- Test - lists.nanog.org

[NANOG-announce] Survey Reminder
by Betty Burke <betty＠nanog.org> 14 Jun '12

14 Jun '12

NANOGers; Thank you to those recently participating in NANOG 55, Vancouver. Either as an on-site or remote attendee, speaker, sponsor, or member, your opinions are valued. If you have not yet completed the NANOG 55 survey(s), we would greatly appreciate you taking the time to complete them by visiting the NANOG 55 Survey http://www.nanog.org/meetings/nanog55/surveys.html The surveys will close at end of day Friday, June 15, 2012. Remember, your feedback will help us take action to continuously improve the NANG meeting experience! Sincerely, Betty -- Betty Burke NANOG Executive Director _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

WLC vlan size and management
by Andrey Khomyakov 14 Jun '12

14 Jun '12

Hi list, If I may ask for your advice, I have a Cisco 5508 WLC. Need to use it to manage APs at multiple buildings which I plan on doing using AP Groups. I understand that if I have one SSID mapped to one VLAN I can do it within the AP group and all is well. In my case, I have to provide a single SSID, but be able to assign clients into vlans based on their credentials. ACS 5.2 takes care of that with Tunnel-Private-Group-ID. Currently, I only have it managing one building, so the problem is only looming, but need to start converting my fat APs to LWAPs in other places. That means "way more clients than I can fit into a /24 or even a /23". The way I have it configured right now is as follows: 1. I have interfaces created in the WLC with names corresponding to the value that gets sent in Tunnel-Private-Group-ID (this is done because there are multiple controllers, but I can adjust to a tag instead. Though I don't think this will help in my case) 2. I have these interfaces grouped into an interface group. 3. I have the WLAN created and mapped to the interface group (which I'm pretty sure is not important, since AP group overrides this) 4. I have an AP Group with my APs in just this one building and that has that very same WLAN mapped to the same interface group mentioned above 5. ACS sends back the interface name in Tunnel-Private-Group-ID and the client gets placed into an appropriate vlan based on client's credentials Now the issue 1. I need to add other buildings full of APs, so I'm guessing more AP groups (one per building) 2. If I map the next new AP group to the same interface group it will work and the clients will get placed into the same vlans as the clients above 3. The issue is that at some point I will exhaust the DHCP scopes. I'm thinking that somehow I need to be able to place clients into an appropriate vlan based no only on credentials but also on location (that is building). What I can't find is how to match clients based on AP location in my WLC 7.0 + ACS 5.2 setup. The best I could come up with is tracking all AP's mac addresses and match Called-Station-ID based on those address, but that's a nightmare in my opinion. How do others do it? I would imaging there are some kind of "spill over" features that have to exist out there or some other technique Thanks, --Andrey

1 0

HE IPv6 tunnel inbound
by Grant Ridder 14 Jun '12

14 Jun '12

Hi, I have a Hurricane Electric v6 tunnel setup on an AWS (amazon web services) instance so that i can have ipv6 connectivity. I can ping and traceroute out of the tunnel fine, but am unable to access the tunnel from outside. For example, i am unable to traceroute to the tunnel address outside the tunnel address, even with the AWS instance firewall completely open. I would like to host a website accessible via IPv6, hence the tunnel setup. Is this possible? if so, what could i be doing wrong? Or is there a better was to go about this? Thanks, Grant

7 7

Re: HE IPv6 tunnel inbound
by Grant Ridder 14 Jun '12

14 Jun '12

Hi, Thanks for all the replies. I will look at Chris's solution to see if that will work. I had found similar instructions, but none as extensive. Also, I am using the AWS free tier right now, hence the choice, but i am open to other suggestions. Thanks, Grant On Thu, Jun 14, 2012 at 7:54 AM, seth <seth(a)untethered.org> wrote: > > > > > On Jun 13, 2012, at 11:10 PM, Cameron Byrne <cb.list6(a)gmail.com> wrote: > > > On Jun 13, 2012 8:29 PM, "Grant Ridder" <shortdudey123(a)gmail.com> wrote: > >> > >> Hi, > >> > >> I have a Hurricane Electric v6 tunnel setup on an AWS (amazon web > > services) > >> instance so that i can have ipv6 connectivity. I can ping and > traceroute > >> out of the tunnel fine, but am unable to access the tunnel from outside. > >> For example, i am unable to traceroute to the tunnel address outside the > >> tunnel address, even with the AWS instance firewall completely open. I > >> would like to host a website accessible via IPv6, hence the tunnel > setup. > >> Is this possible? if so, what could i be doing wrong? Or is there a > >> better was to go about this? > >> > >> Thanks, > >> Grant > > > > Sigh. > > > > Or you could take your business to the dozen or so cloud / vps providers > > that support ipv6. ... Softlayer and Arpnetworks come to mind. I have > used > > both with a high level of sucess > > > > CB > > But everybody knows that "amazon" and "cloud" are synonyms.

