- mice-discuss - lists.micemn.net

Fwd: [arin-announce] Reminder of Upcoming Deadline for ARIN’s Multifactor Authentication (MFA) Enforcement for ARIN Online
by David Farmer 09 Sep '24

09 Sep '24

If you still need to enable MFA on your ARIN Online Account, DO IT NOW! More than 15,000 ARIN Online Accounts have yet to enable MFA, which is nuts! Thanks. ---------- Forwarded message --------- From: ARIN <info(a)arin.net> Date: Mon, Sep 9, 2024 at 11:25 AM Subject: [arin-announce] Reminder of Upcoming Deadline for ARIN’s Multifactor Authentication (MFA) Enforcement for ARIN Online To: <arin-announce(a)arin.net> On 7 October 2024, ARIN will lock all remaining ARIN Online accounts that have not enabled multifactor authentication (MFA). As of 1 February 2023, ARIN requires MFA on all new ARIN Online accounts. Users with accounts created before February 2023 were notified and encouraged to log in at their earliest opportunity, where they would be prompted to set up MFA. This step was taken to provide stronger security for the registry, reduce the risk of fraud, and increase confidence in the integrity of their ARIN resources. On 17 July, we announced that ARIN was continuing to take steps to secure the registry by enforcing MFA. We engaged in direct communications with 19,853 account holders linked to organizations with direct allocations, detailed reassignments, and reallocations who had not yet enabled MFA on their accounts. These users were notified that they needed to set up MFA within 60 days or their accounts would be locked, As of 4 September 2024, 15,593 accounts have not completed MFA setup. We are extending this deadline by two weeks to allow more time for account holders to enable MFA on existing accounts. We strongly encourage ARIN Online account holders who have not set up MFA to do so before the 7 October deadline. Users with locked accounts can contact Registration Services during ARIN operating hours, 7:00 AM to 7:00 PM ET Monday through Friday, to unlock and set up MFA and regain access to ARIN Online. ARIN relies on the support of its customers to ensure the accuracy and security of the registry. We rely on all our customers to follow best practices for account security and to report any suspicious activity to us immediately. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) --------- Helpful Resources: Need help setting up your MFA? Visit https://www.arin.net/MFA to get started. You’ll find guides on enabling MFA via an authenticator application, SMS, or security key hardware. We also provide information on how to receive and save your MFA recovery codes, as well as what to do if you’ve lost access to your authenticator app, SMS phone number, or security key. -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 ===============================================

1 0

Odd AWS transfer issue
by Danny Meister 07 Sep '24

07 Sep '24

8 11

New QCIX Mailing Lists
by Jay Hanke 06 Sep '24

06 Sep '24

For those that are interested, QCIX has just added mailing lists. https://qcix.mailman3.com/ -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 507-327-2398 https://southfront.io/ <https://southfront.io/path.html>

1 0

Fwd: [Idr] [job@fastly.com: RFC 9234 route leak prevention in the wild!]
by David Farmer 04 Sep '24

