- Test - lists.nanog.org

AfNOG 2010
by Randy Bush 10 Nov '09

10 Nov '09

AfNOG-11 and AfriNIC-12: Meetings 23 May-4 June, 2010 The African Network Operators' Group (AfNOG) and the African Network Information Centre (AfriNIC) are pleased to announce that the 11th AfNOG Meeting and the AfriNIC-12 Meeting would be held in Kigali, Rwanda during May & June 2010. About the Entire Event AfNOG and AfriNIC are jointly organizing a two-week event that includes the AfNOG Workshop on Network Technology (offering advanced training in a week-long hands-on workshop), several full-day Advanced Tutorials, a one-day AfNOG Meeting, and a two-day AfriNIC Meeting. In addition, several side meetings and workshops will be hosted in collaboration with other organizations. Timetable Unix Boot Camp 23 May 2010 (Sunday) AfNOG Workshop 24 - 28 May 2010 (Monday - Friday) AfriNIC IPv6 Workshop 29 - 30 May 2010 (Saturday - Sunday) AfREN Meeting / AAF 29 - 30 May 2010 (Saturday - Sunday) <http://www.afnog.org/afnog2010/tutorial/> AfNOG Tutorials 30 - 31 May 2010(Sunday - Monday) AfriNIC LIR Workshop 31 May 2010 (Monday) <http://www.afnog.org/afnog2010/conference/> AfNOG-11 Meeting 1 June 2010 (Tuesday) <http://www.afrinic.net/meeting/> AfriNIC-12 Meeting 2- 3 June 2010 (Wednesday - Thursday) Africa INET Day 4 June 2010 (Friday) Venue & Hotel Venue & hotel for the event will be announced shortly. About AfNOG AfNOG (See <http://www.afnog.org/> <http://www.afnog.org/>) is a forum for cooperation and the exchange of technical information between operators of Internet-connected networks in Africa. AfNOG has organized an event like this one every year since 2000. About AfriNIC AfriNIC (See <http://www.afrinic.net/> <http://www.afrinic.net/>) is a Regional Internet Registry (RIR), responsible for Internet Number resources Management in the Africa region. AfriNIC organizes two Public Policy meetings every year (see < <http://www.afrinic.net/meeting/> http://www.afrinic.net/meeting/>). AfNOG Workshop on Network Technology The AfNOG Workshop on Network Technology aims to offer advanced training to people who are in the process of developing and enhancing an Internet-connected network with regional and international connectivity. The target audience includes senior and mid-level technical staff of commercial Internet service providers (ISPs), academic networks, government networks, or NGO networks. This workshop builds on the experience of previous AfNOG workshops held annually from 2000 to 2009 in ten different African countries, and also the Internet Society's INET workshops, held annually from 1993 to 2000 at eight locations around the world. The workshop's instructors are an international team with many years of experience operating large networks and teaching about network operations. The workshop is divided into four parallel tracks: * SA-E - Unix System Administration (in English), focused on using a Unix-like operating system as a platform for delivery of Internet services. * SS-E - Scalable Internet Services (in English), focused on the design and operation of email, web, and other Internet services, in ways that can scale to handle large numbers of end users. * SI-E - Scalable Network Infrastructure (in English), focused on the design and operation of networks using routers and switches, in ways that can scale to handle large numbers of interconnected sites. * SI-F - Infrastructure Reseaux IP (en francais), similar to track SI-E, but given in French. Workshop application information is available here: http://www.afnog.org/afnog2010/workshop/online_application_en.html http://www.afnog.org/afnog2010/workshop/online_application_fr.html AfREN Meeting The Africa Research and Education Networking community will be holding a two-day meeting on 29 - 30 May 2010. The meeting will discuss issues of interest to the NREN community such as coordination on activites in the region, advocacy, bandwidth consortia, regional RENs etc. Additional information about AfREN 2010 will be provided shortly. AfNOG Tutorials AfNOG will offer 1 to 2 full-day(s) tutorials on advanced topics. Tutorials take place in a classroom-style environment, and may include a hands-on practical component. Tutorials are non-commercial in nature, and most are technically oriented. They are intended to offer advanced training on technology already deployed or soon to be deployed on networking and related services provisioning for ISP operations. Additional information about AfNOG 2010 Tutorials will be availabe here: < <http://afnog.org/afnog2010/tutorial/> http://www.afnog.org/afnog2010/tutorial/> 11th AfNOG Meeting The 11th AfNOG meeting will be held in Kigali, Rwanda on 01 June 2010. AfNOG conferences provide a forum for the coordination and dissemination of technical information related to backbone/enterprise networking technologies and operational practices. The meetings are informal, with an emphasis on relevance to current and future African backbone engineering practices. The AfNOG 2009 conference in Cairo, Egypt drew over 150 participants, mainly consisting of network engineering staff from national service providers, and members of the research and education community. Additional information and the Conference schedule will be available here: < <http://www.afnog.org/afnog2010/conference/> http://www.afnog.org/afnog2010/conference/> AfriNIC-12 Meeting The AfriNIC-12 meeting will be held in Kigali, Rwanda for two days from 02-03 June, 2010. AfriNIC Meetings are open to everyone and provide an excellent opportunity to take part in Internet policy discussions. These policies, which describe how Internet Number Resources should be managed and distributed, are developed by the community. The meeting will include tutorials, presentations, update on the various working groups and the AfriNIC Public Policy Meeting. The two day meeting will be preceeded by a two-day IPv6 training. The meeting will focus on the IPv6 protocol and its deployment, especially in Africa and the issue of the exhaustion of the IPv4 pool of address space. There will be an opportunity to discuss the challenges which our region will be facing with IPv4 address space exhaustion. Further information will be available at < <http://www.afrinic.net/meeting/> http://www.afrinic.net/meeting/>. ISOC - INET Africa Conference The Internet Society will be organizing an INET Africa Conference on 4th June 2010 in conjunction with the AfriNIC 12 and AfNOG 11 meetings in Kigali, Rwanda. The conference will discuss the situation of Internet Interconnection in Africa, the challenges as well as the solutions, including Internet Exchange Points. The meeting agenda will be available shortly. Visa Requirements Citizens of certain countries require a visa to enter Rwanda. Please check with the Rwandan -30-