1 0

Re: very confusing.
by Randy Bush 14 Jun '12

14 Jun '12

NANOG, i strongly desire to restrain this slimeball idiot's trade. please tell me if you have any ideas on how to do so. --- > Be advised that Im following your posts and have your threating > messages to me. If there is an ddos or restraint of trade due to my > ACCIDENTAL email I'll escalate to commerce and FBI. LOL. you are not only a slimeball (who the ietf and nanog admins are scraping out), but an idiot. but do please tell me how i can restrain your trade. would love to discuss your spam with the DoC and FBI. randy

12 11

RE: EBAY and AMAZON
by Hal Murray 14 Jun '12

14 Jun '12

[Snip good collection of security setting suggestions. Does anybody have others or a URL?] > I could never quite understand how anyone could get "phished" by e-mail > since I have never ever seen a "phishing" or other malicious message that > was not obviously so, even when I don't have me spectacles on! Your imagination needs serious recalibration. You are a geek, not a naive, dumb, or unfortunately, typical user. Windows security sucks. Most users will pick convenience over security. What fraction of users (customers) would be happy with your suggested settings? Phishers are smart. They are willing to work for high value targets. Google for >spear phishing<. After you have read a few of those, google for > spear phishing RSA<. >From the comments section of an Arstechnica article on the RSA event: >> So why do any workplace computers in sensitive environments >> have Flash in the first place? > Because the training materials are no doubt flash based. :) If you are interested in security, the whole comments section may be worth scanning. My probably naive view is that this type of problem could easily be solved by having the serious work done on a special class of well locked down machines and making a pool of more open systems available for checking mail or facebook or whatever. I've heard stories of people filling USB slots with epoxy so idiots can't insert thumb drives found in the parking lot or brought from home. I forget the context. -- These are my opinions. I hate spam.

13 15

Patch Management - Windows & RHEL/CentOS based on Date
by Wade Peacock 14 Jun '12

14 Jun '12

Hi All, Does anyone know of a patch management system that will allow us to control the roll out of patches, specifically for Windows but Linux would be nice too, that can use a date to limit whether a patch is rolled out. Ie. Patch to date set to 2012-06-10 So all patches released up to 2012-06-10 will be offer to requesting client. Any patches released after 2012-06-10 will be hidden/not offered until the "Patch to Date" is moved forward. Wade Peacock Production IT | Vision Critical direct 604.629.9358 mobile 604.363.8137 www.visioncritical.com<http://www.visioncritical.com/> New York | London | Vancouver | Paris | Sydney | Chicago | San Francisco | Toronto | Montreal | Calgary

5 4

Re: Article: IPv6 host scanning attacks
by Fernando Gont 13 Jun '12

13 Jun '12

On 06/13/2012 03:37 PM, Dave Hart wrote: >>> "published" and "available" are misleading at best. >> >> It is not. Just scroll down the page, and you'll find the whole article. >> -- it was easy to talk crap than to do that, right? > > Yes, I'm an idiot for believing what I read on that site: > > "Requires Free Membership to View" > > Of course I should have expected that means "scroll past me and the > page of whitespace to view." I wouldn't "announce" the publication of an article that implies the hassle of a registration in order to read it. While it's certainly not "as good as it can get" to have a banner saying "require free membership to view" inserted in the middle of the article body, it's still "acceptable" for me. (Since you're not the first one to think that the article was not free, next time I'll probably make this explicit such that possible trouble is avoided]). >> I find it amazing the number of people that will talk crap when one >> publishes something when compared to the number of people that provides >> technical comments or criticism (even if it's "you're completely wrong >> because of this and that). > > The draft and the article raise valid points about the predictability > of widely-used MAC-derived IIDs, but it does not in any way justify > the headline "Analysis: Vast IPv6 address space actually enables IPv6 > attacks." Whomever wrote that should share their stash. FWIW, the headline was replaced prior to publication. Put another way: I agree with your comment regarding the headline. Cheers, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Flame virus
by Grant Ridder 13 Jun '12

13 Jun '12

Hi Everyone, I realize this is not directly network related, but i thought i would pass the article along anyways. The authors of the Flame virus have started to destroy its existence. http://spectrum.ieee.org/riskfactor/telecom/security/flame-ordered-to-flame… -Grant

1 0

Heads-up: spammer Scott Whittle/iptechlabs.com/iptechnologylabs.com hitting addresses harvested from NANOG list
by Rich Kulawiec 13 Jun '12

13 Jun '12

Spammer Scott Whittle has harvested not only email addresses from the NANOG list archives, but also Message-IDs, and is busily trying to abuse the hell out of them. I've seen 6 (edit: 11) (edit: 14) copies so far this morning, and no doubt more are on the way. He identifies himself thusly: IP Technology Labs Network Communications Simplified Scott Whittle | President | T: +1 301 570 6611 x601 | M/SMS: +1 301 339 3237 | E: scott(a)IpTechnologyLabs.com | W: http://iptechnologylabs.com Although the spam itself carries a return address of Return-Path: <scott.whittle(a)iptechlabs.com> So blocking on the latter should suffice, at least for this round. ---rsk p.s. Pro tip: proofread your spam content before sending: "I am looking contact your Product Manager/Sales Manager regarding possible distribution of our USA made and designed Plug-and-Play VPN products. We are the are a channel friendly company, can offer account protection, and ensure your margins."

4 4