October 2014 - mice-discuss - lists.micemn.net

FW: MICE L2 Security Project

by Anthony Anderberg

This first phase is complete, if anyone has trouble peering with the beta testers let us know. Anthony Anderberg Sr. Systems Analyst [NUtel_email_logo_1] 320-234-5239 anthonyanderberg(a)nu-telecom.net<mailto:anthonyanderberg@nu-telecom.net> www.nutelecom.net<http://www.nutelecom.net> From: Anthony Anderberg Sent: Thursday, October 09, 2014 9:08 AM To: MICE Discuss (MICE-DISCUSS(a)LISTS.IPHOUSE.NET) Subject: FW: MICE L2 Security Project As a reminder, at 10am this morning we'm planning on making the first set of changes below for our beta testers: US Internet, Paul Bunyan Communications, CNS, IP House, and Wikstrom Telephone. I can be reached at 320-234-5539 if anyone has issues. Cheers, anthony Anthony Anderberg Sr. Systems Analyst [NUtel_email_logo_1] 320-234-5239 anthonyanderberg(a)nu-telecom.net<mailto:anthonyanderberg@nu-telecom.net> www.nutelecom.net<http://www.nutelecom.net> From: Anthony Anderberg Sent: Wednesday, October 01, 2014 11:58 PM To: MICE Discuss (MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>); 'MICE-ANNOUNCE(a)LISTS.IPHOUSE.NET' Subject: MICE L2 Security Project We're at a point where the L2 security team feels ready to make the config changes we've talked about in the past. Although these changes can't protect us from every scenario they should protect the exchange from the many common issues. As discussed at the last meeting member ports will be limited to 5 MAC addresses, storm control will be enabled at 20%, and spanning tree BPDU packets will be filtered. Additionally the exchange will support jumbo frames should members want to exchange them with each other. Obviously if any member needs alternate configuration we'll strive to be as accommodating as possible within the larger project goals. We do not anticipate any downtime, but will send out a group reminder before starting the configuration work. Our schedule: Thursday 10/9/2014 at 10AM = Make global config changes and port changes for beta testers Thursday 10/16/2014 at 10AM = Make port config changes for all other members The beta testers are: US Internet, Paul Bunyan Communications, CNS, IP House, and Wikstrom Telephone. Below is the configuration we'll be using and will publish on our web site for members to review and enjoy. As always questions and comments are welcome, anthony ----------------------------- **Cisco Switch Config ** Global Config: system mtu 1998 # Already set system mtu jumbo 9198 # Already set mac address-table aging-time 14400 errdisable detect cause link-flap errdisable recovery cause link-flap errdisable recovery cause storm-control vtp mode transparent Cisco Port Config: switchport block multicast switchport block unicast # Unknown unicasts that is. switchport port-security maximum 5 switchport port-security switchport port-security violation restrict storm-control broadcast level 20.00 spanning-tree bpdufilter enable no cdp enable ----------------------------- ** Juniper Switch Config ** Juniper Core Switch Global: set protocols rstp bridge-priority 1 # On the main switch stack set ethernet-switching-options storm-control interface all Juniper Port Config: set interface XXX mtu 9216 set protocols rstp interface XXX edge set ethernet-switching-options bpdu-block interface XXX set ethernet-switching-options bpdu-block disable-timeout 60 set ethernet-switching-options secure-access-port interface XXX mac-limit 5 set storm-control interface XXX level 20 -----------------------------

Oct. 9, 2014

FW: MICE L2 Security Project

by Anthony Anderberg

As a reminder, at 10am this morning we'm planning on making the first set of changes below for our beta testers: US Internet, Paul Bunyan Communications, CNS, IP House, and Wikstrom Telephone. I can be reached at 320-234-5539 if anyone has issues. Cheers, anthony Anthony Anderberg Sr. Systems Analyst [NUtel_email_logo_1] 320-234-5239 anthonyanderberg(a)nu-telecom.net<mailto:anthonyanderberg@nu-telecom.net> www.nutelecom.net<http://www.nutelecom.net> From: Anthony Anderberg Sent: Wednesday, October 01, 2014 11:58 PM To: MICE Discuss (MICE-DISCUSS(a)LISTS.IPHOUSE.NET) 'MICE-ANNOUNCE(a)LISTS.IPHOUSE.NET' Subject: MICE L2 Security Project We're at a point where the L2 security team feels ready to make the config changes we've talked about in the past. Although these changes can't protect us from every scenario they should protect the exchange from the many common issues. As discussed at the last meeting member ports will be limited to 5 MAC addresses, storm control will be enabled at 20%, and spanning tree BPDU packets will be filtered. Additionally the exchange will support jumbo frames should members want to exchange them with each other. Obviously if any member needs alternate configuration we'll strive to be as accommodating as possible within the larger project goals. We do not anticipate any downtime, but will send out a group reminder before starting the configuration work. Our schedule: Thursday 10/9/2014 at 10AM = Make global config changes and port changes for beta testers Thursday 10/16/2014 at 10AM = Make port config changes for all other members The beta testers are: US Internet, Paul Bunyan Communications, CNS, IP House, and Wikstrom Telephone. Below is the configuration we'll be using and will publish on our web site for members to review and enjoy. As always questions and comments are welcome, anthony ----------------------------- **Cisco Switch Config ** Global Config: system mtu 1998 # Already set system mtu jumbo 9198 # Already set mac address-table aging-time 14400 errdisable detect cause link-flap errdisable recovery cause link-flap errdisable recovery cause storm-control vtp mode transparent Cisco Port Config: switchport block multicast switchport block unicast # Unknown unicasts that is. switchport port-security maximum 5 switchport port-security switchport port-security violation restrict storm-control broadcast level 20.00 spanning-tree bpdufilter enable no cdp enable ----------------------------- ** Juniper Switch Config ** Juniper Core Switch Global: set protocols rstp bridge-priority 1 # On the main switch stack set ethernet-switching-options storm-control interface all Juniper Port Config: set interface XXX mtu 9216 set protocols rstp interface XXX edge set ethernet-switching-options bpdu-block interface XXX set ethernet-switching-options bpdu-block disable-timeout 60 set ethernet-switching-options secure-access-port interface XXX mac-limit 5 set storm-control interface XXX level 20 -----------------------------