1 0

Re: BGP Peer Selection Considerations
by adel＠baklawasecrets.com 10 Nov '09

10 Nov '09

If nothing else by the time this deployment is finished I will surely have become extremely cynical. Now reading through peoples answers, I think the general consensus is that I would be giving too much control to provider A in the scenario I suggested below. So as someone mentioned they have the ability to foul up my connections all by themselves. >From all of this I gather that the most resilience would be provided by: 1) Go to two tier 1 carriers myself - say Global Crossing and Level 3. Arrange to get two 100meg BGP feeds, burstable. Pick them up at different datacentres as well I suppose to provide datacentre redundancy? Negotiate pricing, any tips on negotiating appreciated. 2) Arrange cross connects to these providers i.e. get to the datacentres the Tier1 providers are in. They are not on net at the colo we are in. With regards to arranging the cross connects am I able to ask the cross connect providers for fibre maps? Is this a done thing or will they brush me off with "you don't need this our network is diverse?" 3) Arrange for PI space and ASN myself, so become an LIR through RIPE. Do I really lose a lot by asking Level3 or GBLX to get the PI and ASN for me? I think the failure mode cited by someone was if the PI and ASN provider goes out of business. I would prefer not to go through becoming an LIR and maintaining the membership, as they are not an ISP and so it is more attractive to do that through one of the Tier 1 providers. I'm not sure what my options are in terms of getting to the datacentres to pick up the Tier1 providers. The "provider A" below has said they run a diverse fibre backhaul network etc etc. and I should go with them for connectivity to other datacentres. Now it would be easier to go with them just because they are running colo for us and they run the datacentre we are in. However I assume that I should not be scared of arranging a second cross connect with someone else altogether. In all of the above, I'm most worried about administrative overhead. Managing two cross connect providers, managing ongoing relationship with two Tier1 providers and so on. However resilience comes at a cost I suppose is the answer. Comments appreciated. Adel On Mon 7:10 PM , "William Herrin" herrin-nanog(a)dirtside.com sent: > On Mon, Nov 9, 2009 at 12:40 PM, <adel@ > baklawasecrets.com> wrote:> I have an existing relationship with provider A, > colo, cross connects> etc. Provider A has offered to get the PI > space, ASN number,> purchase the transit for us with provider B and > manage cross> connects to provider B (they say they have a > diverse "fibre> backhaul network"). This is quite > attractive from a support> and billing perspective. Also suspect that > provider A will be> able to get more attractive pricing from > Provider B than I> would be able to. > > > > Am I missing things that I need to > consider? > What happens when provider A is bought by provider C and you want to > dump provider C but keep provider B? You'll have created a conflict of > interest for provider B in any negotiation you have with them. > > Be aware that provider A's diverse network for provider A's service is > the same diverse network they'll use to connect you to provider B. As > a result, many or most of the outages which impact provider A will > also impact your connectivity to provider B, defeating the central > purpose of having a provider B. > > Regards, > Bill Herrin > > > -- > William D. Herrin ................ herrin@di > rtside.com bill(a)herrin.us > 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>Falls Church, VA 22042-3004 > > >

