- Test - lists.nanog.org

RE: Dual Homed BGP for failover (Ahmed Yousuf)
by James Byaruhanga 19 Jan '11

19 Jan '11

On 2011/01/19 5:28 PM, "nanog-request(a)nanog.org" <nanog-request(a)nanog.org> wrote: >Send NANOG mailing list submissions to > nanog(a)nanog.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://mailman.nanog.org/mailman/listinfo/nanog >or, via email, send a message with subject or body 'help' to > nanog-request(a)nanog.org > >You can reach the person managing the list at > nanog-owner(a)nanog.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of NANOG digest..." > > >Today's Topics: > > 1. Re: NAT-PT or NAT64 in real life (jarod smith) > 2. Re: Software DNS hghi availability and load balancer solution > (Joe Greco) > 3. Re: Software DNS hghi availability and load balancer solution > (Joe Abley) > 4. Re: Software DNS hghi availability and load balancer solution > (InterNetX - J?rgen Gotteswinter) > 5. Re: Network Simulators (Ryan Shea) > 6. RE: Network Simulators (Gary Gladney) > 7. RE: Dual Homed BGP for failover (Randy McAnally) > 8. Re: Network Simulators (Carlos Martinez-Cagnazzo) > 9. RE: Dual Homed BGP for failover (Ahmed Yousuf) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Wed, 19 Jan 2011 13:02:33 +0100 >From: jarod smith <jarod.smouth(a)gmail.com> >Subject: Re: NAT-PT or NAT64 in real life >To: nanog(a)nanog.org >Message-ID: > <AANLkTing2SOssk-yNLOVKSPS4nTRjEwcq+itVWkhrJZC(a)mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Thanks for your reply. > >In summary it's not possible to deployed IPv6 only if I want to access the >whole internet :) > > > >On Wed, Jan 19, 2011 at 10:18 AM, jarod smith ><jarod.smouth(a)gmail.com>wrote: > >> Although it would seem that double-stack is still the preferred method >>of linux >> distribution, I want my next deployed in IPv6 only. >> For linux there is NAT-PT tomicki and NAT64 Viagenie. >> >> I don't have Cisco equipment although I'd like tested their NAT-PT, even >> if it's obsolete. >> >> Are some of you have installed one of these two implementations in >> production on recent versions of linux? Is it stable, secure, ... ? >> >> >> Regards >> > > >------------------------------ > >Message: 2 >Date: Wed, 19 Jan 2011 07:17:07 -0600 (CST) >From: Joe Greco <jgreco(a)ns.sol.net> >Subject: Re: Software DNS hghi availability and load balancer solution >To: paul(a)paulgraydon.co.uk (Paul Graydon) >Cc: nanog(a)nanog.org >Message-ID: <201101191317.p0JDH74H076996(a)aurora.sol.net> >Content-Type: text/plain; charset=us-ascii > >> On 01/18/2011 07:42 AM, Sergey Voropaev wrote: >> > Does any one know software sollutions (free is preferable) like as >>cisco GSS >> > and F5 BIG-IP? The main point is that DNS-server (or dns server >>plugin) must >> > be able to monitor server availability (for example by TCP connect) >>and from >> > DNS-reply depends on it. >> > >> > I know that it is possible by BIND with set of script. But we are >>trying to >> > find more usable solution with frendly interface. >> > >> > Thanks a lot. >> >> If you want to get fancy you could try an Anycast DNS setup, using >>GNU's >> Zebra tool to automatically alter routing tables. >> >>http://www.netlinxinc.com/netlinx-blog/45-dns/118-introduction-to-anycast >>-dns.html > >You wouldn't use Zebra; it isn't actively developed anymore and has >not been updated in many years. Use Quagga instead, which is the >community-based offshoot. > >... JG >-- >Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net >"We call it the 'one bite at the apple' rule. Give me one chance [and] >then I >won't contact you again." - Direct Marketing Ass'n position on e-mail >spam(CNN) >With 24 million small businesses in the US alone, that's way too many >apples. > > > >------------------------------ > >Message: 3 >Date: Wed, 19 Jan 2011 08:23:09 -0500 >From: Joe Abley <jabley(a)hopcount.ca> >Subject: Re: Software DNS hghi availability and load balancer solution >To: Joe Greco <jgreco(a)ns.sol.net> >Cc: nanog(a)nanog.org >Message-ID: <B3ABA767-D8DC-4806-A127-AD0BD5138960(a)hopcount.ca> >Content-Type: text/plain; charset=us-ascii > > >On 2011-01-19, at 08:17, Joe Greco wrote: > >> You wouldn't use Zebra; it isn't actively developed anymore and has >> not been updated in many years. Use Quagga instead, which is the >> community-based offshoot. > >I don't think this is what the original post was asking about, but for >the sake of completeness other alternatives to Zebra/Quagga (when using >BGP between anycast origin servers and adjacent routers, e.g. with >multipath configured on the routers) are OpenBGPd and BIRD. > >See earlier suggestions for bedtime reading, also: ><http://www.merit.edu/mail.archives/nanog/msg06970.html>. > > >Joe > > > > >------------------------------ > >Message: 4 >Date: Wed, 19 Jan 2011 14:27:52 +0100 >From: InterNetX - J?rgen Gotteswinter > <juergen.gotteswinter(a)internetx.de> >Subject: Re: Software DNS hghi availability and load balancer solution >To: nanog(a)nanog.org >Message-ID: <4D36E6D8.9000408(a)internetx.de> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Am 19.01.11 01:01, schrieb david raistrick: >> >>> On 01/18/2011 09:42 AM, Sergey Voropaev wrote: >>>> Does any one know software sollutions (free is preferable) like as >>>> cisco GSS >>>> and F5 BIG-IP? The main point is that DNS-server (or dns server >>>> plugin) must >>>> be able to monitor server availability (for example by TCP connect) >>>> and from >>>> DNS-reply depends on it. >>>> >> >> On Tue, 18 Jan 2011, Charles N Wyble wrote: >>> >>> Ha-proxy and linux virtual server are popular packages. >> >> Neither of these do DNS. He asked about DNS based loadbalancing (also >> known as GSLB, among other things) software packages.... >> > >haproxy doesnt, > > >lvs works for dns very well, take a look at keepalived >(www.keepalived.org) it supports lvs + vrrp. > >> >> >> -- >> david raistrick http://www.netmeister.org/news/learn2quote.html >> drais(a)icantclick.org http://www.expita.com/nomime.html >> >> >> > > > > >------------------------------ > >Message: 5 >Date: Wed, 19 Jan 2011 08:36:31 -0500 >From: Ryan Shea <ryanshea(a)google.com> >Subject: Re: Network Simulators >To: Brandon Kim <brandon.kim(a)brandontek.com> >Cc: nanog group <nanog(a)nanog.org> >Message-ID: > <AANLkTinzXRVwa-sGirFLieDS6GJ7cH=YzbgOWKbXqbuJ(a)mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1 > >You can do some switching by stuffing a virtual NM-16ESW into your >faketastic 3660 in Dynamips. Then there are the built-in frame-relay and >ethernet switches you could dump into the mix as well. > >-Ryan > >On Mon, Jan 17, 2011 at 10:23 AM, Brandon Kim ><brandon.kim(a)brandontek.com>wrote: > >> >> James: >> >> I've been resisting GNS3 for the longest time, because I like real >> equipment and to get my hands a little dirty. >> But for the purpose of simulation, GNS3 helped me identify a BGP issue >>last >> week. If it weren't for GNS3, >> I would not have been able to figure it out. >> >> I will be using GNS3 in the future now for as much I can. Remember it is >> more router oriented than switch. >> >> So you can't do any fancy L3 switching...... >> >> >> >> > Date: Mon, 17 Jan 2011 10:05:21 -0500 >> > From: james(a)freedomnet.co.nz >> > To: nanog(a)nanog.org >> > Subject: Re: Network Simulators >> > >> > So far GNS3 has won out so far. It seems to work on my Mac fairly >>well. >> > trying it out now. >> > >> > On 17/01/11 9:37 AM, Carlos Martinez-Cagnazzo wrote: >> > > I am currently researching virtual simulation environments for the >> > > Networking courses that I teach. I am now interested in user-mode >> > > linux emulators as they provide more real environments. >> > > >> > > The one that I am liking the most right now is this one: >> > > http://wiki.netkit.org/index.php/Main_Page >> > > >> > > regards >> > > >> > > Carlos >> > > >> > > On Mon, Jan 17, 2011 at 12:20 PM, Arturo Servin< >> arturo.servin(a)gmail.com> wrote: >> > >> GNS3 >> > >> http://www.gns3.net/ >> > >> >> > >> This is another network simulator, mainly for academic >> research. >> > >> >> > >> NS-2 >> > >> http://www.isi.edu/nsnam/ns/ >> > >> >> > >> And you can always setup some virtual machines with DNSs, >> hosts and routers with open-source software. >> > >> >> > >> regards, >> > >> -as >> > >> >> > >> On 17 Jan 2011, at 11:58, James Jones wrote: >> > >> >> > >>> Are there any good Network Simulators/Trainers out there that >>support >> IPv6? I want play around with some IPv6 setup. >> > >>> >> > >>> -- >> > >>> James Jones >> > >>> +1-413-667-9199 <tel:+14136679199> >> > >>> james(a)freedomnet.co.nz >> > >>> >> > >> >> > > >> > > >> > >> >> > > >------------------------------ > >Message: 6 >Date: Wed, 19 Jan 2011 13:52:20 +0000 >From: Gary Gladney <gladney(a)stsci.edu> >Subject: RE: Network Simulators >To: Brandon Kim <brandon.kim(a)brandontek.com> >Cc: nanog group <nanog(a)nanog.org> >Message-ID: > <1B0C5329DB4558419BE8B3440A66ADF306E2B432(a)EXCHMAIL1.stsci.edu> >Content-Type: text/plain; charset="us-ascii" > >If you looking for network simulator for Cisco equipment it's been my >experience that Boson (www.boson.com) has best network simulator for >Cisco equipment. It behaves and process information the way real Cisco >equipment does. I've tried GS3, it great for routing situations but >lacks in simulating switches. > >Gary > >-----Original Message----- >From: Ryan Shea [mailto:ryanshea@google.com] >Sent: Wednesday, January 19, 2011 8:37 AM >To: Brandon Kim >Cc: nanog group >Subject: Re: Network Simulators > >You can do some switching by stuffing a virtual NM-16ESW into your >faketastic 3660 in Dynamips. Then there are the built-in frame-relay and >ethernet switches you could dump into the mix as well. > >-Ryan > >On Mon, Jan 17, 2011 at 10:23 AM, Brandon Kim ><brandon.kim(a)brandontek.com>wrote: > >> >> James: >> >> I've been resisting GNS3 for the longest time, because I like real >> equipment and to get my hands a little dirty. >> But for the purpose of simulation, GNS3 helped me identify a BGP issue >> last week. If it weren't for GNS3, I would not have been able to >> figure it out. >> >> I will be using GNS3 in the future now for as much I can. Remember it >> is more router oriented than switch. >> >> So you can't do any fancy L3 switching...... >> >> >> >> > Date: Mon, 17 Jan 2011 10:05:21 -0500 >> > From: james(a)freedomnet.co.nz >> > To: nanog(a)nanog.org >> > Subject: Re: Network Simulators >> > >> > So far GNS3 has won out so far. It seems to work on my Mac fairly >>well. >> > trying it out now. >> > >> > On 17/01/11 9:37 AM, Carlos Martinez-Cagnazzo wrote: >> > > I am currently researching virtual simulation environments for the >> > > Networking courses that I teach. I am now interested in user-mode >> > > linux emulators as they provide more real environments. >> > > >> > > The one that I am liking the most right now is this one: >> > > http://wiki.netkit.org/index.php/Main_Page >> > > >> > > regards >> > > >> > > Carlos >> > > >> > > On Mon, Jan 17, 2011 at 12:20 PM, Arturo Servin< >> arturo.servin(a)gmail.com> wrote: >> > >> GNS3 >> > >> http://www.gns3.net/ >> > >> >> > >> This is another network simulator, mainly for academic >> research. >> > >> >> > >> NS-2 >> > >> http://www.isi.edu/nsnam/ns/ >> > >> >> > >> And you can always setup some virtual machines with DNSs, >> hosts and routers with open-source software. >> > >> >> > >> regards, >> > >> -as >> > >> >> > >> On 17 Jan 2011, at 11:58, James Jones wrote: >> > >> >> > >>> Are there any good Network Simulators/Trainers out there that >> > >>> support >> IPv6? I want play around with some IPv6 setup. >> > >>> >> > >>> -- >> > >>> James Jones >> > >>> +1-413-667-9199 <tel:+14136679199> >> > >>> james(a)freedomnet.co.nz >> > >>> >> > >> >> > > >> > > >> > >> >> > > > >------------------------------ > >Message: 7 >Date: Wed, 19 Jan 2011 09:00:28 -0500 >From: "Randy McAnally" <rsm(a)fast-serv.com> >Subject: RE: Dual Homed BGP for failover >To: "Ahmed Yousuf" <ayousuf0079(a)gmail.com>,"'nanog group'" > <nanog(a)nanog.org> >Message-ID: <20110119140022.M30623(a)fast-serv.com> >Content-Type: text/plain; charset=iso-8859-1 > >On Wed, 19 Jan 2011 10:23:47 -0000, Ahmed Yousuf wrote > >> - Accept that we are never going to get an ideal >> distribution of traffic and continue monitoring and adjusting local >> pref/prepends etc. as and when we need to change the distribution of >> traffic. Hopefully we don't need to do this that often. > > >^ This. You're fighting a loosing battle with such slow links. Given the >limited route capacity of your router you might as well set up statics >aimed >at each link and forget about BGP shaping. Just keep a floating default >pointed at each peer. > >-Randy > > > >------------------------------ > >Message: 8 >Date: Wed, 19 Jan 2011 12:27:27 -0200 >From: Carlos Martinez-Cagnazzo <carlosm3011(a)gmail.com> >Subject: Re: Network Simulators >To: nanog(a)nanog.org >Message-ID: > <AANLkTikkwtptwNxxC0CTHuJ+nHzs9SeFMZXeo13+KCBG(a)mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Anything for Junipers ? > >On Wed, Jan 19, 2011 at 11:52 AM, Gary Gladney <gladney(a)stsci.edu> wrote: >> If you looking for network simulator for Cisco equipment it's been my >>experience that Boson (www.boson.com) has best network simulator for >>Cisco equipment. ?It behaves and process information the way real Cisco >>equipment does. ?I've tried GS3, it great for routing situations but >>lacks in simulating switches. >> >> Gary >> >> -----Original Message----- >> From: Ryan Shea [mailto:ryanshea@google.com] >> Sent: Wednesday, January 19, 2011 8:37 AM >> To: Brandon Kim >> Cc: nanog group >> Subject: Re: Network Simulators >> >> You can do some switching by stuffing a virtual NM-16ESW into your >>faketastic 3660 in Dynamips. Then there are the built-in frame-relay and >>ethernet switches you could dump into the mix as well. >> >> -Ryan >> >> On Mon, Jan 17, 2011 at 10:23 AM, Brandon Kim >><brandon.kim(a)brandontek.com>wrote: >> >>> >>> James: >>> >>> I've been resisting GNS3 for the longest time, because I like real >>> equipment and to get my hands a little dirty. >>> But for the purpose of simulation, GNS3 helped me identify a BGP issue >>> last week. If it weren't for GNS3, I would not have been able to >>> figure it out. >>> >>> I will be using GNS3 in the future now for as much I can. Remember it >>> is more router oriented than switch. >>> >>> So you can't do any fancy L3 switching...... >>> >>> >>> >>> > Date: Mon, 17 Jan 2011 10:05:21 -0500 >>> > From: james(a)freedomnet.co.nz >>> > To: nanog(a)nanog.org >>> > Subject: Re: Network Simulators >>> > >>> > So far GNS3 has won out so far. It seems to work on my Mac fairly >>>well. >>> > trying it out now. >>> > >>> > On 17/01/11 9:37 AM, Carlos Martinez-Cagnazzo wrote: >>> > > I am currently researching virtual simulation environments for the >>> > > Networking courses that I teach. I am now interested in user-mode >>> > > linux emulators as they provide more real environments. >>> > > >>> > > The one that I am liking the most right now is this one: >>> > > http://wiki.netkit.org/index.php/Main_Page >>> > > >>> > > regards >>> > > >>> > > Carlos >>> > > >>> > > On Mon, Jan 17, 2011 at 12:20 PM, Arturo Servin< >>> arturo.servin(a)gmail.com> ?wrote: >>> > >> GNS3 >>> > >> http://www.gns3.net/ >>> > >> >>> > >> ? ? ? ? This is another network simulator, mainly for academic >>> research. >>> > >> >>> > >> NS-2 >>> > >> http://www.isi.edu/nsnam/ns/ >>> > >> >>> > >> ? ? ? ? And you can always setup some virtual machines with DNSs, >>> hosts and routers with open-source software. >>> > >> >>> > >> regards, >>> > >> -as >>> > >> >>> > >> On 17 Jan 2011, at 11:58, James Jones wrote: >>> > >> >>> > >>> Are there any good Network Simulators/Trainers out there that >>> > >>> support >>> IPv6? I want play around with some IPv6 setup. >>> > >>> >>> > >>> -- >>> > >>> James Jones >>> > >>> +1-413-667-9199 <tel:+14136679199> >>> > >>> james(a)freedomnet.co.nz >>> > >>> >>> > >> >>> > > >>> > > >>> > >>> >>> >> >> > > > >-- >-- >========================= >Carlos M. Martinez-Cagnazzo >http://www.labs.lacnic.net >========================= > > > >------------------------------ > >Message: 9 >Date: Wed, 19 Jan 2011 14:26:32 -0000 >From: "Ahmed Yousuf" <ayousuf0079(a)gmail.com> >Subject: RE: Dual Homed BGP for failover >To: "'nanog group'" <nanog(a)nanog.org> >Message-ID: <008901cbb7e4$f1feb860$d5fc2920$(a)gmail.com> >Content-Type: text/plain; charset="us-ascii" > >We're doing BGP to announce our PI space and make sure that our PI space >is >reachable through both ISPs in case one link goes down. This is the >primary >need to do the BGP here. Unfortunately my boss has requested that we make >use of the capacity of both links, rather than pref traffic out of the >higher capacity link. > >-----Original Message----- >From: Randy McAnally [mailto:rsm@fast-serv.com] >Sent: 19 January 2011 14:00 >To: Ahmed Yousuf; 'nanog group' >Subject: RE: Dual Homed BGP for failover > >On Wed, 19 Jan 2011 10:23:47 -0000, Ahmed Yousuf wrote > >> - Accept that we are never going to get an ideal >> distribution of traffic and continue monitoring and adjusting local >> pref/prepends etc. as and when we need to change the distribution of >> traffic. Hopefully we don't need to do this that often. > > >^ This. You're fighting a loosing battle with such slow links. Given the >limited route capacity of your router you might as well set up statics >aimed >at each link and forget about BGP shaping. Just keep a floating default >pointed at each peer. > >-Randy > > > > >------------------------------ > >_______________________________________________ >NANOG mailing list >NANOG(a)nanog.org >https://mailman.nanog.org/mailman/listinfo/nanog > >End of NANOG Digest, Vol 36, Issue 120 >************************************** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error please contact the sender immediately by returning electronic transmission and then immediately delete this transmission including all attachments without copying distributing or disclosing the same. Any views or opinions presented are solely those of the author and do not necessarily represent those of Roke Telkom.

