- Test - lists.nanog.org

Fw: Cisco Sanitization
by Greg Whynott 12 Jan '11

12 Jan '11

V ----- Original Message ----- From: Greg Whynott Sent: Wednesday, January 12, 2011 09:46 AM To: 'Timothy.Green(a)ManTech.com' <Timothy.Green(a)ManTech.com> Subject: Re: Cisco Sanitization Replace the flash cards. If you are really concerned about information being disclosed, formatting/deleting files will not destroy the data and it probably can be recovered. Or take the flash cards and scrub them from a pc. G ----- Original Message ----- From: Green, Timothy [mailto:Timothy.Green@ManTech.com] Sent: Wednesday, January 12, 2011 09:41 AM To: nanog(a)nanog.org <nanog(a)nanog.org> Subject: Cisco Sanitization Hey all! I'm currently creating a sanitization guide for all my hardware. When I got to my Cisco devices I noticed there are numerous ways to reset them back to the default and clear the NVRAM. Does anyone have a guide that includes sanitization information for all Cisco devices(at least switches, routers, IDS's, and ASA 5500 Series) so I don't have to recreate the wheel? Thanks, Tim -- This message and any attachments may contain confidential and/or privileged information for the sole use of the intended recipient. Any review or distribution by anyone other than the person for whom it was originally intended is strictly prohibited. If you have received this message in error, please contact the sender and delete all copies. Opinions, conclusions or other information contained in this message may not be that of the organization.

2 1

Cisco Sanitization
by Green, Timothy 12 Jan '11

12 Jan '11

Hey all! I'm currently creating a sanitization guide for all my hardware. When I got to my Cisco devices I noticed there are numerous ways to reset them back to the default and clear the NVRAM. Does anyone have a guide that includes sanitization information for all Cisco devices(at least switches, routers, IDS's, and ASA 5500 Series) so I don't have to recreate the wheel? Thanks, Tim

2 1

Agenda for Miami
by Schiller, Heather A 11 Jan '11

11 Jan '11

Hopefully posted soonish? Less than 3 weeks to the meeting, the early registration window has passed and there is still no agenda. Thanks, --h ~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~* Heather Schiller Network Security - Verizon Business 1.800.900.0241 security(a)verizonbusiness.com

2 1

Re: AltDB?
by Jon Lewis 11 Jan '11

11 Jan '11

[moved to nanog as it seems a far more appropriate forum than cisco-nsp] On Wed, 5 Jan 2011, Jose Madrid wrote: > Anyone here use AltDB? It seems their servers have been down for two days. > I have emailed their admin alias but have gotten nothing. Anyone? > > whois -h whois.altdb.net 199.48.252.0 > [Querying whois.altdb.net] > [Unable to connect to remote host] Can anyone from Level3 say how this will impact customer BGP filters. Will L3 keep working with the last data sync they got from altdb? I'm guessing if whatever the problem is with altdb isn't fixed soon, those who use it as their IRR will need to re-publish all their objects in another IRR DB and have any transit providers who build filters based on IRR data update their profiles to use object data from the IRR DB to which they moved their records. I'd been thinking about moving from altdb to ARIN's but hadn't had sufficient motivation. www.altdb.net is reachable, but the whois server is not. Even altdb queries run from http://www.altdb.net/ fail. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

16 36

NIST IPv6 document
by Kevin Oberman 11 Jan '11

11 Jan '11

NIST has released SP800-119, "Guidelines for the Secure Deployment of IPv6". While I don't agree with everything in it, it is an excellent overview of IPv6, differences from IPv4, and security advice. While the title sounds like a security document, the security implications are only a part of it. I've not finished reading it, but my first reaction is that this is a good source of information. Well written, fairly detailed (at 188 pages) with lots of references. The PDF is available at: http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634 Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751