2 1

BGP Peer Selection Considerations
by adel＠baklawasecrets.com 10 Nov '09

10 Nov '09

Hi, Thanks to everyone that replied to my post on failover configuration. This has lead me to this post. I'm at a point now where I'm looking at dual-homing with two BGP peers upstream. Now what I am looking at doing is as follows: BGP Peer with Provider A who is multihomed to other providers. BGP Peer with Provider B who is not peered with provider A I have an existing relationship with provider A, colo, cross connects etc. Provider A has offered to get the PI space, ASN number, purchase the transit for us with provider B and manage cross connects to provider B (they say they have a diverse "fibre backhaul network"). This is quite attractive from a support and billing perspective. Also suspect that provider A will be able to get more attractive pricing from Provider B than I would be able to. Am I missing things that I need to consider?

6 7

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

So if my requirements are as follows: - BGP router capable of holding full Internet routing table. (whether I go for partial or full, I think I want something with full capability). - Capable of pushing 100meg plus of mixed traffic. What are my options? I want to exclude openbsd, or linux with quagga. Probably looking at Cisco or Juniper products, but interested in any other alternatives people suggest. I realise this is quite a broad question, but hoping this will provide a starting point. Oh and if I have missed any specs I should have included above, please let me know. Thanks Adel On Sun 10:18 PM , Seth Mattinen <sethm(a)rollernet.us> wrote: > adel(a)baklawasecrets.com wrote: > > I think partial routes makes perfect sense, makes sense that traffic > for customers who are connected to each of my upstreams should go out of > > the correct BGP link as long as they are up! Now I need to start > thinking of BGP router choices, sure I have a plethora of choices :-( > > > > Personally I'll always go for full routes if the router has enough > memory (software based) or TCAM space (hardware based). Cheaper to do on > software platforms though. An entry level Cisco 2811 can take full > tables from multiple upstreams with 786MB RAM or even 512. It won't push > 100 meg of mixed traffic though. > > ~Seth > > >

3 2

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Thanks Seth and James, Things are getting a lot clearer. The BGP multihoming solution sounds like exactly what I want. I have more questions :-) Now I suppose I would get my allocation from RIPE as I am UK based? Do I also need to apply for an AS number? As the IP block is "mine", it is ISP independent. i.e. I can take it with me when I decide to use two completely different ISPs? Is the obtaining of this IP block, what is referred to as PI space? Of course internally I split the /24 up however I want - /28 for untrust range and maybe a routed DMZ block etc.? Assuming I apply for IP block and AS number, whats involved and how long does it take to get these babies? I know the SSG550's have BGP capabilites. As I have two of these in HA mode, does it make sense to do the BGP on these, or should I get dedicated BGP routers? Fixing the internal routing policy so traffic is directed at the active BGP connection. Whats involved here, preferring one BGP link over the other? Thanks again, I obviously need to do some reading of my own, but all the suggestions so far have been very valuable and definitely seem to be pointing in some fruitful directions. Adel On Sun 6:31 PM , "James Hess" mysidia(a)gmail.com sent: > On Sun, Nov 8, 2009 at 11:34 AM, <adel@ > baklawasecrets.com> wrote:[..] > > connections from different providers I would > still have issues. So> I guess that if my primary Internet goes down I > lose connectivity> to all the publicly addressed devices on that > connection. Like> dmz hosts and so on. I would be interested > to hear how this> can be avoided if at all or do I have to use the > same provider. > You assign multi-homed IP address space to your publicly addressed > devices,which are not specific to either ISP. You announce to both ISPs, and > you accept some routes from both ISPs. > > You get multi-homed IPs, either by having an existing ARIN allocation, > or getting a /22 from ARIN (special allocation available for > multi-homing), or ask for a /24 from ISP A or ISP B for > multihoming. > > > If Link A fails, the BGP session eventually times out and dies: ISP > A's BGP routers withdraw the routes, the IP addresses are then > associated only with provider B. > > And you design your internal routing policy to direct traffic > within your network to the router with an active BGP session. > > Link A's failure is _not_ a total non-event, but a 3-5 minute partial > disruption, while the BGP session times out and updates occur in other > people's routers, is minimal compared to a 3 day outage, if serious > repairs to upstream fiber are required. > > > -- > -J > > >

