- Test - lists.nanog.org

Re: BGP and Firewalls...
by David 09 Dec '11

09 Dec '11

SSL interception was the most painful -- PaloAlto finally confirmed it as a bug in 3.1.9, havnt upgraded yet. it basicall eats ssl traffic sporadically. had another issue during go-live where a "commit" caused the box to crash (3.1.9) and anothere during that same week where a malformed ssl packet crashed the dataplane. all cases involved significant interruptions because most did not trigger ha-related failovers. palo also support was extremely slow in all cases weve had and from that perspective alone i would not put all of my eggs into it. great box for web filtering from a feature perspective, but my bluecoats were much more stabile in their 4 yr life than the first 2weeks on our 2050s david. Sent from an email server. On Dec 8, 2011, at 10:11 AM, "Gregory Croft" <gcroft(a)shoremortgage.com> wrote: > What kind of Bugs are you running into? > I have two PA500's at the moment and haven't really had any issues with > web filtering. > > > > Thank you, > Gregory S. Croft > > -----Original Message----- > From: David [mailto:david@davidswafford.com] > Sent: Thursday, December 08, 2011 9:50 AM > To: Gregory Croft > Cc: <nanog(a)nanog.org> > Subject: Re: BGP and Firewalls... > > I wouldn't do it. We have 8 x PA-2050s and run into a lot of wierd > bugs.... (just doing web filtering) > > David > > Sent from an email server. > > On Dec 7, 2011, at 12:31 PM, "Gregory Croft" <gcroft(a)shoremortgage.com> > wrote: > >> Hi All, >> >> >> >> Does anyone have any experience with using firewalls as edge devices >> when BGP is concerned? >> >> Specifically the Palo Alto series of devices. >> >> >> >> If so please contact me off list. >> >> >> >> Thank you. >> >> >> >> >> >> Thank you, >> >> Gregory S. Croft >> >> >> >> >>

1 0

Re: [fyodor@insecure.org: C|Net Download.Com is now bundling Nmap with malware!]
by Kyle Duren 09 Dec '11

09 Dec '11

http://download.cnet.com/8301-2007_4-57338809-12/a-note-from-sean-regarding… In case no one saw this yet. -Kyle

3 2

Traceroute explanation
by Meftah Tayeb 08 Dec '11

08 Dec '11

Hey folks, i see a strange traceroute there Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts : 1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

6 11

[NANOG-announce] NANOG 54 Hotel Update
by Betty Burke <betty＠nanog.org> 08 Dec '11

08 Dec '11

Dear NANOG Community, On behalf of the Board of Directors, I am happy to share some wonderful news regarding hotel accommodations for our NANOG 54 meeting in San Diego. The hotel has been undergoing renovations and recently completed remodeling of all its guest rooms and meeting space. The last phase of the hotel remodel will include the main lobby, which they plan to complete before our meeting. The Board has been working closely with the hotel to ensure the remodel will have no effect on NANOG 54, scheduled for February 5 - 8, 2012. As a result of our conversations, the hotel has agreed to reduce the individual guest room rate from $199 +tax/ night to $169 + tax/night. For reservations already made, the hotel will make an adjustment to your daily rate, reflecting the new NANOG 54 rate. In addition, if you make your reservation by January 4th, 2012, you will be entered into a drawing to win 10,000 Starwood Preferred Guest points! For your reference, below please find a copy of the original letter from the hotel. We look forward to seeing you all in San Diego! Sincerely, Betty Burke, Executive Director Greetings from San Diego! We are looking forward to welcoming you to America’s Finest City for the NANOG Annual Meeting in February 2012. Over the last year, The Westin Gaslamp Quarter has completed a refresh of our guest rooms, meeting space and WestinWORKOUT®, and we are in the final phase of our lobby renovation. To celebrate and to help manage your travel expense, we are happy to offer a discounted conference rate of $169 plus tax (originally $199!) For any reservations that have already been made, we will reduce your confirmed rate for you. Early Bird Special: If you make your reservation by January 4, 2012, you will be entered into a drawing to win 10,000 Starwood Preferred Guest points! Be well, Keri Robinson General Manager _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