33 129

Is Cisco equpiment de facto for you?
by Brandon Kim 11 Jan '11

11 Jan '11

Hello gents: I wanted to put this out there for all of you. Our network consists of a mixture of Cisco and Extreme equipment. Would you say that it's fair to say that if you are serious at all about being a service provider that your core equipment is Cisco based? Am I limiting myself by thinking that Cisco is the "de facto" vendor of choice? I'm not looking for so much "fanboy" responses, but more of a real world experience of what you guys use that actually work and does the job..... No technical questions here, just general feedback. I try to follow the Tolly Group who compares products, and they continually show that Cisco equipment is a poor performer in almost any equipment compared to others, I find that so hard to believe..... Thanks! Brandon

24 44

Internet to Tunisia
by Marshall Eubanks 11 Jan '11

11 Jan '11

I am hearing reports of Internet blockage in / to Tunisia, where a near full-on revolt is being coordinated / reported on by social media such as twitter ( #sidibouzid ), Facebook and Youtube. Can anyone confirm that there is blockage ? Are there any in-country resources to check this ? There does not appear to be a looking glass in Tunisia. Regards Marshall

4 4

Re: Satellite IP
by Jay Ashworth 11 Jan '11

11 Jan '11

----- Original Message ----- > From: "Valdis Kletnieks" <Valdis.Kletnieks(a)vt.edu> > > Why the hostility, Valdis? > > As I said several times - it's not hard to be 98% or 99% sure you can make > all your commitments. However, since predicting the future is an inexact > science, > it's really hard to provide a *100% guarantee* that you'll have enough > contended capacity to make all the performance targets even if every > single occasional customer shows up at once. As Jay pointed out in his > follow-up note, his backup strategy is "scramble around and hope another > provider can > come through in time", which is OK if you *know* that's your strategy > and are OK on it. However, blindly going along with "my usual provider > guaranteed 100% availability" is a bad idea. I don't think Kelly is on his first rodeo, and I know I'm not. "scramble around" is a bit pejorative as descriptions for my booking strategy go, but everyone has a cranky day every so often, not least me. :-) And note that I *also* pointed out that carrier statmuxing on the transport is a valid strategy for capacity elasticity, in that particular environment. > Remember, we're coming out of a solar minimum. ;) Are we in fact coming out of it yet? I heard it was getting deeper, and that we were looking at a Dalton, if not another Maunder. Cheers, -- jra

3 2

Re: Working abuse contact for lstn.net / limestonenetworks.com?
by Tim Burke 11 Jan '11

11 Jan '11

Ha, good luck... Limestone is a haven for cheap child-run web hosting companies. I can almost guarantee abuse@ goes to /dev/null... Sent from my Samsung Captivate(tm) on AT&T goemon(a)anime.net wrote: >Anyone have a WORKING abuse contact for lstn.net / limestonenetworks.com? > >I have tried the usual channels (abuse(a)limestonenetworks.com, phone calls, "live chat") with no results. > >-Dan >

