- mice-discuss - lists.micemn.net

MICE UG 32

by Richard Laager

Reminder: UG 32 is on Wednesday of next week (July 17) at 3:00pm Remote Conferencing: 952-562-5400 passcode MICE (6423) Location Details: Cedar Falls Utilities 1 Utility Pkwy Cedar Falls, IA Agenda The agenda is attached. I'm behind on getting this out, so I didn't send a separate call for agenda. If you have something to add, let me know ASAP and I'll send an updated agenda. As this is an "away" meeting, I intend to skip the repeat old business items. We can pick those up in October. As far as I know, we have no other technical committee report this meeting; if anyone is planning on giving a technical committee report, please let me know. I've also taken the liberty to reorder things a bit. The idea here is to group business (official reports and things that could involve a motion/vote) before open discussion. This way, people who are not interested in the discussion can leave earlier if they wish, confident that they won't miss an official motion/vote. By shortening the "mandatory" part of the meeting, this may make the meetings more accessible. I'd like to give this a try for a couple meetings and see what people think. That said, with this being the summer outreach meeting, we traditionally cover "What is MICE?" first. I kept that at the top, rather than putting it after adjournment. -- Richard

July 9, 2019

Re: Blackholing DoS traffic

by Steve Howard

July 5, 2019

Off Topic Cisco L2TPv3

by Jeremy Lumby

If anyone on MICE has experience with a L2TPv3 tunnel between Cisco routers, could you please contact me directly. I have a situation where the tunnel comes up, and broadcast traffic makes it across, however not unicast traffic. I have tried different routers, and settings, and IOS versions to no avail. Any help on this subject would be greatly appreciated. Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington, MN 55425 M: 612-355-7740 D: 612-392-6814 F: 952-873-7425 jlumby(a)mnvoip.com

July 2, 2019

SFN MN-AlbertLea Remote Switch Notification #72

by Jay Hanke

An upstream vendor will be performing service affecting work on the circuit between Albert Lea and Minneapolis on the following dates. This will potentially affect the connectivity between the SFN MICE Switch and the MICE core. Estimated Start: NIGHT 1 2019-07-09 12:00 AM Estimated End: NIGHT 1 2019-07-09 05:00 AM Estimated Start: NIGHT 2 2019-07-10 12:00 AM Estimated End: NIGHT 2 2019-07-10 05:00 AM -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

July 2, 2019

Re: Please Welcome FDL Communications Corp to MICE!

by AnthonyAnderberg＠nuvera.net

Added FDL to the route servers, switch config, and graph system. Welcome! [signature_21095059] From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Jay Hanke <jayhanke(a)SOUTHFRONT.IO> Reply-To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Date: Friday, June 21, 2019 at 2:29 PM To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] Please Welcome FDL Communications Corp to MICE! Name: FDL Communications Corp Port: Ethernet5/27 (Main Switch) 10GE ASN: 396939 IPv4: 206.108.255.144/24<http://206.108.255.144/24> IPv6: 2001:504:27:0:6:0e8b::1/64 Peering Contact: peering(a)aaniin.net<mailto:peering@aaniin.net> Route Servers- YES BFD: NO Welcome Aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io<mailto:jayhanke@southfront.io> Phone 612-204-0000 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

June 22, 2019

Please Welcome FDL Communications Corp to MICE!

by Jay Hanke

Name: FDL Communications Corp Port: Ethernet5/27 (Main Switch) 10GE ASN: 396939 IPv4: 206.108.255.144/24 IPv6: 2001:504:27:0:6:0e8b::1/64 Peering Contact: peering(a)aaniin.net Route Servers- YES BFD: NO Welcome Aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

