March 2022 - mice-discuss - lists.micemn.net

Re: MICE Remote Switch Policy

by Reid Fishler

Thanks Richard for this great summary of what the board has been pondering for a bit... Reid On Thu, Mar 24, 2022 at 4:58 PM Richard Laager <rlaager(a)wiktel.com> wrote: > I've had some discussions with the board as well as with Jay and Jeremy on > these topics. The board consensus was to bring this (in general) to the > membership for more input. > > As to the specifics, while I know others agree with at least parts of > this, I'm only speaking for myself here. I'll let everyone articulate their > own positions. (This disclaimer should not be read as me signaling the > existance of disagreement either. I just don't want to put words in other > people's mouths.) > > > Our current policy on remote switches is here: > https://micemn.net/technical.html#remotes It has the proposal presented > to the membership for discussion, then the board makes a final decision. > > Is this decision ministerial or discretionary? That is, if the remote > switch proposal checks all the boxes in our policy, is MICE "required" > (supposed to) always grant it, or is the board supposed to apply some > discretion? > > If the decision is ministerial, then why bother bringing this to the board > (or for that matter, the members) all? Couldn't we save a bunch of time and > hassle and simply have management (in some form, whether that's me, Jay, > and/or Jeremy) approve it? > > If the decision is discretionary, are there particular criteria that the > board should consider (above and beyond the listed criteria)? > > One criteria used in a discussion I had (and I can't recall which of us > said it first) is "MICE's strategic interests". What would that phrase mean > to you; what are some strategic interests of MICE? > > For a bit of an absurd example for the thought experiment, imagine that > someone was proposing a MICE remote switch, but we knew their goal was to > attract a bunch of members and then convert that into a competing exchange. > Is that something we would have to agree to simply because they met all the > objective criteria? > > When we were new and little, MICE certainly had an interest in making > every decision in a way that would maximize additional peering. However, at > this point, the calculus may be (I'd argue is) different. We are moving a > lot of traffic and are important to our members / in our region. We have to > be careful that our decisions do not destabilize the exchange--in multiple > ways: technical, financial, or political. > > > Either way, should we expand the list of objective criteria in the policy? > Some examples: > > - We have previously discussed dedicated vs non-dedicated switches. As > time goes along, I am more convinced than ever that MICE remote switches > should be required to be dedicated. Non-dedicated switches present extra > complications for configuration and troubleshooting. (Jeremy has some > additional insight on this that he will share.) I think we should make it a > requirement that the switch be dedicated. (Perhaps the board could still > grant an exception in exceptional cases.) > - Should we require that a remote switch have X number of participants > committed? And if so, what is X? In my view, it hardly makes sense to have > a remote switch one or two participants. They could just as well backhaul > to MICE directly. > > The criteria for allowing new remote switches vs disconnecting existing > remotes need not be the same. If we set a minimum of e.g. 5 participants, > we don't necessarily need to disconnect existing remotes that don't meet > that. And I think the consensus is that we would not, barring them creating > some significant problem. > > > How do we feel about far-away remote switches? (This is a live issue in > the context of the proposed Kansas City remote.) > > Some concerns: > > - At Wiktel, I peer with MN VoIP's far away extensions in Minneapolis. > For example, I peer at SeattleIX (SIX) in Minneapolis. This has caused me > some issues. For example, latency-sensitive gaming traffic was tromboning > Wiktel-Minneapolis-Seattle-Chicago-Seattle-Minneapolis-Wiktel rather than > Wiktel-Chicago-Wiktel. > - Is it safe to have a broadcast domain that stretches across multiple > states (or half a continent, in the SIX case)? > - If we take this to its logical extreme... Imagine we had a MICE > extension in every datacenter in the U.S. I think that is pretty obviously > untenable for a bunch of reasons. Something close to that is actually > within the realm of possibility, with some of these virtual extension > things that people are doing. (Reid would be able to cite who.) Granted, > nobody is proposing that today, but where should we draw the line? > - Far-away extensions may reduce the incentive for CDNs to install > locally. > > Some counterpoints: > > - Nobody is forcing networks to use the far-away remotes. > - If people choose to use them, they take their routing into their own > hands. They need to understand the tromboning risk and set their own > routing policy. > - Counter-counterpoint: Do they? Especially smaller / less > experienced networks? Have we adequately warned them? > - Counter-counterpoint: The existence of these far-away peers > doesn't affect just them. It also affects the other networks with which > they peer. Everyone on the exchange needs to be aware of the existence of > far-away participants and handle their routing policy accordingly. If there > are enough far-away peers, this might tip networks into an opt-in route > server policy, or even to only do bilaterals. This will disadvantage small > participants. > - Networks can backhaul into far-away exchanges directly. > - Counter-counterpoint: But a remote switch makes this cheaper / > more feasible / more common, which is literally the point of creating such > a remote switch. > - For a local eyeball network in Des Moines, neither MICE nor > Kansas City are far-away from me. Even MICE via Kansas City is not likely > to be problematic. This might be the only economically feasible way they > could peer with Minneapolis content. > > -- > Richard > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- Reid Fishler Senior Director Hurricane Electric +1-510-580-4178

