December 2011 - mice-discuss - lists.micemn.net

Re: New Switch Proposal

by Andrew Hoyos

On Dec 22, 2011, at 9:01 PM, Doug McIntyre wrote: > mac address limiting to tiny numbers, especially qty 1 won't work. > There are a lot of administrative packets that go across a link coming > from specific well-known MAC addresses, if that administrative packet > gets in before any real traffic, that administrative MAC address will > be learned and real traffic locked out. > > (this is mentioned in the JunOS documentation). > That's why you get those 'administrative packets' to not happen in the first place. No offense, but I don't want to see your cdp/lldp, ospf, stp, keepalives, etc. coming across the IX. On an IX, realistically, we should only be seeing one router/mac address per port, and only IP traffic from said router. AMSIX has a good guide on how to make your devices be quiet for most platforms, here: http://www.ams-ix.net/config-guide/ Now, I could see making exceptions for devices which don't seem to have a way to be quiet, but in 99% of the cases here, a few lines of config can avoid this problem. -- Andrew Hoyos hoyosa(a)gmail.com ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 23, 2011

Re: New Switch Proposal

by Andrew Hoyos

Owen - were you thinking 'sticky-mac' style config, where you must have someone manually config a mac address allowed list for the port? That's not what Jay is suggesting here. On Dec 22, 2011, at 8:41 PM, Jay Hanke wrote: > The benefit is it will block traffic from other mac addresses in the event of a loop or other misconfiguration. The learned mac address will clear automatically when the port goes down so it should not require admin assistance. > > On Dec 22, 2011 8:28 PM, "Owen DeLong" <owend(a)he.net> wrote: > What is the perceived benefit of doing this? The down-side is that whenever anyone has to replace a line card or do an equipment swap, they need to coordinate with someone who can update the port security on the switch. Worse, they need to remember that's an issue at the time or figure it out through a (not terribly convenient) troubleshooting process. > > Owen > > > Sent from my iPad > > On Dec 23, 2011, at 4:23 AM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET> wrote: > > > I have purchased a new EX 2200 switch for the Mankato Networks rack. > > The new switch will be dedicated and will enable traffic stats for > > those connected to my switch. > > > > As a trial, I plan to enable port security on the downstream access > > ports limiting the port to one learned mac-address. The port security > > mechanism is the same on the EX 2200 as the EX 4200 so if successful, > > a similar strategy could be applied to the main switch. > > > > The uplink to the main switch will remain the same. > > > > Pending feedback, I'm planning to perform the move sometime in early January. > > > > Thanks, > > > > Jay > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- Andrew Hoyos hoyosa(a)gmail.com ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 23, 2011

Re: New Switch Proposal

by Doug McIntyre

mac address limiting to tiny numbers, especially qty 1 won't work. There are a lot of administrative packets that go across a link coming from specific well-known MAC addresses, if that administrative packet gets in before any real traffic, that administrative MAC address will be learned and real traffic locked out. (this is mentioned in the JunOS documentation). mac-address limiting is mainly used for untrusted environments such that you are protecting the switch from having its CAM table blasted out turning the switch into broadcast all packets down all ports mode since its CAM table is full. Then the attacker can sniff for traffic they are looking for, hopefully grabbing the traffic they are trying to intercept before the hardware CPU pegged at 100% signals the NOC that something is amiss and they start looking for what is going on. In practice, in such an untrusted environment( untrusted site, untrusted ports, with max of one device per user. ), I found that at a minimum 3 MAC address limit was the practical smallest size I could go, with typically a range of 5 to 10. Otherwise, administrative and other weird packets would shut down the ports due to flase security alerts all the time, and it wasn't practical to have such low limits. On Thu, Dec 22, 2011 at 08:41:47PM -0600, Jay Hanke wrote: > The benefit is it will block traffic from other mac addresses in the event > of a loop or other misconfiguration. The learned mac address will clear > automatically when the port goes down so it should not require admin > assistance. > On Dec 22, 2011 8:28 PM, "Owen DeLong" <owend(a)he.net> wrote: > > > What is the perceived benefit of doing this? The down-side is that > > whenever anyone has to replace a line card or do an equipment swap, they > > need to coordinate with someone who can update the port security on the > > switch. Worse, they need to remember that's an issue at the time or figure > > it out through a (not terribly convenient) troubleshooting process. > > > > Owen > > > > > > Sent from my iPad > > > > On Dec 23, 2011, at 4:23 AM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET> > > wrote: > > > > > I have purchased a new EX 2200 switch for the Mankato Networks rack. > > > The new switch will be dedicated and will enable traffic stats for > > > those connected to my switch. > > > > > > As a trial, I plan to enable port security on the downstream access > > > ports limiting the port to one learned mac-address. The port security > > > mechanism is the same on the EX 2200 as the EX 4200 so if successful, > > > a similar strategy could be applied to the main switch. > > > > > > The uplink to the main switch will remain the same. > > > > > > Pending feedback, I'm planning to perform the move sometime in early > > January. > > > > > > Thanks, > > > > > > Jay > > > > > > ######################################################################## > > > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 -- Doug McIntyre <merlyn(a)iphouse.net> -- ipHouse/Goldengate/Bitstream/ProNS -- Network Engineer/Provisioning/Jack of all Trades ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 23, 2011