4 3

Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability
by Cisco Systems Product Security Incident Response Team 09 Nov '09

09 Nov '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability Advisory ID: cisco-sa-20091109-tls http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml Revision 1.0 For Public Release 2009 November 9 1600 UTC (GMT) Summary ======= An industry-wide vulnerability exists in the Transport Layer Security (TLS) protocol that could impact any Cisco product that uses any version of TLS and SSL. The vulnerability exists in how the protocol handles session renegotiation and exposes users to a potential man-in-the-middle attack. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml. Affected Products ================= Cisco is currently evaluating products for possible exposure to these TLS issues. Products will only be listed in the Vulnerable Products or Products Confirmed Not Vulnerable sections of this advisory when a final determination about product exposure is made. Products that are not listed in either of these two sections are still being evaluated. Vulnerable Products - ------------------- This section will be updated when more information is available. Products Confirmed Not Vulnerable - --------------------------------- The following products are confirmed not vulnerable: * Cisco AnyConnect VPN Client This section will be updated when more information is available. Details ======= TLS and its predecessor, SSL, are cryptographic protocols that provide security for communications over IP data networks such as the Internet. An industry-wide vulnerability exists in the TLS protocol that could impact any Cisco product that uses any version of TLS and SSL. The vulnerability exists in how the protocol handles session renegotiation and exposes users to a potential man-in-the-middle attack. The following Cisco Bug IDs are being used to track potential exposure to the SSL and TLS issues. The bugs listed below do not confirm that a product is vulnerable, but rather that the product is under investigation by the appropriate product teams. Registered Cisco customers can view these bugs via Cisco's Bug Toolkit: http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl +------------------------------------------------------------+ | Product | Bug ID | |----------------------------+-------------------------------| | Cisco Adaptive Security | CSCtd01491 | | Device Manager (ASDM) | | |----------------------------+-------------------------------| | Cisco AON Software | CSCtd01646 | | | | |----------------------------+-------------------------------| | Cisco AON Healthcare for | CSCtd01652 | | HIPAA and ePrescription | | |----------------------------+-------------------------------| | Cisco Application and | CSCtd01529 | | Content Networking System | | | (ACNS) Software | | |----------------------------+-------------------------------| | Cisco Application | CSCtd01480 | | Networking Manager | | |----------------------------+-------------------------------| | Cisco ASA 5500 Series | CSCtd00697 | | Adaptive Security | | | Appliances | | |----------------------------+-------------------------------| | Cisco ASA Advanced | | | Inspection and Prevention | CSCtd01539 | | (AIP) Security Services | | | Module | | |----------------------------+-------------------------------| | Cisco AVS 3100 Series | CSCtd01566 | | Application Velocity | | | System | | |----------------------------+-------------------------------| | Cisco Catalyst 6500 Series | CSCtd06389 | | SSL Services Module | | |----------------------------+-------------------------------| | Firewall Services Module | CSCtd04061 | | FWSM | | |----------------------------+-------------------------------| | Cisco CSS 11000 Series | CSCtd01636 | | Content Services Switches | | |----------------------------+-------------------------------| | Cisco Unified SIP Phones | CSCtd01446 | | | | |----------------------------+-------------------------------| | Cisco Data Center Network | CSCtd02635 | | Manager | | |----------------------------+-------------------------------| | Cisco Data Mobility | CSCtd02642 | | Manager | | |----------------------------+-------------------------------| | Cisco Digital Media | CSCtd01703 | | Encoders | | |----------------------------+-------------------------------| | Cisco Digital Media | CSCtd01692 | | Manager | | |----------------------------+-------------------------------| | Cisco Digital Media | CSCtd01718 | | Players | | |----------------------------+-------------------------------| | Cisco Emergency Responder | CSCtd02650 | | | | |----------------------------+-------------------------------| | Cisco IOS Software | CSCtd00658 | | | | |----------------------------+-------------------------------| | Cisco IOS XE Software | CSCtd00658 | | | | |----------------------------+-------------------------------| | Cisco IOS XR Software | CSCtd02658 | | | | |----------------------------+-------------------------------| | Cisco IP Communicator | CSCtd02662 | | | | |----------------------------+-------------------------------| | CATOS | CSCtd00662 | | | | |----------------------------+-------------------------------| | Cisco IronPort Appliances | CSCtd02069 | | | | |----------------------------+-------------------------------| | Cisco Unified MeetingPlace | CSCtd02709 | | | | |----------------------------+-------------------------------| | Cisco NAC Appliance (Clean | CSCtd01453 | | Access) | | |----------------------------+-------------------------------| | Cisco NAC Guest Server | CSCtd01462 | | | | |----------------------------+-------------------------------| | Cisco NAC Profiler | CSCtd02716 | | | | |----------------------------+-------------------------------| | Cisco Network Analysis | CSCtd02729 | | Module Software (NAM) | | |----------------------------+-------------------------------| | Cisco Network Registrar | CSCtd02748 | | | | |----------------------------+-------------------------------| | Cisco ONS 15500 Series | CSCtd02769 | | | | |----------------------------+-------------------------------| | Cisco Physical Access | CSCtd02777 | | Gateways | | |----------------------------+-------------------------------| | Cisco Physical Access | CSCtd03912 | | Manager | | |----------------------------+-------------------------------| | Cisco Physical Security | CSCtd03920 | | ISM | | |----------------------------+-------------------------------| | Cisco QoS Device Manager | CSCtd03923 | | | | |----------------------------+-------------------------------| | Cisco Secure Access | CSCtd00725 | | Control Server (ACS) | | |----------------------------+-------------------------------| | Cisco Secure Desktop | CSCtd03928 | | | | |----------------------------+-------------------------------| | Cisco Secure Services | CSCtd03935 | | Client | | |----------------------------+-------------------------------| | Cisco Security Agent CSA | CSCtd02689 | | | | |----------------------------+-------------------------------| | Cisco Security Monitoring, | CSCtd02654 | | Analysis and Response | | | System (MARS) | | |----------------------------+-------------------------------| | Cisco Unified IP Phones | CSCtd04121 | | | | |----------------------------+-------------------------------| | Cisco Service Control | CSCtd04171 | | Subscriber Manager | | |----------------------------+-------------------------------| | Cisco TelePresence Manager | CSCtd01771 | | | | |----------------------------+-------------------------------| | Telepresence for Consumer | CSCtd01752 | | | | |----------------------------+-------------------------------| | Cisco TelePresence | CSCtd01742 | | Recording Server | | |----------------------------+-------------------------------| | Cisco Network Asset | CSCtd04198 | | Collector | | |----------------------------+-------------------------------| | Cisco Unified | CSCtd01282 | | Communications Manager | | | (CallManager) | | |----------------------------+-------------------------------| | Cisco Unified Business | CSCtd05731 | | Attendant Console | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05790 | | Center Enterprise | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05790 | | Center Express | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05755 | | Center Management Portal | | |----------------------------+-------------------------------| | Cisco Unified Contact | CSCtd05790 | | Center Products | | |----------------------------+-------------------------------| | Cisco Unified Department | CSCtd05733 | | Attendant Console | | |----------------------------+-------------------------------| | Cisco Unified E-Mail | CSCtd05756 | | Interaction Manager | | |----------------------------+-------------------------------| | Cisco Unified Enterprise | CSCtd05735 | | Attendant Console | | |----------------------------+-------------------------------| | Cisco Unified Mobile | CSCtd05762 | | Communicator | | |----------------------------+-------------------------------| | Cisco Unified Mobility | CSCtd05786 | | | | |----------------------------+-------------------------------| | Cisco Unified Mobility | CSCtd05783 | | Advantage | | |----------------------------+-------------------------------| | Cisco Unified Operations | CSCtd05784 | | Manager | | |----------------------------+-------------------------------| | Cisco Unified Personal | CSCtd05759 | | Communicator | | |----------------------------+-------------------------------| | Cisco Unified Presence | CSCtd05791 | | | | |----------------------------+-------------------------------| | Cisco Unified Provisioning | CSCtd05777 | | Manager | | |----------------------------+-------------------------------| | Cisco Unified Quick | CSCtd05738 | | Connect | | |----------------------------+-------------------------------| | Cisco Unified Service | CSCtd05780 | | Monitor | | |----------------------------+-------------------------------| | Cisco Unified Service | CStCd05778 | | Statistics Manager | | |----------------------------+-------------------------------| | Cisco Unified SIP Proxy | CSCtd05765 | | | | |----------------------------+-------------------------------| | Cisco Unity | CSCtd02855 | | | | |----------------------------+-------------------------------| | Cisco NX-OS Software | CSCtd00699 and CSCtd00703 | | | | |----------------------------+-------------------------------| | Cisco Video Portal | CSCtd04097 | | | | |----------------------------+-------------------------------| | Cisco Video Surveillance | CSCtd02831 | | Media Server Software | | |----------------------------+-------------------------------| | Cisco Video Surveillance | CSCtd02780 | | Operations Manager | | | Software | | |----------------------------+-------------------------------| | Cisco Wide Area File | CSCtd04106 | | Services Software (WAFS) | | |----------------------------+-------------------------------| | Cisco Wireless Control | CSCtd01625 | | System | | |----------------------------+-------------------------------| | Cisco Wireless LAN | CSCtd01611 | | Controller (WLAN) | | |----------------------------+-------------------------------| | Cisco Wireless Location | CSCtd04115 | | Appliance | | |----------------------------+-------------------------------| | CiscoWorks Common Services | CSCtd01597 | | Software | | |----------------------------+-------------------------------| | CiscoWorks Wireless LAN | CSCtd04111 | | Solution Engine (WLSE) | | +------------------------------------------------------------+ This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-3555. Vulnerability Scoring Details +---------------------------- Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * TLS Renegotiation Vulnerability (all Cisco Bugs above) CVSS Base Score - 4.3 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - None Integrity Impact - Partial Availability Impact - None CVSS Temporal Score - 4.1 Exploitability - Functional Remediation Level - Unavailable Report Confidence - Confirmed Impact ====== This section will be updated when more information is available. Software Versions and Fixes =========================== This section will be updated to include fixed software versions for affected Cisco products as they become available. Workarounds =========== Workarounds are being investigated. This section will be updated when more information becomes available. Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts - -------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations - ------------------------------------------------- Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts - ----------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== This vulnerability was initially discovered by Marsh Ray and Steve Dispensa from PhoneFactor, Inc. Cisco is not aware of any malicious exploitation of this vulnerability. Proof-of-concept exploit code has been published for this vulnerability. Status of this Notice: INTERIM ============================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2009-November-9 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. +-------------------------------------------------------------------- Copyright 2008-2009 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- Updated: Nov 09, 2009 Document ID: 111046 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkr4TCsACgkQ86n/Gc8U/uDNWgCfYptXVZhz0qn2DvRh2zUtZ5EF OS4AoJediPm3/t9XqYIdrjR5PNP25iY/ =SkAu -----END PGP SIGNATURE-----