March 24, 2022

MICE Remote Switch Policy

by Richard Laager

I've had some discussions with the board as well as with Jay and Jeremy on these topics. The board consensus was to bring this (in general) to the membership for more input. As to the specifics, while I know others agree with at least parts of this, I'm only speaking for myself here. I'll let everyone articulate their own positions. (This disclaimer should not be read as me signaling the existance of disagreement either. I just don't want to put words in other people's mouths.) Our current policy on remote switches is here: https://micemn.net/technical.html#remotes It has the proposal presented to the membership for discussion, then the board makes a final decision. Is this decision ministerial or discretionary? That is, if the remote switch proposal checks all the boxes in our policy, is MICE "required" (supposed to) always grant it, or is the board supposed to apply some discretion? If the decision is ministerial, then why bother bringing this to the board (or for that matter, the members) all? Couldn't we save a bunch of time and hassle and simply have management (in some form, whether that's me, Jay, and/or Jeremy) approve it? If the decision is discretionary, are there particular criteria that the board should consider (above and beyond the listed criteria)? One criteria used in a discussion I had (and I can't recall which of us said it first) is "MICE's strategic interests". What would that phrase mean to you; what are some strategic interests of MICE? For a bit of an absurd example for the thought experiment, imagine that someone was proposing a MICE remote switch, but we knew their goal was to attract a bunch of members and then convert that into a competing exchange. Is that something we would have to agree to simply because they met all the objective criteria? When we were new and little, MICE certainly had an interest in making every decision in a way that would maximize additional peering. However, at this point, the calculus may be (I'd argue is) different. We are moving a lot of traffic and are important to our members / in our region. We have to be careful that our decisions do not destabilize the exchange--in multiple ways: technical, financial, or political. Either way, should we expand the list of objective criteria in the policy? Some examples: * We have previously discussed dedicated vs non-dedicated switches. As time goes along, I am more convinced than ever that MICE remote switches should be required to be dedicated. Non-dedicated switches present extra complications for configuration and troubleshooting. (Jeremy has some additional insight on this that he will share.) I think we should make it a requirement that the switch be dedicated. (Perhaps the board could still grant an exception in exceptional cases.) * Should we require that a remote switch have X number of participants committed? And if so, what is X? In my view, it hardly makes sense to have a remote switch one or two participants. They could just as well backhaul to MICE directly. The criteria for allowing new remote switches vs disconnecting existing remotes need not be the same. If we set a minimum of e.g. 5 participants, we don't necessarily need to disconnect existing remotes that don't meet that. And I think the consensus is that we would not, barring them creating some significant problem. How do we feel about far-away remote switches? (This is a live issue in the context of the proposed Kansas City remote.) Some concerns: * At Wiktel, I peer with MN VoIP's far away extensions in Minneapolis. For example, I peer at SeattleIX (SIX) in Minneapolis. This has caused me some issues. For example, latency-sensitive gaming traffic was tromboning Wiktel-Minneapolis-Seattle-Chicago-Seattle-Minneapolis-Wiktel rather than Wiktel-Chicago-Wiktel. * Is it safe to have a broadcast domain that stretches across multiple states (or half a continent, in the SIX case)? * If we take this to its logical extreme... Imagine we had a MICE extension in every datacenter in the U.S. I think that is pretty obviously untenable for a bunch of reasons. Something close to that is actually within the realm of possibility, with some of these virtual extension things that people are doing. (Reid would be able to cite who.) Granted, nobody is proposing that today, but where should we draw the line? * Far-away extensions may reduce the incentive for CDNs to install locally. Some counterpoints: * Nobody is forcing networks to use the far-away remotes. * If people choose to use them, they take their routing into their own hands. They need to understand the tromboning risk and set their own routing policy. o Counter-counterpoint: Do they? Especially smaller / less experienced networks? Have we adequately warned them? o Counter-counterpoint: The existence of these far-away peers doesn't affect just them. It also affects the other networks with which they peer. Everyone on the exchange needs to be aware of the existence of far-away participants and handle their routing policy accordingly. If there are enough far-away peers, this might tip networks into an opt-in route server policy, or even to only do bilaterals. This will disadvantage small participants. * Networks can backhaul into far-away exchanges directly. o Counter-counterpoint: But a remote switch makes this cheaper / more feasible / more common, which is literally the point of creating such a remote switch. * For a local eyeball network in Des Moines, neither MICE nor Kansas City are far-away from me. Even MICE via Kansas City is not likely to be problematic. This might be the only economically feasible way they could peer with Minneapolis content. -- Richard