Re: New Switch Proposal

by Jay Hanke

The benefit is it will block traffic from other mac addresses in the event of a loop or other misconfiguration. The learned mac address will clear automatically when the port goes down so it should not require admin assistance. On Dec 22, 2011 8:28 PM, "Owen DeLong" <owend(a)he.net> wrote: > What is the perceived benefit of doing this? The down-side is that > whenever anyone has to replace a line card or do an equipment swap, they > need to coordinate with someone who can update the port security on the > switch. Worse, they need to remember that's an issue at the time or figure > it out through a (not terribly convenient) troubleshooting process. > > Owen > > > Sent from my iPad > > On Dec 23, 2011, at 4:23 AM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET> > wrote: > > > I have purchased a new EX 2200 switch for the Mankato Networks rack. > > The new switch will be dedicated and will enable traffic stats for > > those connected to my switch. > > > > As a trial, I plan to enable port security on the downstream access > > ports limiting the port to one learned mac-address. The port security > > mechanism is the same on the EX 2200 as the EX 4200 so if successful, > > a similar strategy could be applied to the main switch. > > > > The uplink to the main switch will remain the same. > > > > Pending feedback, I'm planning to perform the move sometime in early > January. > > > > Thanks, > > > > Jay > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 23, 2011

Re: New Switch Proposal

by Justin Krejci

I don't see how anyone needs to update anything. Once the dynamically learned old mac address ages out the new one could be learned or perhaps as soon as the interface goes down the dynamically learned mac address is flushed depending on how it works on Junos. -----Original Message----- From: Owen DeLong <owend(a)HE.NET> Sender: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Date: Fri, 23 Dec 2011 09:24:03 To: <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Reply-To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: Re: [MICE-DISCUSS] New Switch Proposal What is the perceived benefit of doing this? The down-side is that whenever anyone has to replace a line card or do an equipment swap, they need to coordinate with someone who can update the port security on the switch. Worse, they need to remember that's an issue at the time or figure it out through a (not terribly convenient) troubleshooting process. Owen Sent from my iPad On Dec 23, 2011, at 4:23 AM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET> wrote: > I have purchased a new EX 2200 switch for the Mankato Networks rack. > The new switch will be dedicated and will enable traffic stats for > those connected to my switch. > > As a trial, I plan to enable port security on the downstream access > ports limiting the port to one learned mac-address. The port security > mechanism is the same on the EX 2200 as the EX 4200 so if successful, > a similar strategy could be applied to the main switch. > > The uplink to the main switch will remain the same. > > Pending feedback, I'm planning to perform the move sometime in early January. > > Thanks, > > Jay > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 23, 2011

Re: New Switch Proposal

by Owen DeLong

What is the perceived benefit of doing this? The down-side is that whenever anyone has to replace a line card or do an equipment swap, they need to coordinate with someone who can update the port security on the switch. Worse, they need to remember that's an issue at the time or figure it out through a (not terribly convenient) troubleshooting process. Owen Sent from my iPad On Dec 23, 2011, at 4:23 AM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET> wrote: > I have purchased a new EX 2200 switch for the Mankato Networks rack. > The new switch will be dedicated and will enable traffic stats for > those connected to my switch. > > As a trial, I plan to enable port security on the downstream access > ports limiting the port to one learned mac-address. The port security > mechanism is the same on the EX 2200 as the EX 4200 so if successful, > a similar strategy could be applied to the main switch. > > The uplink to the main switch will remain the same. > > Pending feedback, I'm planning to perform the move sometime in early January. > > Thanks, > > Jay > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 23, 2011

New Switch Proposal

by Jay Hanke

I have purchased a new EX 2200 switch for the Mankato Networks rack. The new switch will be dedicated and will enable traffic stats for those connected to my switch. As a trial, I plan to enable port security on the downstream access ports limiting the port to one learned mac-address. The port security mechanism is the same on the EX 2200 as the EX 4200 so if successful, a similar strategy could be applied to the main switch. The uplink to the main switch will remain the same. Pending feedback, I'm planning to perform the move sometime in early January. Thanks, Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 22, 2011

MICE CNS Switch downtime

by Steve Howard

Hello, CNS will be converting its MICE switch from AC to DC power and moving the switch to a new cabinet on the morning of 12/23 starting around 5:00AM. Service is expected to be down for about 15 minutes for members that are connected to that switch. This will affect MICE connectivity to the following MICE members: CNS Hurricane Electric Northern Lights GigaPOP/Univ of Minnesota Paul Bunyan Communications Wikstrom Telephone I'm sorry for the inconvenience. If you have any questions/issues, feel free to send me e-mail. Thanks, Steve ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 20, 2011

Re: Akamai Memory

by Jeremy Lumby

Sure, not a problem. I have more equipment of my own going into 511 in the next week or so, so I will be there quite a bit. -----Original Message----- From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Jay Hanke Sent: Thursday, December 15, 2011 8:37 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: [MICE-DISCUSS] Akamai Memory Can someone swap some memory in one of the Akamai servers in the next couple of days? Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 15, 2011

Akamai Memory

by Jay Hanke

Can someone swap some memory in one of the Akamai servers in the next couple of days? Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 15, 2011