. It is not that we could not bring that money if that was the only way to do it. It is just that I have so many other things that I could spend that money on, that would further our business plans so much more. I can not even say if the Juniper or the Brocade will actually solve my problem. I need it to route to ten of thousands of VLANS (Q-in-Q), both with IPv4 and IPv6. It needs to act as IPv6 router on every VLAN, and very few devices seems to like having that many IP-addresses assigned. It also needs to do VRRP and proxy arp for every VLAN. The advantage of a software solution is that I can test it all before buying. Also to some limited degree, I am able to fix shortcomings myself. Regards, Baldur

4 3