1 0

PacketExchange/Mzima
by Andrew Kirch 19 Jan '11

19 Jan '11

Need a PacketExchange/Mzima admin to contact me off list regarding an AS Number issue. Andrwe

1 0

Routing Suggestions
by Lars Carter 19 Jan '11

19 Jan '11

Hi NANOG list, I have a simple, hypothetical question regarding preferred connectivity methods for you guys that I would like to get the hive mind opinion about. There are two companies, Company A and Company B, that are planning to continuously exchange a large amount of sensitive data and are located in a mutual datacenter. They decide to order a cross connect and peer privately for the obvious reasons. Company A has a small but knowledgable engineering staff and it's network is running BGP as its only routing protocol with multiple transit vendors and a handful of other larger peers. Company B is a smaller shop that is single homed behind one ISP through a default static route, they have hardware that can handle advanced routing protocols but have not had the need to implement them as of yet. There is a single prefix on both sides that will need to be routed to the other party. It is rare that prefixes would need to change or for additional prefixes to be added. >From an technical, operational, and security standpoint what would be the preferred way to route traffic between these two networks? Cheers, Lars

17 21

Auto ACL blocker
by Brian R. Watters 19 Jan '11

19 Jan '11

We are looking for the following solution. Honey pot that collects attacks against SSH/FTP and so on Said attacks are then sent to a master ACL on a edge Cisco router to block all traffic from these offenders .. Of course we would require a master whitelist as well as to not be blocked from our own networks. Any current solutions or ideas ?? -- BRW

10 14

Authentication using Microsoft 2008 Active directory for Cisco RADIUS login
by Michael Ruiz 19 Jan '11

19 Jan '11

Hello all, I am having some trouble getting my Cisco routers to use Active directory to authenticate users. I have searched on Google and so far I am coming up dry on good documentation that will work. I have used these links. http://briandesmond.com/blog/how-to-authenticate-against-active-director y-from-cisco-ios/ http://filedb.experts-exchange.com/incoming/2008/12_w51/87700/TA0001-Win dows-2008-RADIUS-for-C.pdf When I am doing a debug against the AAA I am getting the "Response (32) failed decrypt" error. Any thoughts? Thank you in advance. M.A.R

4 3

adaptec 5405 wedged
by Randy Bush 19 Jan '11

19 Jan '11

any adaptec bios-level fu out there? if so, please see http://archive.psg.com/110119.adaptec.pdf thanks randy

3 2

Request Spamhaus contact
by Jeffrey Lyon 18 Jan '11

18 Jan '11

Someone at Spamhaus please contact me concerning your second consecutive preemptive strike against our IP space. Fun Fact: No one at Spamhaus has ever successfully sent us an abuse complaint. Also, some rocket scientist decided that their sbl-removals@ box should also filter e-mail so blocked parties can't even get in touch. As such, it will be necessary to reply to jeffrey.lyon(a)gmail.com vs. @blacklotus.net . You claim to monitor sbl-removals@ but it seems i've been ignored for several hours. -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

27 96

PCCW Admin
by Andrew Kirch 18 Jan '11

18 Jan '11

Would a PCCW admin contact me off-list regarding one of your customers? Andrew

1 0

Re: Software DNS hghi availability and load balancer solution
by William Herrin 18 Jan '11

18 Jan '11

On Tue, Jan 18, 2011 at 3:49 PM, Dorn Hetzel <dorn(a)hetzel.org> wrote: > If it wouldn't be too ugly, could this be circumvented by having the web > application continually do its next operation against an incrementing > subhost name like syymmddhhmmss or snnnnnnn.www.foo.com in order to convince > the local browser and client os to do a fresh lookup? Hi Dorn, There's an efficiency problem where you can no longer pipeline http requests and have to delay every http request while a DNS lookup happens. Also it'd probably crush your google pagerank. And you still wouldn't get around the javascript in your web 2.0 pages needing to go back to the same server name it came from in order to update the content on those pages. The custom name strategy does have some other really neat applications though. You can track a session without setting a cookie. And consider a large email system: suppose you encode the account name in the server name and then point that encoded name to the server which actually holds that user's account? You can eliminate the expensive front-end that multiplexes user access to the backend servers. Regards, Bill Herrin -- William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