1 0

RE: IPv6 - real vs theoretical problems
by Tony Hain 11 Jan '11

11 Jan '11

*requested anonymous* wrote: > (I don't post on public mailing lists, so, please consider this > private. > That is, I don't care if the question/reply are public, just, not the > source.) > > On 1/10/11 11:46 AM, Tony Hain wrote: > > ... yes I know you understand operational issues. > > > > While managed networks can 'reverse the damage', there is no way to > fix that > > for consumer unmanaged networks. Whatever gets deployed now, that is > what > > the routers will be built to deal with, and it will be virtually > impossible > > to change it due to the 'installed base' and lack of knowledgeable > > management. > > > > It is hard enough getting the product teams to accept that it is > possible to > > build a self-configuring home network without having that be crippled > by > > braindead conservation. The worst possible value I can see for > delegation to > > the home is /56, yet that is the most popular value because people > have > ^^^^^^^^^^^^^^^^^ > Why would you say /56 is the worst possible value? Just curious -- I am actually trying to develop a simple set of 'auto conf' rules for all the CPE vendors to build against, and for a Joe-sixpack plug-n-play network configuration a /56 means there is only one topology option beyond single subnet. > my provider doesn't offer IPv6 yet, but, I think they will soon. > I was going to ask for a /56 for my home net. If I ever get around > to using them to set up a domain for my wife's business, I will ask > for a /48, but, for a house without a private domain, /56 seems > perfect. You are thinking of a managed network. Connect a random graph of boxes, then figure out a subnet scheme that all cpe vendors can implement that will correctly deal with prefix delegation and hierarchical routing. > I don't expect to run out in my lifetime, or even my children's > or grandchildren's lifetimes if somehow the house stays in the family > ;-) > How many subnets will they really need, no matter if every lightbulb > is on the net? Wrong question. In a managed network that would be the right question, but in an unmanaged one the right question is how many sub-delegations and how many branches per sub-delegate are going to be automatically figured out. > > My frame of reference is that while we need to make the addresses big > enough, we also need to preserve the hierarchy. There is no shortage > of addresses, nor will there be, ever, but there could be a shortage > of levels in the hierarchy. I assume you would like a home to have a > /48? But, from my provider's /32, that is only 4 levels at the > assumed nibble boundary. I think my provider could use another > two levels. If your provide has more than 10,000 customers they should never have gotten a /32. The braindead notion that everyone needed to rush out and get a /32 has not helped get IPv6 deployed. The /32 value was the default one for a startup provider. Every provider with a customer base should have done a plan for a /48 per customer, then gotten the right size block to start with. Any provider with a /32 and more than 10k customers needs to do that now and swap for 'a real block', instead of trying to squeeze their customers into a tiny block due to their insufficient initial request. > > I also think ~256 subnets has stood the test of time -- seldom in > the last 25 years has a geographically contiguous enterprise network > (such as a university or company) required more than 256 subnets -- > except for cisco, microsoft, et al., but not, e.g. most colleges, > universities, research centers, etc. More addresses, sure, but, > not usually more than 256 subnets. So, even in a world where > every possible device has its own set of addresses -- how many > subnets will I really need? Again, wrong question. Most of the possible subnets in a Joe-sixpack configuration will be 'wasted'. So what? That space will be wasted sitting on the shelf at IANA in 500 years when someone comes up with a better idea. IPv6 is not the last protocol known to mankind (unless the 2012 predictions are true), so most of its potential space will be wasted. Get over that point and accept that innovation requires thinking differently than the limited myopia of the past. > > Also from my frame of reference -- we need to work on making addressing > and re-addressing easier and more automatic for consumers anyway, so, > if /56 is not enough, we can easily and painlessly switch to a /52 > with no problems. Easy in a managed network where it is possible to update code and expect that things will happen in a timeframe that makes development worth the effort. Impossible in consumer land where it is well documented that things are never updated, and all vendors need to play by the same simple rules because there is no hope that the consumer will know how to tweak them. > And, if I decide to grow an enterprise from home, > I feel that I should be able to re-address as needed over the course > of time anyway, so, I would rather make re-addressing easier than > put all my eggs in the large-enough-/48 basket. What if I grow so > large that I buy someone else's company, or otherwise merge? We have > to solve the re-addressing problem anyway, in which case, /48, /52, /56 > assignments should not be a big deal. > > What am I missing? You are thinking like every other network engineer on Nanog, not like a consumer that doesn’t understand why some configurations are not possible. The only way to avoid support calls is to make it trivial for the devices to deal with just about anything that a consumer might do, and it has to be scalable enough over time to deal with the fact that a device from today will still be in use 10-15 years from now. Evolution of the rules is possible over very long timeframes, but more complex and costly. Starting with a short-sighted, managed network viewpoint is a guarantee that it will be impossible to innovate in the unmanaged home network space. Tony

2 1