January 2011 - mice-discuss - lists.micemn.net

Re: FYII: MICE 10Gig Switch

by Mike Horwath

On 1/20/11 10:47 AM, "Dan Olsen" <Dano(a)WINDOMNET.COM> wrote: >Mike >you are way to honest. You should have blamed the key board. > > >Great job and appreciate the posts. Anyone that knows me knows I can't do that, except in jest. Or Doug made me do it, that works too. -- Mike Horwath ipHouse - Welcome home! drechsau(a)iphouse.net The universe is an island, surrounded by whatever it is that surrounds universes. - Berkeley Fortune ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 20, 2011

Re: FYII: MICE 10Gig Switch

by Dan Olsen

Mike you are way to honest. You should have blamed the key board. Great job and appreciate the posts. Dan Olsen Operations Manager Windomnet City OF Windom 443 10th St PO Box 38 Windom MN 56101 507-832-8007 _____ From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Mike Horwath Sent: Thursday, January 20, 2011 3:21 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] FYII: MICE 10Gig Switch On 1/19/11 3:55 PM, "James Montz" <jamesmontz(a)MANKATONETWORKS.NET> wrote: >CNS added to Route Servers (IPv4). >Waiting on permissions issue to be resolved on the IPv6 Router Server >daemon. Resolved, damn transposition of letters! -- Mike Horwath ipHouse - Welcome home! drechsau(a)iphouse.net The universe is an island, surrounded by whatever it is that surrounds universes. - Berkeley Fortune ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> &A=1 _____ No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1191 / Virus Database: 1435/3390 - Release Date: 01/19/11 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 20, 2011

Re: FYII: MICE 10Gig Switch

by Mike Horwath

On 1/19/11 3:55 PM, "James Montz" <jamesmontz(a)MANKATONETWORKS.NET> wrote: >CNS added to Route Servers (IPv4). >Waiting on permissions issue to be resolved on the IPv6 Router Server >daemon. Resolved, damn transposition of letters! -- Mike Horwath ipHouse - Welcome home! drechsau(a)iphouse.net The universe is an island, surrounded by whatever it is that surrounds universes. - Berkeley Fortune ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 20, 2011

Latest Router Server Stats 1/19/2011

by James Montz

Routes: *213* Established BGP Peers: *5* ipHouse ASN_7753 Selloxx ASN_46131 Airstream ASN_11796 SDN ASN_13576 Avant Garde ASN_53480 Following PEER's are configured but not establishing TDS ASN_4181 CNS ASN_32609 --------------------------------------------------- *James C. Montz* Senior Consultant *Mankato Networks LLC* <http://www.mankatonetworks.net/>320 East Liberty Street <http://maps.google.com/maps?q=320+East+Liberty+Street%2CMankato%2CMN+56001&…>Mankato, MN 56001 *Phone:* *(320)-496-6689* *Email: jamesmontz(a)mankatonetworks.net* *Web: http://www.mankatonetworks.net Skype: james.montz* * http://www.linkedin.com/in/jmontz* ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: FYII: MICE 10Gig Switch

by James Montz

CNS added to Route Servers (IPv4). Waiting on permissions issue to be resolved on the IPv6 Router Server daemon. --------------------------------------------------- *James C. Montz* Senior Consultant *Mankato Networks LLC* <http://www.mankatonetworks.net/>320 East Liberty Street <http://maps.google.com/maps?q=320+East+Liberty+Street%2CMankato%2CMN+56001&…>Mankato, MN 56001 *Phone:* *(320)-496-6689* *Email: jamesmontz(a)mankatonetworks.net* *Web: http://www.mankatonetworks.net Skype: james.montz* * http://www.linkedin.com/in/jmontz* On Wed, Jan 19, 2011 at 9:40 AM, Steve Howard <showard(a)paulbunyan.net>wrote: > The CNS ASN is 32609 > > Thanks, > Steve > > > On 01/17/2011 09:02 AM, James Montz wrote: > > Just nees their ASN > On Jan 16, 2011 12:30 PM, "Jay Hanke" <jayhanke(a)mankatonetworks.net> > wrote: > >> management/monitoring/whatever. I also installed a 10Gig connection for > >> CNS and have sent a request to FWR for a cross-connect to the MICE1 > >> Switch. (CNS will pay the monthly on the cross connect). > > > > Steve, I assume you're coming in on fiber so I assigned you Gi1/2. The > > CNS IP is .50 and :0050 for v6. > > > > James/Anthony, can you build the peering config for CNS in the route > servers? > > > > > > -- > > Jay Hanke > > CTO, CCIE #19093 > > Mankato Networks LLC > > 320 East Liberty Street > > Mankato, MN 56001-3838 > > Google 530-618-2398 > > jayhanke(a)mankatonetworks.net > > http://www.mankatonetworks.com > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: Route Server Security