March 24, 2022

Re: icmp v6 nd storm ~ 00:58:01 2022/03/18 GMT?

by Richard Laager

On 3/17/22 21:09, Richard Laager wrote: > I will provide a more detailed explanation of my mistakes later. The existing servers are _only_ route servers. The new servers will be virtualization hosts running multiple VMs. The route servers will be running on there, but so will other things: IXP Manager, something to answer ARP for the blackholing we want to setup, Cacti will be brought in house, etc. Therefore, the host has bridging configured. We are tentatively planning to setup a quarantine VLAN as some other exchanges have done. This would also have quarantine route servers on it, which would behave normally except they would not advertise any routes out. This quarantine VLAN obviously needs to exist on the exchange switches because participant ports would be put into it. Because there will be multiple VLANs, the plan was to use VLAN tagging between the Arista and the new physical servers. The MICE VLAN is setup as VLAN 1. Before you say it... I don't think anyone likes that. Jeremy and I are of the opinion that this should change at some point in the future, but it doesn't seem worth doing until we are taking down the fabric anyway (e.g. a reboot of the Arista). In light of all that, our plan was (and in hindsight, I believe this to be mistake #1) to configure the main MICE VLAN as untagged, with the idea of adding the quarantine VLAN as tagged in the future. Cameron and I felt it was important to confirm the network was working to the MICE fabric before leaving Minneapolis, since we both live so far away. In hindsight, this was a good idea; had I made the same configuration mistake while working remote, it would have been slower to fix (at a minimum). The new systems are running Ubuntu 22.04 LTS which is increasingly frozen by the day [1] and will have a final release on April 21. So by the time we get everything configured, it will likely be released. This avoids us installing 20.04 LTS now and then wanting an upgrade immediately. Ubuntu (whether 22.04 LTS, or even 20.04 LTS) uses netplan to configure network interfaces. netplan uses an exclusively [2] declarative configuration model (unlike ifupdown, which is mostly declarative but some things can only be done with imperative commands). I'm actually a fan of netplan; it has made network configuration quite a bit nicer than ifupdown for me. I was not sure how to configure an untagged VLAN in netplan. I reviewed the documentation and was still unsure. I saw that the vlan "id" parameter was documented [3] as accepting a value of 0-4094. I figured I'd try 0 to see if that meant untagged. That did not work. I did a packet capture and found that 0 meant an explicit tag of 0. Having no more ideas, I gave up and removed the VLAN configuration, going back to just a straight interface. I figured I'd look at it more later. One of the big advantages of netplan is that it is (supposed to be) idempotent. That is, you configure it the way you want, run `netplan apply` and it makes it so. You don't (usually) need to explicitly manage the transition from the old state to the new state. Unfortunately, that is not true for bridging and/or VLANs, at least in some cases. In hindsight, for bridging, that largely makes sense. After all, you wouldn't want a `netplan apply` to remove the VMs host-side interfaces