- Test - lists.nanog.org

Re: SSL Certificates
by graham＠g-rock.net 06 Jan '12

06 Jan '12

We use rapidssl. Seems to be ok across the board. No reports otherwise. Sent from my HTC on the Now Network from Sprint! ----- Reply message ----- From: "Michael Carey" <mcarey(a)kinber.org> Date: Fri, Jan 6, 2012 8:15 am Subject: SSL Certificates To: <nanog(a)nanog.org> Looking for a recommendation on who to buy affordable and reputable SSL certificates from? Symantec, Thawte, and Comodo are the names that come to mind, just wondering if there are others folks use. Thanks, -- Michael D. Carey KINBER Network Engineer mcarey(a)kinber.org M: 814.777.5027 GV: (814) 205-6773 <https://www.google.com/voice#phones> Skype: KINBER.Mike.Carey KINBER - Keystone Initiative for Network Based Education and Research - www.kinber.org PennREN - Pennsylvania's Research and Education Network

1 0

question regarding US requirements for journaling public email (possible legislation?)
by Eric J Esslinger 06 Jan '12

06 Jan '12

Hope yall had an 'eventless' holiday. (I.e. no pages at 2 am on a holiday morning). Sorry to drop what is possibly just someone misunderstanding something or pulling my leg on the list, but over the holidays I ran into one of my buddies that is also a network admin type and he was griping about mail journalling, which I already do for our corporate email accounts. However, his discussion was in terms of all customer email... Which I said was probably a bad thing to do. His response was there is legislation being pushed in both House and Senate that would require journalling for 2 or 5 years, all mail passing through all of your mail servers. I've seen nothing, and my google fu has turned up nothing other than corporate requirements, so I ask here. Has anyone heard of such a bill working it's way through either side of congress? (I am speaking specifically of full email journaling, not just logs, which I do archive for significant amounts of time.) I also don't want to discuss the pros, cons, merits, costs, goods, or evils of such a requirement, just wanted to know if this is something I should be looking forward towards maybe needing to implement. Thanks for your attention and may you have a low incident new year. __________________________ Eric Esslinger Information Services Manager - Fayetteville Public Utilities http://www.fpu-tn.com/ (931)433-1522 ext 165 This message may contain confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.

8 11

anycast load balancing issue
by Måns Nilsson 06 Jan '12

06 Jan '12

Hi, I'm in the process of deploying an anycast DNS service internally. We're on a pretty provider-like network, where we run MPLS to provide several network overlays for different services. iBGP is used to distribute routing information, and ISIS is used as IGP. In one of the VRFen we would like to place name servers using a common IP address. To get speedy network updates when outages occur we'll be using OSPF on the name servers to inject the routes into the IGP. The P/E router then redistributes the route into the right VRF. (the name server OSPF process is not aware of MPLS; it just talks to a router.) So far so good. This works. Trouble is, we find that (untweaked) cost and metric are such that all nodes are equal. The last resort (peer router ID) gets invoked and all traffic goes to one single instance. Of course, when that instance falls off the net recalculation takes place and another node steps in, but I'd like true path lengths (IGP hop count) to influence more than iBGP (route-reflector-style) selection. Any clues? Oh, all-cisco, all ASR1000 series. All links GE. ~90 routers in IGP. -- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE +46 705 989668 ... this must be what it's like to be a COLLEGE GRADUATE!!

4 5

"Non-vendor neutral" hosting/colocation
by Christopher J. Pilkington 06 Jan '12

06 Jan '12

We are experiencing an issue in NYCMNY where the hosting facility's owner, a large IXC and CLEC, is being less than cooperative in allowing the ILEC delivering a private circuit to the hosting facility. They will allow ILEC to deliver the circuit elsewhere in the building, but will not provide us a cross connect to this facility. Hosting provider will however gladly use their own CLEC to provide us the service and provide cross connect to same. I have no details on whether this is contractually permitted or not. Another circuit from a third IXC/CLEC ran into a similar problem. This carrier "resolved it" by using the hosting company's CLEC for local loop, even though third carrier has lit facilities elsewhere in said facility. We have concerns for future issues involving the merger of a previous vendor-neutral hosting facility company and another telco provider. Any experiences or advice, on or off list, would be helpful. Also, comments from regulatory geeks would be interesting as well. -cjp

3 2

Trouble accessing www.nanog.org
by Ronald Bonica 05 Jan '12

05 Jan '12

Is anyone else having trouble accessing www.nanog.org. I can ping the site but don't get any response from HTTP requests. -------------------------- Ron Bonica vcard: www.bonica.org/ron/ronbonica.vcf

13 17

AD and enforced password policies
by Jones, Barry 05 Jan '12

05 Jan '12

Hello all. Happy New Year. I have a requirement to enforce password policies on AD (a tacacs and windows domain). I don't have a great deal of Windows AD knowledge - so a newbie ;-) this is a little off topic, but I thought I'd ask... Specifically, I need to enforce the use of length, special characters, and be able to validate the enforcement of such. Looking at Nfront, Quest, etc..., and wanted to see if anyone out there had thoughts? Thank you.

15 24

Comcast Postmaster...
by Matt Kelly 05 Jan '12

05 Jan '12

Would a comcast postmaster be so kind as to contact me off list? Thanks. -- Matt

1 0

Internet Edge and Defense in Depth
by Holmes,David A 05 Jan '12

05 Jan '12

Some firewall vendors are proposing to collapse all Internet edge functions into a single device (border router, firewall, IPS, caching engine, proxy, etc.). A general Internet edge design principle has been the "defense in depth" concept. Is anyone collapsing all Internet edge functions into one device? Regards, David ________________________________ This communication, together with any attachments or embedded links, is for the sole use of the intended recipient(s) and may contain information that is confidential or legally protected. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, dissemination, distribution or use of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return e-mail message and delete the original and all copies of the communication, along with any attachments or embedded links, from your system.

13 13

Looking for a Tier 1 ISP Mentor for career advice.
by Tyler Haske 05 Jan '12

05 Jan '12

Hi. I have some big goals and a lot of enthusiasm but I need direction. I'm looking for a mentor who can help me focus my career so eventually I wind up working at one of the Tier I ISPs as a senior tech. I want to handle the big pipes that hold everyone's data. This is what I want to do with my life. I have my CCNA, and when I graduate college I'll have a CCNP, and the ability to move anywhere in the USA. Please message me off-list. Thank you, Tyler.

23 26

IPv6 resolvers
by Seth Mos 05 Jan '12

05 Jan '12

Hi Nanog, Owen, I was wondering if many people are seeing horrendous latency on the free Hurricane Electric resolvers? Both accessing the v4 or v6 resolvers have horrendous latency. This could well be coupled to their free nature and popularity. So far when contacting Hurricane Electric they restart the resolver on their end and all is well again, but now other pfSense users in the US were noticing these latency issues as well, leading me to believe it is a larger issue. But I was wondering if a more permanent solution for these resolvers exist. 74.82.42.42 2373 msec 2001:470:20::2 2592 msec The google DNS server I'm using is doing swimmingly so far, OpenDNS seems ok too. 2001:4860:4860::8844 16 msec Kind regards, Seth Mos

6 9