by Jay Hanke

Bogons are being filtered and I believe we are capping the prefixes. Default routes are also filtered. We can look into the irr but it does add a bit of burden for those not currently using a registry. I would add that private as numbers need to be filtered on the route server. On Jan 19, 2011 2:53 PM, "Andrew Hoyos" <hoyosa(a)gmail.com> wrote: > Welcome to the insecurities of how the internet works :) > > But, I'd agree - this seems like a lot of work for folks to maintain > prefix filters... > > If everyone can agree to maintain proper IRR policy/objects, we could > have irrpt or the like build prefix filters on an automated basis and > suck into the route servers, but we'd have to get consensus of the > group. > > At the very least, the route servers could check as-path, filter > bogons, and police a reasonable max-prefix (if they don't already). > > On Wed, Jan 19, 2011 at 2:36 PM, Steve Howard <showard(a)paulbunyan.net> wrote: >> I haven't heard any discussions about this, but I think that is >> something that we should look into. The downside is that every time >> somebody adds a network or a customer with an ARIN allocation it would >> require human maintenance. I wouldn't want to have that job. I also >> suspect that it could be problematic for organizations with a large >> number of netblocks. >> >> Can our route servers read routes from a routing registry? >> >> >> >> On 01/19/2011 02:05 PM, Jeremy Lumby wrote: >>> I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? >>> >>> Jeremy >>> >>> ######################################################################## >>> >>> To unsubscribe from the MICE-DISCUSS list, click the following link: >>> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >>> >>> >> >> ######################################################################## >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: Route Server Security

by Andrew Hoyos

Welcome to the insecurities of how the internet works :) But, I'd agree - this seems like a lot of work for folks to maintain prefix filters... If everyone can agree to maintain proper IRR policy/objects, we could have irrpt or the like build prefix filters on an automated basis and suck into the route servers, but we'd have to get consensus of the group. At the very least, the route servers could check as-path, filter bogons, and police a reasonable max-prefix (if they don't already). On Wed, Jan 19, 2011 at 2:36 PM, Steve Howard <showard(a)paulbunyan.net> wrote: > I haven't heard any discussions about this, but I think that is > something that we should look into. The downside is that every time > somebody adds a network or a customer with an ARIN allocation it would > require human maintenance. I wouldn't want to have that job. I also > suspect that it could be problematic for organizations with a large > number of netblocks. > > Can our route servers read routes from a routing registry? > > > > On 01/19/2011 02:05 PM, Jeremy Lumby wrote: >> I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? >> >> Jeremy >> >> ######################################################################## >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> >> > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: Route Server Security

by Steve Howard

I haven't heard any discussions about this, but I think that is something that we should look into. The downside is that every time somebody adds a network or a customer with an ARIN allocation it would require human maintenance. I wouldn't want to have that job. I also suspect that it could be problematic for organizations with a large number of netblocks. Can our route servers read routes from a routing registry? On 01/19/2011 02:05 PM, Jeremy Lumby wrote: > I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? > > Jeremy > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Route Server Security

by Jeremy Lumby

I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? Jeremy ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: FYII: MICE 10Gig Switch

by Steve Howard

The CNS ASN is 32609 Thanks, Steve On 01/17/2011 09:02 AM, James Montz wrote: > > Just nees their ASN > > On Jan 16, 2011 12:30 PM, "Jay Hanke" <jayhanke(a)mankatonetworks.net > <mailto:jayhanke@mankatonetworks.net>> wrote: > >> management/monitoring/whatever. I also installed a 10Gig > connection for > >> CNS and have sent a request to FWR for a cross-connect to the MICE1 > >> Switch. (CNS will pay the monthly on the cross connect). > > > > Steve, I assume you're coming in on fiber so I assigned you Gi1/2. The > > CNS IP is .50 and :0050 for v6. > > > > James/Anthony, can you build the peering config for CNS in the route > servers? > > > > > > -- > > Jay Hanke > > CTO, CCIE #19093 > > Mankato Networks LLC > > 320 East Liberty Street > > Mankato, MN 56001-3838 > > Google 530-618-2398 > > jayhanke(a)mankatonetworks.net <mailto:jayhanke@mankatonetworks.net> > > http://www.mankatonetworks.com > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > ------------------------------------------------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011