1 0

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Thanks, I've taken your advice and decided to reconsider my requirement for a full routing table. I believe I'm being greedy and a partial table will be sufficient. With regards to Linux/BSD, its not the CLI of quagga that will be an issue, rather the sysadmin and lack of supporting infrastructure for Linux boxes within the organisation. So things like package management, syslog servers, monitoring, understanding of security issues etc. I don't want to leave them with a linux/bsd solution that they won't be able to maintain/manage effectively when I am gone. Thanks for your comments. Look forward to hearing which solutions come back into the mix having dropped the full routing table requirement. Regards, Adel On Mon 11:45 AM , Joe Greco <jgreco(a)ns.sol.net> wrote: > > > > Basically the organisation that I'm working for will not have the > skills > > > > in house to support a linux or bsd box. They will have trouble > > > > with supporting the BGP configuration, however I don't think they > will be > > > > happy with me if I leave them with a linux box when they > > > > don't have linux/unix resource internally. At least with a Cisco or > > > > Juniper they are familiar with IOS and it won't be too foreign to > them. > > > > On Sun 11:47 PM , Dale Rumph wrote: > > > > > > What does your budget look like? A pair of Cisco 7246vxr's with G1's > > > sitting on the edge of the network would be very effective and still > allow > > > expansion. Or you could go up to the 7609. However this gear may be > > > slightly overkill. You might be ok with a 3660 enterprise and a ton > of > > > ram. I have done single sessions on them but not with the level of HA > your > > > looking for. > > > > > > Just my 2c > > > You will laugh, but the budget at the moment looks like Â£13k. > > Impossible? Do only linux and openbsd solutions remain in the mix > > for this pittance? > > No, you have the buy-it-off-eBay solutions as well. "Beware the > fakes." > > If they're familiar with IOS, then they can be familiar with Quagga > about as easily as they could be familiar with a switch or other > network gizmo that had a Ciscoesque CLI but wasn't actually Cisco. > > You've painted yourself into a corner. I have a word for you: > > Reconsider. > > I don't care what you reconsider, but reconsider something. You can > reconsider taking BGP with a full table. You can reconsider Quagga. > Or you can reconsider your budget. This is the end result of the > "pick any two" problem. > > Most end user organizations have no need of full routes in BGP. To > try to take them dooms TCAM-based equipment at some future point, > though if you have a lot of money to throw at it, you can make that > point be years in the future. It is essentially planned obsolescence. > If you discard the requirement for full routes, you open up a bunch > of reasonably-priced possibilities. > > Finding someone knowledgeable in BSD or Linux isn't that rough. > Unlike a Cisco 76xx router, the hardest part of a Quagga-based > solution is finding the right mix of hardware and software at the > beginning. PC hardware has a lot going for AND against it. There is > no reason you can't make a good router out of a PC. If you buy the > Cisco software-based routers, you're essentially buying a prepackaged > version, except that it'll be specced to avoid any real competition > with their low-end TCAM-based offerings. A contemporary PC can > easily route gigabits. Vyatta makes what I hear is a fantastic > canned solution of some sort, for a reasonable cost, and they will > sell just software or software/hardware. If you really can't put > it together yourself, there's someone to do it for you. > > Reconsidering your budget is probably the most painful thing to do, > but also opens up the "just buy big Cisco" option. I think my point > here would have to be that what you're looking for would have needed > big Cisco... ten years ago. Now, dealing with a few hundred megs of > traffic, that's not that big a deal, the thing that's killing you is > the BGP table size. > > Your best option may be to see if you can settle for partial routes > plus a default. > > ... JG > -- > Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net > [1] > "We call it the 'one bite at the apple' rule. Give me one chance [and] > then I > won't contact you again." - Direct Marketing Ass'n position on e-mail > spam(CNN) > With 24 million small businesses in the US alone, that's way too many > apples. > > > > Links: > ------ > [1] http://webmail.123-reg.co.uk/parse.php?redirect=http://www.sol.net > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Thanks, Their offering certainly looks appealing. Will be interested to hear user experiences of the Vyatta BGP router range. Having said that I will still be examining the Cisco offering, just because of the support, larger user community and skills base issue. However if I can't meet the price point using Cisco, obviously other solutions are going to come into the picture. Adel On Mon 11:39 AM , Arnold Nipper <arnold(a)nipper.de> wrote: > On 09.11.2009 11:53 adel(a)baklawasecrets.com wrote > > > You will laugh, but the budget at the moment looks like £13k. > > Impossible? Do only linux and openbsd solutions remain in the mix > > for this pittance? > > > > Do you know Vyatta (http://www.vyatta.com/)? [1] CLI and config is > Cisco-ish. Prices e.g. > > Vyatta Appliance, Vyatta 2502, Enterprise Subscription, Basic Warranty, > 1 Year (ships with US Power Cord as standard) (Typically ships in 10-12 > business days) > Price: $2,997.00 > > Best regards, > Arnold > -- > Arnold Nipper / nIPper consulting, Sandhausen, Germany > email: arnold(a)nipper.de phone: +49 6224 9259 299 > mobile: +49 172 2650958 fax: +49 6224 9259 333 > > > > Links: > ------ > [1] > http://webmail.123-reg.co.uk/parse.php?redirect=http://www.vyatta.com/%29%3 > F >