04 Sep '24

I think this is something we should add to our list Thanks ---------- Forwarded message --------- From: Job Snijders <job=40fastly.com(a)dmarc.ietf.org> Date: Mon, Sep 2, 2024 at 8:36 AM Subject: [Idr] [job(a)fastly.com: RFC 9234 route leak prevention in the wild!] To: <idr(a)ietf.org> Hello IDR, You might enjoy a report back from the field on route leak blocking based on RFC 9234. Please see below. Kind regards, Job ----- Forwarded message from Job Snijders <job(a)fastly.com> ----- Date: Mon, 2 Sep 2024 13:33:00 +0000 From: Job Snijders <job(a)fastly.com> To: nanog(a)nanog.org Subject: RFC 9234 route leak prevention in the wild! Dear all, I'd like to share an update on RFC 9234 deployment. RFC 9234 titled "BGP Open Policy" aka the "Only-To-Customer" (OTC) BGP Path Attribute is an anti-route-leak mechanism which is *NOT* based on RPKI! (yes ... routing security is more than just RPKI! :-) The basic idea of 9234 is that BGP routers (based on their role in the Gao-Rexford inter-domain routing model) attach a special BGP Path attribute, or take action based on the presence and contents of this BGP Path attribute - with the intention to constrain a route's propagation radius to just the downstream customer cone of the neighboring ASN. Most operators will intuitively understand that any route propagating through multiple IX route servers operated by different IXPs is a route leak: ``` IXP_1 IXP_2 / \ / \ / \ / \ ISP_A ISP_B ISP_C (receives) (leaker) (originates) ``` (figure 1. propagation from right to left; leak scenario) In the above example, ISP_A originates a route towards IXP_1's route servers, IXP_1 propagates the route to ISP_B (so far so good); but for one reason or another ISP_B subsequently continues propagation of the route towards IXP_2's route servers, who in turn propagate it to ISP_C. ISP_B is forwarding IP traffic between ISP_A and ISP_C for zero revenue. ISP_A and ISP_C are probably not expecting ISP_B to be in the middle. This situation can happen as a result of a misconfiguration in ISP_B's equipment, even when all participants use IRR & RPKI ROV to attempt to mitigate the worst routing incidents. What does it matter / impact ============================ Calgary-based YYCIX deployed RFC9234 support in late 2022/early 2023 using OpenBGPD; and FranceIX deployed support using BIRD in Q2 2024. Both IXPs configured their route servers to reject BGP routes that have an OTC attribute attached, and to attach an OTC attribute when propagating routes to the Route Server's peers. As it happens to be, currently (Mon Sep 2 12:26:50 UTC 2024) a small route leak is happening involving both YYCIX and FranceIX Route Servers via an ISP connected to both IXP's Route Servers; with the leak being stopped at YYCIX thanks to RFC 9234! Appendix A contains a table of leaked IPv4 routes. Let's zoom in on 1 entry: ``` $ bgpctl show rib 157.185.154.0/24 detail BGP routing table entry for 157.185.154.0/24 6939 38040 54994 Nexthop 206.126.225.20 (via 206.126.225.20) Neighbor 206.126.225.20 (216.218.252.194) Origin IGP, metric 1911, localpref 100, weight 0, ovs not-found, avs unknown, external, otc leak Last update: 11:58:08 ago Communities: 0:2906 0:16265 0:16276 0:18638 0:41690 0:48641 0:49029 Ext. Communities: ovs not-found Large Communities: 53339:11:1 53339:11:3 Aggregator: 54994 [163.171.131.254] OTC: 51706 ``` (figure 2. inspecting an leaked route using OpenBGPD's CLI) In figure 2. one can see the route is marked as 'otc leak', this was made possible because FranceIX's route server's attached the OTC attribute with the ASN value set to their Route Server's ASN (51706). ``` YYCIX FranceIX . x <adds OTC> \ . \ / \ ISP_A 6939_38040 54994 ``` (figure 3. right to left: real world example of blocked leak) In figure 3 AS 54994 originates 157.185.154.0/24 and propagates a route towards the FranceIX route servers. FranceIX accepts this route (probably because an IRR route object exists) and propagates it onward with the "Only-To-Customer" attribute set to 51706. The