June 21, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Darin Steffl

Yes we saw issues from 6:50 to about 7:20 as well. None of our BGP sessions dropped to cogent, HE, or MICE but our customers noticed it and I did see a drop in traffic during that time.. It's stumped me and I'm glad I'm not the only one since I thought it was internal to our network but it appears not. On Thu, Jun 20, 2019, 12:30 PM Jeff Wilde <jeff.wilde(a)parkregion.com> wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? > > > > Jeff Wilde > > IT Manager > > *Park Region Telephone Company* > > P: 218-826-8330 > > E: jeff.wilde(a)parkregion.com > > > > *From:* MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> * On Behalf Of *Andrew > Hoyos > *Sent:* Thursday, June 20, 2019 11:48 AM > *To:* MICE-DISCUSS(a)LISTS.IPHOUSE.NET > *Subject:* Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic > > > > On Jun 20, 2019, at 11:39 AM, Doug McIntyre <merlyn(a)IPHOUSE.NET> wrote: > > On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: > > https://www.seattleix.net/blackholing > > Does MICE have an blackholng functionality equivalent to SIX? > > I was visiting with a DDoS mitigation vendor this morning and was curious > if there was a way we could automatically mitigate DoS attack traffic > coming from a MICE peer. > > > > You can adjust the routing with communities, ie. in the MICE communities > aera of > http://micemn.net/technical.html > > you could block-hole the AS that is sending you that traffic. > > > > unfortunately, that just has the effect of traffic going elsewhere - not a > blackhole effect. the communities in place would just cause the route not > to be advertised to said peer, and the traffic would just ingress your > network via a different path. In the case of a DDOS, it’s likely you have > multiple ASN’s targeting you. > > > > https://www.seattleix.net/blackholing > > > > SIX, as an example, has a blackhole IP address, and the route servers > matching a blackhole community to set next hop to this to sink the traffic > on the switch fabric. > > Perhaps something we should look into for MICE. > > > > > > — > > Andrew Hoyos > > hoyosa(a)gmail.com > > > > > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Dave Williams

We had issues reported last night... it was 'fixed' by the time I looked at things Sent from my T-Mobile 4G LTE Device -------- Original message -------- From: Mike Horwath <drechsau(a)GEEKS.ORG> Date: 6/20/19 12:32 PM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? You mean for Hulu and Netflix going down? :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Jay Hanke

I was in a hotel in waterloo ia on centruylink and had a similar problem about the same time to fb and google. On Thu, Jun 20, 2019, 1:00 PM Brian Riggleman <briggleman(a)jagcom.net> wrote: > We also lost google related sites from 6:50 PM until 7:18 PM. I also was > unable to explain this. > > > Brian Riggleman > > Network Administrator > > Jaguar Communications > > 507-214-0258 briggleman(a)jagcom.net > > > On Thu, Jun 20, 2019 at 12:33 PM Jeff Wilde <jeff.wilde(a)parkregion.com> > wrote: > >> No lost icmp to google and others allegedly but I'm not finding anything. >> >> Jeff Wilde >> IT Manager >> Park Region Telephone Company >> P: 218-826-8330 >> E: jeff.wilde(a)parkregion.com >> >> -----Original Message----- >> From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike >> Horwath >> Sent: Thursday, June 20, 2019 12:32 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET >> Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic >> >> On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: >> > On a separate note, did anyone experience very intermittent Internet >> > issues last night for about 30 minutes or so? >> >> You mean for Hulu and Netflix going down? :) >> >> -- >> Mike Horwath, reachable via drechsau(a)Geeks.ORG >> > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Andrew Hoyos

On Jun 20, 2019, at 12:31 PM, Mike Horwath <drechsau(a)GEEKS.ORG> wrote: > > On Thu, Jun 20, 2019 at 11:48:13AM -0500, Andrew Hoyos wrote: >> SIX, as an example, has a blackhole IP address, and the route >> servers matching a blackhole community to set next hop to this to >> sink the traffic on the switch fabric. Perhaps something we should >> look into for MICE. > > A good idea - perahps use a specific community advertisement with > correct next-hop into the ether. > Yes, exactly. Rough logic = route server accepts /32’s from you tagged with 65535:666 route server sets next hop no matching prefixes to 206.108.255.0 206.108.255.0 is a blackhole/null destination on switching fabric, or at least translates to dst-mac-addr that is layer2 acl’d to drop. I’d think a prerequisite for this, however, is getting to a point on the route-servers where we are validating/strict filtering prefixes that folks are sending (via IRR), otherwise, we run the risk of people essentially being able to blackhole others. > You can even automate a few things as well from known blacklists, then > another system to accept new networks to be reviewed then blackholed > for <period of time>. Sure, essentially what many folks do already internally for RTBH, and signaling to upstream. We utilize Kentik to flip back community tagged routes via BGP to for us for dst ip’s under attack matching certain parameters. We blackhole these on our core routers via the same logic above (match community, set next hop to a IP w/ a discard/null route). In turn, you can community match these and send upstream if your upstreams support a RTBH community as well. — Andrew Hoyos hoyosa(a)gmail.com

June 20, 2019