- Test - lists.nanog.org

[NANOG-announce] Communications Committee members
by Steve Feldman 09 Nov '09

09 Nov '09

Kris Foster and Michael K. Smith have been chosen to fill two year terms on the Communications Committee (formerly known as the Mailing List Committee.) They join Randy Epstein and Tim Yocum, who are starting the second year of their terms, and Sue Joiner, who is the Merit appointee to the CC. The Steering Committee would also like to thank Simon Lyall for his service on the MLC. His diligence and attention to refining and documenting the committee's processes was greatly appreciated. For the SC, Steve Feldman (chair) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Congress may require ISPs to block fraud sites H.R.3817
by Bryan King 09 Nov '09

09 Nov '09

Did I miss a thread on this? Has anyone looked at this yet? http://m.news.com/2166-12_3-10390779-38.html Section 508 of H.R.3817: SEC. 508. PENALTY FOR MISREPRESENTATION OF SIPC MEMBERSHIP OR PROTECTION. Section 14 of the Securities Investor Protection Act of 1970 (15 U.S.C. 78jjj) is amended by adding at the end the following new subsection: `(d) Misrepresentation of SIPC Membership or Protection- `(1) IN GENERAL- Any person who falsely represents by any means (including, without limitation, through the Internet or any other medium of mass communication), with actual knowledge of the falsity of the representation and with an intent to deceive or cause injury to another, that such person, or another person, is a member of SIPC or that any person or account is protected or is eligible for protection under this Act or by SIPC, shall be liable for any damages caused thereby and shall be fined not more than $250,000 or imprisoned for not more than five years. `(2) INTERNET SERVICE PROVIDERS- Any Internet service provider that, on or through a system or network controlled or operated by the Internet service provider, transmits, routes, provides connections for, or stores any material containing any misrepresentation of the kind prohibited in paragraph (1) shall be liable for any damages caused thereby, including damages suffered by SIPC, if the Internet service provider-- `(A) has actual knowledge that the material contains a misrepresentation of the kind prohibited in paragraph (1), or `(B) in the absence of actual knowledge, is aware of facts or circumstances from which it is apparent that the material contains a misrepresentation of the kind prohibited in paragraph (1), and upon obtaining such knowledge or awareness, fails to act expeditiously to remove, or disable access to, the material. `(3) INJUNCTIONS- Any court having jurisdiction of a civil action arising under this Act may grant temporary injunctions and final injunctions on such terms as the court deems reasonable to prevent or restrain any violation of paragraph (1) or (2). Any such injunction may be served anywhere in the United States on the person enjoined, shall be operative throughout the United States, and shall be enforceable, by proceedings in contempt or otherwise, by any United States court having jurisdiction over that person. The clerk of the court granting the injunction shall, when requested by any other court in which enforcement of the injunction is sought, transmit promptly to the other court a certified copy of all papers in the case on file in such clerk's office.'.

15 21

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Basically the organisation that I'm working for will not have the skills in house to support a linux or bsd box. They will have trouble with supporting the BGP configuration, however I don't think they will be happy with me if I leave them with a linux box when they don't have linux/unix resource internally. At least with a Cisco or Juniper they are familiar with IOS and it won't be too foreign to them. On Sun 11:30 PM , "Renato Frederick" <frederick(a)dahype.org> wrote: > There are any problems with quagga+BSD/Linux that you know or something > like that? > > Or in your scenario a "cisco/juniper box" is a requirement? > > I'm asking this because I'm always running BGP with upstreams providers > using quagga on BSD and everything is fine until now. > > -------------------------------------------------- > From: > Sent: Sunday, November 08, 2009 8:39 PM > To: > Subject: Re: Failover how much complexity will it add? > > > > > So if my requirements are as follows: > > > > - BGP router capable of holding full Internet routing table. (whether I > > > go for partial or full, I think I want something with full capability). > > > > - Capable of pushing 100meg plus of mixed traffic. > > > > What are my options? I want to exclude openbsd, or linux with quagga. > > Probably looking at Cisco or Juniper products, but interested > > in any other alternatives people suggest. I realise this is quite a > broad > > question, but hoping this will provide a starting point. Oh and > > if I have missed any specs I should have included above, please let me > > know. > > > > Thanks > > > > Adel > > >