RE: Flapping POS Interface on Frame-relay between a Juniper and Cisco
by Scott Weeks 08 Dec '11

08 Dec '11

Did Jeff's suggestion work? : interface POS0/0/0 : frame-relay intf-type dce If so, please let the list know, so when someone comes across this thread while searching for the fix they can figure it out without having to email the list. If it didn't help contact me off-line and I will be happy to troubleshoot it with you. scott ________________________________________ From: Righa Shake [righa.shake(a)gmail.com] Sent: Saturday, November 19, 2011 11:11 AM To: afnog(a)afnog.org Subject: Flapping POS Interface on Frame-relay between a Juniper and Cisco Hi, Am having a problem that is buffling. I recently changed a POS link encapsulation from PPP to Frame-relay. Since that time the POS interface keeps resetting from time to time. On my BGP session am receiving cease notifications from my upstream provider. The setup is such that we have a cisco on one end and a Juniper on the other. interface POS0/0/0 mtu 4474 no ip address no ip unreachables encapsulation frame-relay logging event link-status crc 32 pos scramble-atm frame-relay lmi-type ansi end ROUTERshow run int pos0/0/0.101 Building configuration... ! interface POS0/0/0.101 point-to-point ip address X.X.X.X 255.255.255.252 frame-relay interface-dlci 101 end ROUTER#show int pos0/0/0 POS0/0/0 is up, line protocol is up Hardware is SPA-2XOC12-POS MTU 4474 bytes, BW 622000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 6/255, rxload 38/255 Encapsulation FRAME-RELAY, crc 32, loopback not set Keepalive set (10 sec) Scramble enabled LMI enq sent 81981, LMI stat recvd 77480, LMI upd recvd 0, DTE LMI up LMI enq recvd 0, LMI stat sent 0, LMI upd sent 0 LMI DLCI 0 LMI type is ANSI Annex D frame relay DTE segmentation inactive FR SVC disabled, LAPF state down Broadcast queue 0/256, broadcasts sent/dropped 26/0, interface broadcasts 0 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 1w2d Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 94336000 bits/sec, 13151 packets/sec 5 minute output rate 16470000 bits/sec, 7049 packets/sec 12211574207 packets input, 10967607038364 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 6970870 runts, 2179 giants, 0 throttles 0 parity 892493293 input errors, 882184781 CRC, 0 frame, 0 overrun, 0 ignored, 3335463 abort 6379191154 packets output, 1614018181446 bytes, 0 underruns 0 output errors, 0 applique, 4 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions Any assistance on this will be greatly appreciated. --- jsaxe(a)briworks.com wrote: From: Jeff Saxe <jsaxe(a)briworks.com> I believe this is the explanation for your flapping: a PPP link is intended to go between two routers over, for instance, a private leased line, so both of the devices are peers, neither one particularly special. Frame-relay, by contrast, was originally designed so that your router was an "end user" device and its directly-connected partner device was not your other router, which you control, but the frame carrier's frame-relay switch. Your router was a DTE device, and their switch, which was in a more "important" position in control of the frame-relay NBMA cloud, was the DCE device. Your router then slaved to the frame switch via LMI signaling, so that the upstream switch instructed you which DLCIs existed and were up at the moment. So if you connect up two routers with frame-relay encap and each thinks it is the DTE, and neither one is taking the role of the frame switch, then when you bring them up, they will initially optimistically think their DLCIs are up and working, and the routing protocol and traffic will come up... but both of them will be waiting for the frame switch to send them LMI indicating that their idea of the DLCI up/down status is correct. When a couple minutes go by and they don't hear the responses to their LMI enquiries, they will bring all the DLCI's down. I thought they would then stay down forever, i.e., not flap, but maybe you are shutting / no shutting the POS circuit to try again. Anyway, I believe the very simple fix is interface POS0/0/0 frame-relay intf-type dce So this will turn your Cisco side of the circuit into "DCE" mode, and if the Juniper side stays in "DTE" mode (the default, so probably not listed in the config), then the LMI should start behaving between the two. And yes, as Jay Hennigan suggested, you might need to use "encap frame-relay ietf" to be compatible with non-Cisco gear, or you might need to adjust the frame-relay lmi-type -- one type sends the LMI on DLCI number 0, one of them on DLCI 1023, whatever. I think you'll need to adjust the two ends until you see LMI enquiries both sent and received; right now the "show interface" from the Cisco side shows it has not received any LMI enq yet. Good luck, and I hope it's that simple. :-)