from the bridge group(s). But for VLANs, it seems like this is probably just something nobody implemented, as opposed to being desirable in theory. This was mistake #2 and the immediate cause of the loop. I ended up with a bridge interface that consisted of the physical interface (facing the MICE switch) and a VLAN interface (with an ID of 0) on that same physical interface. So as traffic came in, it was bridged back out the same physical interface, this time with an explicit VLAN 0 tag. Based on the fact that the explicit 0 tag didn't pass traffic normally in the first place, I don't think I was necessarily looping traffic at layer 3. But broadcast traffic would have been looped back to the switch, with the source MAC staying the same. This would obviously mess up the switch's MAC table. I believe that was the immediate cause of the issue. I noticed that things were not behaving quite right (some packet loss). I started a packet capture. When that was very quickly 5 GB rather than some tiny amount, I knew I had made a serious error that likely created a loop. I reflexively confirmed this with a "brctl show bridge", issued a reboot (because why not), and immediate jumped up and unplugged the cables from the back of the servers. When the systems came back up, I confirmed the network configuration was now correct and reconnected the cables. Because the server was expected to have multiple VMs on it, we could not use `port-security maximum 1`. As a result, port-security was not configured. Jeremy and I never had an explicit conversation about this, which was certainly another mistake. Had port-security been enabled, this loo would have been arrested much faster. Additionally, while I mentioned the upcoming work at the UG meeting, not announcing it on MICE-DISCUSS was a mistake. I know we talked about this before. I just forgot to do it. On 3/17/22 21:53, Richard Laager wrote: > Out of an abundance of caution, he is shutting down the ports facing the > new servers, cutting them (the thing we changed today) off completely. The ports have been re-enabled. The ports are now configured with the MICE VLAN _tagged_, which plays well with Linux & netplan. The ports have `port-security maximum 6` configured. This gives us enough headroom to support two route servers (in the event of a hardware failure where both have to run on the same physical box temporarily), two quarantine route servers (same note), the ARP responder, and the host's MAC address (if it shows up somehow). [1] https://discourse.ubuntu.com/t/jammy-jellyfish-release-schedule/23906 [2] Backends, like networkd, can and do implement imperative hooks. But netplan itself is only declarative. And Ubuntu is adding, in multiple cases at my direct suggestion, additional declarative parameters to eliminate the need for hook scripts in many scenarios. [3] https://netplan.io/reference/#properties-for-device-type-vlans%3A -- Richard

March 24, 2022

Corrected Room Code for Summer Meeting

by Jay Hanke

The hotel fixed the booking issue with the block of rooms. The code is now working correctly. Here is a shortcut to the link, you can book one or two nights at the discounted rate. https://reservations.travelclick.com/109230?groupID=3466891 Also to attend you need to register in advance. https://www.eventcreate.com/e/mwps2022 Thanks! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