1 0

Re: Auto ACL blocker
by Brian R. Watters 18 Jan '11

18 Jan '11

Agreed, time to live in the ACL is critical as well .. this is primary to be used to stop sweeps and penetration testing .. We have SNORT deployed now but the process is still manual on the back end and of course does not respond in the time required. ----- Original Message ----- From: " Dorn Hetzel " < dorn @ hetzel .org> To: "Brian R. Watters " < brwatters @ absfoc .com> Cc: nanog @ nanog .org, "Ronald Bonica " < rbonica @juniper.net> Sent: Tuesday, January 18, 2011 1:01:43 PM Subject: Re: Auto ACL blocker One suspects this sort of automated defense should only be used against attack styles that eliminate the likelihood of a forged source ip and that the acl needs to be pruned and compacted for size. Nearby bad ips can be collected into a larger mask but there is then risk of collateral damage (how many bad source ips in a /24 or whatever before you nuke the whole thing for a while? Does the length of a prefixes "rap sheet" change its treatment? Etc) On Jan 18, 2011 3:03 PM, "Brian R. Watters " < brwatters @ absfoc .com > wrote: > Ron, > > I am sure any solution given enough time could be used against you, However my hope was that a whitelist could help in that regard however I know your correct. > > > ----- Original Message ----- > From: "Ronald Bonica " < rbonica @juniper.net > > To: "Brian R. Watters " < brwatters @ absfoc .com >, nanog @ nanog .org > Sent: Tuesday, January 18, 2011 11:55:28 AM > Subject: RE: Auto ACL blocker > > Brian, > > Have you thought about what a bad guy might do if he knew that you had such a policy deployed? Is there a way that the bad guy might turn the policy against you? > > Ron > >> -----Original Message----- >> From: Brian R. Watters [ mailto : brwatters @ absfoc .com ] >> Sent: Tuesday, January 18, 2011 2:12 PM >> To: nanog @ nanog .org >> Subject: Auto ACL blocker >> >> We are looking for the following solution. >> >> Honey pot that collects attacks against SSH/FTP and so on >> >> Said attacks are then sent to a master ACL on a edge Cisco router to >> block all traffic from these offenders .. >> >> Of course we would require a master whitelist as well as to not be >> blocked from our own networks. >> >> Any current solutions or ideas ?? >> >> -- >> >> BRW > > -- > > Brian R. Watters > Director > American Broadband Family of Companies > 5718 East Shields Ave > Fresno, CA. 93727 > brwatters @ absfoc .com > http :// www . americanbroadbandservice .com > tel: 559-420-0205 > fax:559-272-5266 > toll free: 866-827-4638 > > ABS offers T-1's starting at $289 in over 450 cities. Is your city on the list? Click here to find out. > > This message and any attachment(s) are solely for the use of intended recipients. They may contain privileged and/or confidential information legally protected from disclosure. If you are not the intended recipient, you are hereby notified that you received this e-mail in error and that any review, dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please contact the sender and delete the message and any attachment(s) from your system. Thank you for your cooperation. > -- Brian R. Watters Director American Broadband Family of Companies 5718 East Shields Ave Fresno, CA. 93727 brwatters @ absfoc .com http :// www . americanbroadbandservice .com tel: 559-420-0205 fax:559-272-5266 toll free: 866-827-4638 ABS offers T-1's starting at $289 in over 450 cities. Is your city on the list? Click here to find out. This message and any attachment(s) are solely for the use of intended recipients. They may contain privileged and/or confidential information legally protected from disclosure. If you are not the intended recipient, you are hereby notified that you received this e-mail in error and that any review, dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please contact the sender and delete the message and any attachment(s) from your system. Thank you for your cooperation.

2 1