3 3

128.0.0.0/16 configured as martians in some routers
by Alex Le Heux 08 Dec '11

08 Dec '11

Dear Colleagues, The RIPE NCC is aware that 128.0.0.0/16 is configured as a martian by default in (some) Juniper OS, even though RFC 5735 and RFC3330 outline that this /16 should no longer be reserved as specialised address space. All allocations that were already issued have been exchanged and for now we will hold this space in quarantine. We urge everyone to change the default behaviour of their Juniper routers: set routing-options martians 128.0.0.0/16 orlonger allow set routing-options martians 191.255.0.0/16 orlonger allow set routing-options martians 223.255.255.0/24 exact allow 128.0.0.0/16 has been added to the RIPE NCC's Debogonising Project: http://www.ris.ripe.net/debogon/ To facilitate testing, the following prefixes are being announced: prefix pinagble address 128.0.0.0/16 128.0.0.1 128.0.8.0/21 128.0.8.1 128.0.24.0/24 128.0.24.1 Best regards, Alex Le Heux Policy Implementation Co-ordinator RIPE NCC

11 14

[fyodor@insecure.org: C|Net Download.Com is now bundling Nmap with malware!]
by bmanning＠vacation.karoshi.com 08 Dec '11

08 Dec '11

With permission.... ----- Forwarded message from Fyodor <fyodor(a)insecure.org> ----- Date: Mon, 5 Dec 2011 14:35:30 -0800 Hi Folks. I've just discovered that C|Net's Download.Com site has started wrapping their Nmap downloads (as well as other free software like VLC) in a trojan installer which does things like installing a sketchy "StartNow" toolbar, changing the user's default search engine to Microsoft Bing, and changing their home page to Microsoft's MSN. The way it works is that C|Net's download page (screenshot attached) offers what they claim to be Nmap's Windows installer. They even provide the correct file size for our official installer. But users actually get a Cnet-created trojan installer. That program does the dirty work before downloading and executing Nmap's real installer. Of course the problem is that users often just click through installer screens, trusting that download.com gave them the real installer and knowing that the Nmap project wouldn't put malicious code in our installer. Then the next time the user opens their browser, they find that their computer is hosed with crappy toolbars, Bing searches, Microsoft as their home page, and whatever other shenanigans the software performs! The worst thing is that users will think we (Nmap Project) did this to them! I took and attached a screen shot of the C|Net trojan Nmap installer in action. Note how they use our registered "Nmap" trademark in big letters right above the malware "special offer" as if we somehow endorsed or allowed this. Of course they also violated our trademark by claiming this download is an Nmap installer when we have nothing to do with the proprietary trojan installer. In addition to the deception and trademark violation, and potential violation of the Computer Fraud and Abuse Act, this clearly violates Nmap's copyright. This is exactly why Nmap isn't under the plain GPL. Our license (http://nmap.org/book/man-legal.html) specifically adds a clause forbidding software which "integrates/includes/aggregates Nmap into a proprietary executable installer" unless that software itself conforms to various GPL requirements (this proprietary C|Net download.com software and the toolbar don't). We've long known that malicious parties might try to distribute a trojan Nmap installer, but we never thought it would be C|Net's Download.com, which is owned by CBS! And we never thought Microsoft would be sponsoring this activity! It is worth noting that C|Net's exact schemes vary. Here is a story about their shenanigans: http://www.extremetech.com/computing/93504-download-com-wraps-downloads-in-… It is interesting to compare the trojaned VLC screenshot in that article with the Nmap one I've attached. In that case, the user just clicks "Next step" to have their machine infected. And they wrote "SAFE, TRUSTED, AND SPYWARE FREE" in the trojan-VLC title bar. It is telling that they decided to remove that statement in their newer trojan installer. In fact, if we UPX-unpack the Trojan CNet executable and send it to VirusTotal.com, it is detected as malware by Panda, McAfee, F-Secure, etc: http://bit.ly/cnet-nmap-vt According to Download.com's own stats, hundreds of people download the trojan Nmap installer every week! So the first order of business is to notify the community so that nobody else falls for this scheme. Please help spread the word. Of course the next step is to go after C|Net until they stop doing this for ALL of the software they distribute. So far, the most they have offered is: "If you would like to opt out of the Download.com Installer you can submit a request to cnet-installer(a)cbsinteractive.com. All opt-out requests are carefully reviewed on a case-by-case basis." In other words, "we'll violate your trademarks and copyright and squandering your goodwill until you tell us to stop, and then we'll consider your request 'on a case-by-case basis' depending on how much money we make from infecting your users and how scary your legal threat is. F*ck them! If anyone knows a great copyright attorney in the U.S., please send me the details or ask them to get in touch with me. Also, shame on Microsoft for paying C|Net to trojan open source software! Cheers, Fyodor ----- End forwarded message -----