March 23, 2022

Re: MAC Address Filtering

by AnthonyAnderberg＠nuvera.net

I’m going to be in tonight working on MOPs of my own, contact me off-list and we can talk about timing. Cheers, Anthony From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Larry Larsen <llarsen(a)LONGLINES.BIZ> Reply-To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Date: Wednesday, March 23, 2022 at 3:19 PM To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] MAC Address Filtering Good Afternoon; We are going to be swapping out a router this evening at 511, and if I remember correctly you have a MAC Address filter on your connections. Who do we need to work with to get the new MAC addresses authorized? Thank you! [cid:image001.png@01D83EC9.8E076EB0] Larry L. Larsen Director of Information Technology Phone: 712.271.5920 Email: llarsen(a)longlines.biz<mailto:llarsen@longlines.biz> 504 4th Street Sergeant Bluff, IA 51054 https://www.longlines.com/ [Title: Facebook - Description: image of Facebook icon]<https://www.facebook.com/LongLines/> [Title: LinkedIn - Description: image of LinkedIn icon] <https://www.linkedin.com/company/long-lines> [Title: Twitter - Description: image of Twitter icon] <https://twitter.com/LongLinesBB> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 23, 2022

MAC Address Filtering

by Larry Larsen

Good Afternoon; We are going to be swapping out a router this evening at 511, and if I remember correctly you have a MAC Address filter on your connections. Who do we need to work with to get the new MAC addresses authorized? Thank you! [cid:image001.png@01D83EC9.4D210D70] Larry L. Larsen Director of Information Technology Phone: 712.271.5920 Email: llarsen(a)longlines.biz<mailto:llarsen@longlines.biz> 504 4th Street Sergeant Bluff, IA 51054 https://www.longlines.com/ [Title: Facebook - Description: image of Facebook icon]<https://www.facebook.com/LongLines/> [Title: LinkedIn - Description: image of LinkedIn icon] <https://www.linkedin.com/company/long-lines> [Title: Twitter - Description: image of Twitter icon] <https://twitter.com/LongLinesBB>

March 23, 2022

Midwest Peering Summit Info July 26, 2022

by Jay Hanke

As part of the MICE Summer outreach meeting. We have set up a Peering Summit with a number of neighboring Internet Exchanges. These include OmahaIX, KCIX, QCIX and several others. Each of the involved IXes will be attending and assisting in marketing the event to their users. Here's the link to the registration for the conference. https://www.eventcreate.com/e/mwps2022 Advanced registration is free for peering networks. We'll encounter an extra fee from the venue for attendees not pre registered. We'd ask that you pick up a table if you're going to bring sales folks. We have a block of rooms reserved with a discount at the hotel for rooms from the 25th through the 27th of July at $95 per night. Log into: https://www.stoneycreekhotels.com/ Click book now Des Moines Discount Code: 2207SOUTHF Thanks! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

March 21, 2022

MICE Secretary

by Richard Laager

This is going to MICE-ANNOUNCE too, in this interest of formalities. After the UG 40 meeting on March 11, the MICE board appointed Anthony Anderberg as Secretary. (This is separate from the Treasurer appointment which happened earlier and was mentioned during the meeting.) -- Richard

March 19, 2022

Re: Netnod Down?

by Jeremy Lumby

Last I spoke with them they had a series of software issues crop up with their equipment. I have not spoken with them in a while, It is probably worth reaching out to them to see if they have a new estimated timeframe to repair. From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of David Farmer Sent: Friday, March 18, 2022 8:24 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: [MICE-DISCUSS] Netnod Down? Is Netnod down at MICE? I'm not seeing any routes from them, at least via the route servers. Thanks -- =============================================== David Farmer Email:farmer@umn.edu <Email%3Afarmer(a)umn.edu> Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 =============================================== ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 19, 2022

Netnod Down?

by David Farmer

Is Netnod down at MICE? I'm not seeing any routes from them, at least via the route servers. Thanks -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 ===============================================

March 19, 2022