1 0

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

So if my requirements are as follows: - BGP router capable of holding full Internet routing table. (whether I go for partial or full, I think I want something with full capability). - Capable of pushing 100meg plus of mixed traffic. What are my options? I want to exclude openbsd, or linux with quagga. Probably looking at Cisco or Juniper products, but interested in any other alternatives people suggest. I realise this is quite a broad question, but hoping this will provide a starting point. Oh and if I have missed any specs I should have included above, please let me know. Thanks Adel On Sun 10:18 PM , Seth Mattinen <sethm(a)rollernet.us> wrote: > adel(a)baklawasecrets.com wrote: > > I think partial routes makes perfect sense, makes sense that traffic > for customers who are connected to each of my upstreams should go out of > > the correct BGP link as long as they are up! Now I need to start > thinking of BGP router choices, sure I have a plethora of choices :-( > > > > Personally I'll always go for full routes if the router has enough > memory (software based) or TCAM space (hardware based). Cheaper to do on > software platforms though. An entry level Cisco 2811 can take full > tables from multiple upstreams with 786MB RAM or even 512. It won't push > 100 meg of mixed traffic though. > > ~Seth > > >

2 1

Pros and Cons of Cloud Computing in dealing with DDoS
by Stefan Fouant 08 Nov '09

08 Nov '09

I'm working on an article on the Pros and Cons of Cloud Computing as an effective strategy for dealing with DDoS. I'd like to open this up for debate and get some perspectives from folks on the list. In a recent article in ITWire titled "DDoS, the biggest threat to Cloud Computing", Roland Dobbins states that "DDoS attacks are one of the most under-rated and ill-guarded against security threats to corporate IT, and in particular the biggest threat facing cloud computing." To a certain extent, I agree with Roland, however, I also believe this perspective is inconsistent with the view that the elasticity of cloud computing and ability to scale resources on demand is a good way of dealing with the problem. The counterpoint to this is that I can also envision the cloud computing model causing a shift from that of a DDoS to what some are calling EDoS (Economic Denial of Sustainability). In an EDoS, the elasticity of the cloud and surplus of available resources might be used in such a way that large botnets generating seemingly legitimate "targeted" requests for service causing the victim to cloudburst in order to keep pace with the scale of the requests. Even though the victim can sustain business operations, the cost of doing so may be so exorbitantly expensive that to do so threatens economic sustainability. Roland also states "The cloud providers emerging as leaders don't tend to talk much about their resiliency to DDoS attacks". Which brings about another point - are there any cloud providers taking a proactive look at dealing with this problem and deploying effective countermeasures for dealing with this in their environments? What motivation would cloud providers have to deploy DDoS mitigation services and/or services which can distinguish between legitimate resource consumption vs. targeted resource consumption, especially if their revenues are driven from service availability and potential expansion of resource utilization? Stefan Fouant GPG Key ID: 0xB5E3803D

