- Test - lists.nanog.org

Re: NANOG List Update - Moving Forward
by Mattias Ahnberg 14 Jul '11

14 Jul '11

On 2011-07-12 07:19, Michael K. Smith - Adhost wrote: > If you have any questions or concerns please let me know. I miss proper List-Id headers for identifying and filtering the list easily. I might have missed some discussion; but why are we moving away from mailman, and what software is in the new system? -- /ahnberg.

4 4

Re: NANOG List Update - Moving Forward
by Steve Feldman 13 Jul '11

13 Jul '11

We're aware of the spam problem and have our top people working on it. Reports of other lingering issues from the change would be appreciated, though. Thanks, Steve On Jul 12, 2011, at 5:03 AM, jim deleskie wrote: > +1 > > On Tue, Jul 12, 2011 at 8:32 AM, William Pitcock > <nenolod(a)systeminplace.net> wrote: >> On Tue, 12 Jul 2011 10:50:38 +0100 (BST) >> Tim Franklin <tim(a)pelican.org> wrote: >> >>>> Thankfully, the current test has been a success. >>> >>> Including stopping non-members from posting to the list, and other >>> anti-spam? >>> >>> I've got a sudden influx this morning of spam addressed to >>> nanog(a)nanog.org :( >>> >> >> Ditto. Getting lots of crap here. >> >> William >> >

9 11

ipv6 address family with vrf
by harbor235 13 Jul '11

13 Jul '11

Has anyone been able to configure ipv4 and ipv6 AFI with VRF instances simultaneously? Using the 7200 and 12.4(25e), under the ipv6 address family the VRF sub commands are not visible, must be a feature? thanx in advance, Mike

4 4

Answer to: Hello List Easy Cisco question.
by bill＠kruchas.com 13 Jul '11

13 Jul '11

Hello, and thanks for all the help. What the issue boiled down to, I was creating the access list just like the static command. Which means I was using the source and destination ports when creating it. You just need the destination port, actually because the firewall "catches" the packet on a different port and un encapsulates the packet and passes it through. The different port was causing the accesslist to reject the packet. so this is what I had: >access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 This is what worked :) >access-list Etherpoint_access_in extended permit tcp any host outside-ip eq 5900 A complete example if anyone who needs it to route external request to an internal host: * access list to permit traffic in access-list Etherpoint_access_in extended permit tcp any host outside-ip eq 5900 *static command to setup the relationship form outside interface to inside host static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 * command to bind the accesslist to the outside interface access-group Etherpoint_access_in in interface Etherpoint Thanks again list Bill Kruchas Below is the full question and details. ***************************************************************** Hello List, First let me say I'm not a heads down network guy, but I have setup several cisco firewalls from pix's some 831's, and now I'm trying to get a asa 5505 configured. ver 7.2 and 5.2 on the ASDM. This has been in and working for some time, granting outbound access. There is only one external useable ip address so everything is using PAT to get out, (although whoever set it up set it up like a nat with a global address pool). I have been trying to get an inbound static command to work, with no luck. First I wonder if I can do a static mapping for ingress on the same IP that is being used for PAT/NAT for egress. And if that is possible why can't I get through, I'm pretty sure the static command is right, and I needed to add two acl's (any to outside) (outside to inside) to get the packet trace in asdm to let the packet into the inside host, but still the translate isn't passing the packet tracing. Please any insight would be greatly appreciated. The log shows the port coming in as something different than what I expect: the 66.152.132.32/1064 should be 66.152.132.32/5900 (for vnc, which is the client I am testing with). These are the lines from the log: >4 Jul 12 2011 11:27:13 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0] >4 Jul 12 2011 11:27:07 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0] >4 Jul 12 2011 11:27:04 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by These are the appropriate lines from the config: >access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 >access-list Etherpoint_access_in extended permit tcp host outside-ip eq 5900 host 192.168.125.8 eq 5900 >global (Etherpoint) 2 interface >nat (Inside) 0 access-list Inside_nat0_outbound >nat (Inside) 2 192.168.125.0 255.255.255.0 >static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 >no threat-detection statistics tcp-intercept >access-group Inside_access_in in interface Inside >access-group Etherpoint_access_in in interface Etherpoint Thanks In Advance Bill Kruchas