1 0

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

You will laugh, but the budget at the moment looks like £13k. Impossible? Do only linux and openbsd solutions remain in the mix for this pittance? On Sun 11:47 PM , Dale Rumph <daler(a)ibbs.com> wrote: > What does your budget look like? A pair of Cisco 7246vxr's with G1's > sitting on the edge of the network would be very effective and still allow > expansion. Or you could go up to the 7609. However this gear may be > slightly overkill. You might be ok with a 3660 enterprise and a ton of > ram. I have done single sessions on them but not with the level of HA your > looking for. > > Just my 2c > > ----- Original Message ----- > From: adel(a)baklawasecrets.com > To: nanog(a)nanog.org > Sent: Sun Nov 08 18:36:31 2009 > Subject: Re: Failover how much complexity will it add? > > Basically the organisation that I'm working for will not have the skills > in house to support a linux or bsd box. They will have trouble > with supporting the BGP configuration, however I don't think they will be > happy with me if I leave them with a linux box when they > don't have linux/unix resource internally. At least with a Cisco or > Juniper they are familiar with IOS and it won't be too foreign to them. > > On Sun 11:30 PM , "Renato Frederick" wrote: > > > There are any problems with quagga+BSD/Linux that you know or something > > > like that? > > > > Or in your scenario a "cisco/juniper box" is a requirement? > > > > I'm asking this because I'm always running BGP with upstreams providers > > > using quagga on BSD and everything is fine until now. > > > > -------------------------------------------------- > > From: > > Sent: Sunday, November 08, 2009 8:39 PM > > To: > > Subject: Re: Failover how much complexity will it add? > > > > > > > > So if my requirements are as follows: > > > > > > - BGP router capable of holding full Internet routing table. (whether > I > > > > > go for partial or full, I think I want something with full > capability). > > > > > > - Capable of pushing 100meg plus of mixed traffic. > > > > > > What are my options? I want to exclude openbsd, or linux with quagga. > > > > Probably looking at Cisco or Juniper products, but interested > > > in any other alternatives people suggest. I realise this is quite a > > broad > > > question, but hoping this will provide a starting point. Oh and > > > if I have missed any specs I should have included above, please let > me > > > know. > > > > > > Thanks > > > > > > Adel > > > > > > > > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 09 Nov '09

09 Nov '09

Looking at two 100Mbit/s BGP connections, so I think I want something that will do more than 100 but nowhere close to a gig. So full routing table capability with throughput of mixed traffic around 200Mbit/s. If that makes sense. Do the 2850s fall into that sort of price point? Adel On Mon 11:13 AM , Joe Abley <jabley(a)hopcount.ca> wrote: > On 2009-11-09, at 19:53, adel(a)baklawasecrets.com wrote: > > > You will laugh, but the budget at the moment looks like £13k. > > Impossible? Do only linux and openbsd solutions remain in the mix > > for this pittance? > > I don't see an indication of the traffic you need to push (maybe I > deleted a message too enthusiastically) but check the 2800 series from > cisco. The 2850 will take full tables and has gigabit interfaces, but > don't expect them to do wire speed. Other 2800s suffer from reduced > RAM, but perhaps you don't need full tables. > > Also look at Juniper J-series boxes, and maybe Force10 S-series boxes. > > There's a healthy market in used cisco gear in most places I have ever > visited, if you don't need new. > > Joe > > >

1 0