10 18

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

I think partial routes makes perfect sense, makes sense that traffic for customers who are connected to each of my upstreams should go out of the correct BGP link as long as they are up! Now I need to start thinking of BGP router choices, sure I have a plethora of choices :-( On Sun 10:01 PM , Seth Mattinen <sethm(a)rollernet.us> wrote: > adel(a)baklawasecrets.com wrote: > > Hi, > > > > Ok thanks for clearing that up. I'm getting some good feedback on > applying for PI and ASN through Ripe LIRs over on the UKNOF so I think I > have a handle on this. > > With regards to BGP and using separate BGP routers. I am announcing my > PI space to my upstreams, but I don't need to carry a full Internet > routing table, correct? > > So I can get away with some "lightweight" BGP routers not being an ISP > if that makes sense? > > > > Most will give you three choices: full routes, partial routes (internal, > their customers) with default, and default only. If you can't swing full > routes then I would go for partial routes as it will at least send > traffic for each ISP and their customers directly to them rather than > randomly over the other link. It all depends on what you're going to use > as your BGP speaking platform. > > ~Seth > > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Hi, Ok thanks for clearing that up. I'm getting some good feedback on applying for PI and ASN through Ripe LIRs over on the UKNOF so I think I have a handle on this. With regards to BGP and using separate BGP routers. I am announcing my PI space to my upstreams, but I don't need to carry a full Internet routing table, correct? So I can get away with some "lightweight" BGP routers not being an ISP if that makes sense? Adel On Sun 9:26 PM , Ken Gilmour <ken.gilmour(a)gmail.com> wrote: > Hey, > > Yes you apply to RIPE for your allocation. You should ask them for a > /20 since it's the same price for that as a /24 if you can justify it > (at least with LACNIC where i now get my allocations)... > > You will also need to apply for an ASN > > Correct- the block belongs to you and as long as you contact the > transit provider from the address listed in WHOIS then you should be > able to set up a new agreement easily. > > Yes the block is PI space (provider independent) > > It can take up to 1 month to get your assignments. > > I would recommend getting some different routers for this. I use > OpenBSD in some of my locations which is extremely easy to work with. > I also have some old NS-208 devices running ScreenOS for internal BGP > in one other location. I would not recommend using any router with > less than 1GB of RAM for BGP. in HA Mode you can connect the two > tails, one to each SSG (if they are in active active mode) and > announce it that way (check out anycast), we also do this :). > > The way BGP works is that both connections are active at the same > time, there is no primary and backup, if one goes down you just have > one less to receive traffic over and more traffic on the other, but > unless you stop announcing from one connection traffic will go over > both. > > Regards, > > Ken > > 2009/11/8 : > > Don't think I sent the below to the list, so resending: > > > > Thanks Seth and James, > > > > Things are getting a lot clearer. The BGP multihoming solution > sounds like exactly what I want. I have more questions :-) > > > > Now I suppose I would get my allocation from RIPE as I am UK based? > > > > Do I also need to apply for an AS number? > > > > As the IP block is "mine", it is ISP independent. i.e. I can take > it with me when I decide to use two > > completely different ISPs? > > > > Is the obtaining of this IP block, what is referred to as PI space? > > > > Of course internally I split the /24 up however I want - /28 for > untrust range and maybe a routed DMZ block > > etc.? > > > > Assuming I apply for IP block and AS number, whats involved and how > long does it take to get these babies?> > > > > I know the SSG550's have BGP capabilites. As I have two of these in > HA mode, does it make sense to do the BGP > > on these, or should I get dedicated BGP routers? > > > > Fixing the internal routing policy so traffic is directed at the > active BGP connection. Whats involved here, > > preferring one BGP link over the other? > > > > Thanks again, I obviously need to do some reading of my own, but > all the suggestions so far have been very valuable > > and definitely seem to be pointing in some fruitful directions. > > > > Adel > > > > > > > > > > On Sun 6:31 PM , James Hess wrote: > > > >> On Sun, Nov 8, 2009 at 11:34 AM, wrote: > >> [..] > >> > connections from different providers I would still have issues. So > >> > I guess that if my primary Internet goes down I lose connectivity > >> > to all the publicly addressed devices on that connection. Like > >> > dmz hosts and so on. I would be interested to hear how this > >> > can be avoided if at all or do I have to use the same provider. > >> > >> You assign multi-homed IP address space to your publicly addressed > >> devices, > >> which are not specific to either ISP. You announce to both ISPs, and > >> you accept some routes from both ISPs. > >> > >> You get multi-homed IPs, either by having an existing ARIN allocation, > >> or getting a /22 from ARIN (special allocation available for > >> multi-homing), or ask for a /24 from ISP A or ISP B for > >> multihoming. > >> > >> If Link A fails, the BGP session eventually times out and dies: ISP > >> A's BGP routers withdraw the routes, the IP addresses are then > >> associated only with provider B. > >> > >> And you design your internal routing policy to direct traffic > >> within your network to the router with an active BGP session. > >> > >> Link A's failure is _not_ a total non-event, but a 3-5 minute partial > >> disruption, while the BGP session times out and updates occur in other > >> people's routers, is minimal compared to a 3 day outage, if serious > >> repairs to upstream fiber are required. > >> > >> -- > >> -J > >> > >> > >> > > > > > > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Hi, Thanks for the info on UKNOF. I've started a thread there with regards to RIPE and obtaining ASN numbers and so on., as this is I guess quite UK specific. Adel On Sun 8:40 PM , Arnold Nipper <arnold(a)nipper.de> wrote: > Hi Adel, > > On 08.11.2009 21:24 Ken Gilmour wrote > > > There are companies like packet exchange (www.packetexchange.net [1]) > > I could also comment on PacketExchange, but I do not. If you get more UK > specific now you may perhaps want to post to UKNOF > (http://lists.uknof.org.uk/cgi-bin/mailman/listinfo/uknof/) [2] as well. > > For _independant_ consultancy you may want to have a look at Netsumo > (http://www.netsumo.com/) [3] Ask for Andy Davidson. > > Best regards, > Arnold > -- > Arnold Nipper / nIPper consulting, Sandhausen, Germany > email: arnold(a)nipper.de phone: +49 6224 9259 299 > mobile: +49 172 2650958 fax: +49 6224 9259 333 > > > > Links: > ------ > [1] > http://webmail.123-reg.co.uk/parse.php?redirect=http://www.packetexchange.n > et[2] > http://webmail.123-reg.co.uk/parse.php?redirect=http://lists.uknof.org.uk/c > gi-bin/mailman/listinfo/uknof/%29[3] > http://webmail.123-reg.co.uk/parse.php?redirect=http://www.netsumo.com/%29 > >