1 0

Re: NANOG List Update - Moving Forward
by Robert Bonomi 13 Jul '11

13 Jul '11

Cc: nanog(a)nanog.org.r-bonomi.com In-Reply-To: <1BE304A1-0DA0-4558-83AD-0E4F08F8146D(a)twincreeks.net> > Subject: Re: NANOG List Update - Moving Forward > From: Steve Feldman <feldman(a)twincreeks.net> > Date: Tue, 12 Jul 2011 07:00:51 -0700 > > We're aware of the spam problem and have our top people working on it. > > Reports of other lingering issues from the change would be appreciated, > though. You asked for it, you got it: 1) You broke *all* the mailing-list support addresses. 'nanog-owner' ,etc. *BOUNCE* "user unknown" see mark's inbox for a smoking gun 2) You let non-members post to the list. see mark's inbox for a smoking gun 3) You broke the mailing-list *submission* address itself, for subscribers. Although you let non-member *SPAM* through. 4) You have dropped _all_ the the received lines _before_ the message gets to the list. see mark's inbox for a smoking gun -- one of the spam messages 5) You are *NOT* using 'custom 'From ' lines, meaning you cannot tell who the subscriber is when a forwarded message bounces. see mark's inbox for a smoking gun -- one of the spam messages 6) You dropped *ALL* the list-management info headers. see mark's inbox for a smoking gun -- one of the spam messages 7) You rolled changes out with _NOBODY_AROUND_ to take complaints from users who noticed problems. 8) You are mailing to "undisclosed recipients". This indicates "less than competent", *lazy*, mailing-list management practices. AND making it impossible for the recipient to determine _what_ e-mail address the message was actually sent to, *if* for instance they need to change their subscription information on a 'forwarded' (or worse, _multiply-forwarded_) subscription address. see mark's inbox for a smoking gun -- one of the spam messages 9) Others report you lost some, if not all, of the established mailing 'preferences' for subscribers. *AND* all this was on the *second* attempt, having already utterly botched the first one. Reports were being sent to Mark's email (he who posted the announcement, the 'test' and the notice saying things were 'apparently working') roughly 2-1/2 hours after the -first- problem surfaced. SIX hours later the problem was still occuring. "Asleep at the switch" would seem to apply. Considering =ALL= of the above the statement that you have your "top people" working on the matter is not in the least reasurring. One *also* has to "wonder" -- considering all the other things that were 'lost', if the existing suppression filters -- specifically those which keep 'banned' traffic off the list -- were *also* 'lost'. One _really_ has to wonder "why" things are being moved off a tested, reliable, and fully reliable platform, to an "obviously" flawed implementation. Methinks the decision-makers owe the list subscribers _some_ explanation with regard to the 'advantages' to be gained by this migration, and why it is necessary.

4 4

NANOG Updates - Important
by Michael K. Smith - Adhost 13 Jul '11

13 Jul '11

Thank you for your patience as we moved forward with our NANOG transition. We are excited to announce the opening of NANOG 53 registration. You will notice a new format and the need to create a user id and password to complete your registration. We are confident you will find the new system very intuitive and helpful as we continue to move forward. As always, there are opportunities to improve. Feel free to send any questions, suggestions, or concerns to nanog-support(a)nanog.org With respect to NANOG list services. The NANOG Board has decided not to move forward with the mail list and archive transition from Mailman to ARO at this time. For the time being we are operating on our existing hardware in Ann Arbor, MI. We will however, be preparing for a move to an alternate site. As we confirm further details we will be sure to send them along to you. Again, if you have any questions, suggestions, or concerns please send them to nanog-support(a)nanog.org. Sincerely, Michael K. Smith NANOG CC Chair

1 0

using NESSUS to prepare for PenTest Sec. Audit
by Mike Gatti 12 Jul '11

12 Jul '11

Has anyone used Nessus PF (www.nessus.org) as a tool to run a self audit preparing for a PenTest Audit? I wanted to get your opinion on the tool and if it was useful preparing for a PenTest Audit? Thanks, -- Michael Gatti cell.949.735.5612 ekim.ittag(a)gmail.com (UTC-8)

2 1

ep.net contact?
by Chris Griffin 12 Jul '11

12 Jul '11

Could someone involved in ep.net contact me off list in regard to a DNS issue. Usual contact methods have failed to date. Thanks Chris --- Chris Griffin cgriffin(a)ufl.edu Sr. Network Engineer - CCNP Phone: (352) 273-1051 CNS - Network Services Fax: (352) 392-9440 University of Florida/FLR Gainesville, FL 32611

1 1

Re: NANOG List Update - Moving Forward
by Grant Taylor 12 Jul '11

12 Jul '11

On 07/12/11 03:21, Mikael Abrahamsson wrote: > The new posts do not have list (un)subscribe information in the headers. Also, subscriptions that were set to no mail delivery are now delivering mail. Is this expected? Grant. . . .

2 1

Re: NANOG List Update - Moving Forward
by Gerry Boudreaux 12 Jul '11

12 Jul '11

On Jul 12, 2011, at 00:19 , Michael K. Smith - Adhost wrote: > Mailman is shut down on s0.nanog.org and mail is being routed directly to > mail.amsl.com where it is being processed by our new list (etc.) system. Will the list archives migrate? What about future list archives? Thanks G

2 1