Oct. 9, 2014

Re: Outage Today

by Danny Meister

Us too. Some kind of flooding again. I saw traffic coming across our port that wasn¹t ours. Danny Atomic Data On 10/7/14, 12:27 PM, "Jeremy Lumby" <jlumby(a)MNVOIP.COM> wrote: >Does anyone know what happened today around 10:48AM today? I experienced >a large amount of packet loss across the exchange for about 3 minutes

Oct. 7, 2014

Outage Today

by Jeremy Lumby

Does anyone know what happened today around 10:48AM today? I experienced a large amount of packet loss across the exchange for about 3 minutes

Oct. 7, 2014

Re: Please welcome Netflix to MICE!

by Doug McIntyre

On Fri, Oct 03, 2014 at 08:45:26AM -0500, Jason Hanke wrote: > Netflix will connect to the main switch with two LAG groups > > LAG Group 1 > IPv4 Address: 206.108.255.35/24 > IPv6 address: 2001:504:27:0:0:0b5a::1/64 > Member ports: xe-0/0/21, xe-0/0/22 > > > LAG Group 2 > IPv4 Address: 206.108.255.36/24 > IPv6 address: 2001:504:27:0:0:0b5a::2/64 > Member ports: xe-0/0/23, xe-0/0/24 > > ASN: 2906 > Contact: peering(a)netflix.com > > Please configure the route servers and switches. Alright! Okay, switch LAG's and route reflectors are setup to take them when they are ready. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Oct. 3, 2014

Please welcome Netflix to MICE!

by Jason Hanke

Netflix will connect to the main switch with two LAG groups LAG Group 1 IPv4 Address: 206.108.255.35/24 IPv6 address: 2001:504:27:0:0:0b5a::1/64 Member ports: xe-0/0/21, xe-0/0/22 LAG Group 2 IPv4 Address: 206.108.255.36/24 IPv6 address: 2001:504:27:0:0:0b5a::2/64 Member ports: xe-0/0/23, xe-0/0/24 ASN: 2906 Contact: peering(a)netflix.com Please configure the route servers and switches. Netflix has assigned ticket number NCO-2543 on their side if the NOC needs to be contacted. Thanks and welcome aboard! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Oct. 3, 2014

MICE L2 Security Project

by Anthony Anderberg

We're at a point where the L2 security team feels ready to make the config changes we've talked about in the past. Although these changes can't protect us from every scenario they should protect the exchange from the many common issues. As discussed at the last meeting member ports will be limited to 5 MAC addresses, storm control will be enabled at 20%, and spanning tree BPDU packets will be filtered. Additionally the exchange will support jumbo frames should members want to exchange them with each other. Obviously if any member needs alternate configuration we'll strive to be as accommodating as possible within the larger project goals. We do not anticipate any downtime, but will send out a group reminder before starting the configuration work. Our schedule: Thursday 10/9/2014 at 10AM = Make global config changes and port changes for beta testers Thursday 10/16/2014 at 10AM = Make port config changes for all other members The beta testers are: US Internet, Paul Bunyan Communications, CNS, IP House, and Wikstrom Telephone. Below is the configuration we'll be using and will publish on our web site for members to review and enjoy. As always questions and comments are welcome, anthony ----------------------------- **Cisco Switch Config ** Global Config: system mtu 1998 # Already set system mtu jumbo 9198 # Already set mac address-table aging-time 14400 errdisable detect cause link-flap errdisable recovery cause link-flap errdisable recovery cause storm-control vtp mode transparent Cisco Port Config: switchport block multicast switchport block unicast # Unknown unicasts that is. switchport port-security maximum 5 switchport port-security switchport port-security violation restrict storm-control broadcast level 20.00 spanning-tree bpdufilter enable no cdp enable ----------------------------- ** Juniper Switch Config ** Juniper Core Switch Global: set protocols rstp bridge-priority 1 # On the main switch stack set ethernet-switching-options storm-control interface all Juniper Port Config: set interface XXX mtu 9216 set protocols rstp interface XXX edge set ethernet-switching-options bpdu-block interface XXX set ethernet-switching-options bpdu-block disable-timeout 60 set ethernet-switching-options secure-access-port interface XXX mac-limit 5 set storm-control interface XXX level 20 -----------------------------

Oct. 2, 2014