2 1

Re: Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

Don't think I sent the below to the list, so resending: Thanks Seth and James, Things are getting a lot clearer. The BGP multihoming solution sounds like exactly what I want. I have more questions :-) Now I suppose I would get my allocation from RIPE as I am UK based? Do I also need to apply for an AS number? As the IP block is "mine", it is ISP independent. i.e. I can take it with me when I decide to use two completely different ISPs? Is the obtaining of this IP block, what is referred to as PI space? Of course internally I split the /24 up however I want - /28 for untrust range and maybe a routed DMZ block etc.? Assuming I apply for IP block and AS number, whats involved and how long does it take to get these babies?> I know the SSG550's have BGP capabilites. As I have two of these in HA mode, does it make sense to do the BGP on these, or should I get dedicated BGP routers? Fixing the internal routing policy so traffic is directed at the active BGP connection. Whats involved here, preferring one BGP link over the other? Thanks again, I obviously need to do some reading of my own, but all the suggestions so far have been very valuable and definitely seem to be pointing in some fruitful directions. Adel On Sun 6:31 PM , James Hess <mysidia(a)gmail.com> wrote: > On Sun, Nov 8, 2009 at 11:34 AM, wrote: > [..] > > connections from different providers I would still have issues. So > > I guess that if my primary Internet goes down I lose connectivity > > to all the publicly addressed devices on that connection. Like > > dmz hosts and so on. I would be interested to hear how this > > can be avoided if at all or do I have to use the same provider. > > You assign multi-homed IP address space to your publicly addressed > devices, > which are not specific to either ISP. You announce to both ISPs, and > you accept some routes from both ISPs. > > You get multi-homed IPs, either by having an existing ARIN allocation, > or getting a /22 from ARIN (special allocation available for > multi-homing), or ask for a /24 from ISP A or ISP B for > multihoming. > > If Link A fails, the BGP session eventually times out and dies: ISP > A's BGP routers withdraw the routes, the IP addresses are then > associated only with provider B. > > And you design your internal routing policy to direct traffic > within your network to the router with an active BGP session. > > Link A's failure is _not_ a total non-event, but a 3-5 minute partial > disruption, while the BGP session times out and updates occur in other > people's routers, is minimal compared to a 3 day outage, if serious > repairs to upstream fiber are required. > > -- > -J > > >

1 0

Failover how much complexity will it add?
by adel＠baklawasecrets.com 08 Nov '09

08 Nov '09

HI, I was recently brought onto a project where some failover is desired, but I think that the number of connections provisioned is excessive. Also hoping to get some guidance with regards to how well I can get the failover to actually work. So currently 4 X 100Mb/s Internet connections have been provisioned. One is to be used for general Internet, out of the organisation, it also terminates VPNs from remote sites belonging to the organisation and some publicly accessible servers -routed DMZ and translated IPs. Second Internet connection to be used for a separate system which has a site-to-site VPN to a third party support vendor. Internet connections 3 and 4 are currently thought of as providing backups for one and two. Both connections firewalled by a Juniper SSG of some description. Now I couldn't get any good answers as to why Internet connections 1 and 2 need to be separate. I think the idea was to make sure that there was enough bandwidth for the third party support VPN. I feel that I can consolidate this into one connection and just use rate limiting to reserve some portion of the bandwidth on the connection and this should be fine. Now if I was to do this then I can make a case for just having one backup Internet connection. However I'm still concerned about failover and reliability issues. So my questions regarding this are: - Should I make sure that the backup Internet connection is from a separate provider? - How can I acheive a failover which doesn't require me to change all the remote VPN endpoints in case of a failover? Its possible to configure failover VPNs on the Junipers, which should take care of this, but how do I take care of the DMZ hosts and external translation? - In fact I think I'm asking what are my options with regard to failover between one Internet connection and the other? I'm hoping to figure out whether adding an extra Internet connection actually gives us that much, in fact whether it justifies the complexity and spend. Many Thanks for your comments. Adel

7 6