23 40

Juniper MX80 Virtual Chassis
by Skeeve Stevens 08 Dec '11

08 Dec '11

Hey all, Thought I'd ask here to see if anyone has heard. In May 2010 Juniper announced that Virtual Chassis would be available in the MX80 platform in the second half of 2011. Anyone know if it is still being planned for release or if its been removed from the platform features? …Skeeve -- Skeeve Stevens, CEO - eintellego Pty Ltd skeeve(a)eintellego.net<mailto:skeeve@eintellego.net> ; www.eintellego.net Phone: 1300 753 383 ; Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellego twitter.com/networkceoau ; www.linkedin.com/in/skeeve PO Box 7726, Baulkham Hills, NSW 1755 Australia -- eintellego - The Experts Who The Experts Call Juniper - HP Networking - Cisco - Brocade

1 0

GPON Vendors
by Josh V. Hoppes 08 Dec '11

08 Dec '11

Hello NANOG, Due to unforeseen circumstances we need to consider alternative vendors for our GPON system, moving away from Motorola. We wanted to throw out a line and find out what other networks have deployed and what experiences they have had positive or negative with them. Thanks in advance for any replies. Josh Hoppes Network Engineer Cedar Falls Utilities

7 10

Re: [fyodor@insecure.org: C|Net Download.Com is now bundling Nmap with malware!]
by None 07 Dec '11

07 Dec '11

Fyodor wrote: > switched their Nmap downloads back to our real installer. At least > for now. But that isn't enough--they are still infecting the > installers for thousands of other packages! I am sorry about these problems, it is unacceptable. Sourceforge, at least a year or 2 ago, did something that was only slightly less unacceptable. They had (or still have?) ads that would display when you click a donwload link at some site, say http://www.clamwin.com/content/view/18/46/ In this example (and clamwin had no part in that) the redirect of the download link would show an add for another virus scanner (but in fact it was malware, or, so broken it'd behave like malware). I know of actual cases where someone accidentally downloaded the software from the add, and messed up their computer. So much for pointing them to a free virus scanner... -- Earthquake Magnitude: 3.1 Date: Wednesday, December 7, 2011 15:57:44 UTC Location: northern Alaska Latitude: 65.9462; Longitude: -148.7381 Depth: 30.90 km

1 0