route is received by AS 38040, who appear to propagate the route to their upstream 6939. << An AS 38040 router is likely misconfigured! >> Then 6939 sends its customer's routes to the YYCIX route server, but the YYCIX route server recognizes that the route already passed through a 'valley' and thus considers this a leak; and blocks further propagation towards ISP_A. Impact with partial deployment ============================== RFC 9234 is an easy mechanism to configure and debug for both small & large network operators and IXP route server operators. In the above scenario YYCIX and FranceIX are likely the only 2 entities in the entire AS path which support RFC 9234; but we're already seeing leaks being blocked despite partial deployment! It's not hard to imagine that many IX-to-IX route leaks can be blocked with only the IXP operators themselves enabling RFC 9234 support. The world's most populair RS implementations (BIRD and OpenBGPD) already support RFC 9234! Tens of thousands of IX customers would enjoy the benefits of a few hundred IXPs taking action. RFC 9234 has no dependency on the RPKI, this means tha What can you do? ================ Just ask your vendors (your hardware routers and IXPs) to implement and deploy RFC 9234! :-) The more people ask, the more it'll bubble to the top of the priority list. The cost of implementing & deploying RFC 9234 is excellent bang for buck. Closing words ============= Shout out to our friends at FranceIX and MSK-IX for being amongst the first IXPs to deploy RFC 9234! Your effort helped reduce the potential impact of today's route leak! Kind regards, Job (YYCIX volunteer) Appendix A: ----------- Vantage point: YYCIX Route Server 1 (rs1.yycix.ca) Timestamp: Mon Sep 2 12:31:50 UTC 2024 Destination Prefix AS_PATH 102.164.129.0/24 6939 37613 6758 37649 i 102.164.139.0/24 6939 37613 6758 37649 37649 37649 37649 37649 i 102.164.140.0/24 6939 37613 6758 37649 i 102.164.141.0/24 6939 37613 6758 37649 i 102.164.182.0/24 6939 37613 6758 37649 i 154.65.33.0/24 6939 37613 6758 37649 i 154.65.34.0/24 6939 37613 6758 37649 i 154.65.35.0/24 6939 37613 6758 37649 i 154.65.36.0/24 6939 37613 6758 37649 i 154.65.37.0/24 6939 37613 6758 37649 i 154.65.38.0/24 6939 37613 6758 37649 i 154.65.39.0/24 6939 37613 6758 37649 i 154.72.35.0/24 6939 37613 37100 37027 37063 327721 i 157.185.151.0/24 6939 38040 54994 i 157.185.154.0/24 6939 38040 54994 i 163.171.164.0/24 6939 38040 54994 i 192.150.250.0/23 6939 4651 4618 4618 63529 4621 3836 i 196.50.8.0/24 6939 37613 6758 37649 i 196.50.9.0/24 6939 37613 6758 37649 i 196.50.11.0/24 6939 37613 6758 37649 37649 37649 37649 37649 i 196.50.13.0/24 6939 37613 6758 37649 37649 37649 37649 37649 i 196.50.14.0/24 6939 37613 6758 37649 i 2001:67c:15f4::/48 6939 41103 i 2401:c500:fd08::/48 6939 4637 38040 54994 i 2a01:53c0:ff03::/48 6939 4637 38040 54994 i 2a01:53c0:ff0f::/48 6939 4637 38040 54994 i 2a01:58c0::/32 6939 16347 42487 i 2a03:8920::/32 6939 41103 i 2a03:d602::/31 6939 16347 42487 i 2a03:d606::/31 6939 16347 42487 i 2a0d:ee00::/32 6939 16347 42487 i 2a0e:5b80::/29 6939 16347 42487 i 2a0e:e080::/32 6939 16347 42487 i 2a0f:c540::/29 6939 16347 42487 i ----- End forwarded message ----- _______________________________________________ Idr mailing list -- idr(a)ietf.org To unsubscribe send an email to idr-leave(a)ietf.org -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 ===============================================

2 1

Re: [EXTERNAL] - Re: [MICE-DISCUSS] Peering with Google no longer available at MICE IX
by Jeremy Lumby 23 Aug '24

23 Aug '24

I would be willing to bet if you looked just at the eyeball networks on MICE, 90% are getting the majority of their Google traffic across MICE, even if they have caches they are getting the fill across MICE in addition to the non cacheable traffic. Google's caches are not nearly as efficient as many of their competitors.I can confirm with over 10 years of experience dealing with Google that they are almost always very slow to upgrade.Jeremy LumbyMinnesota VoIP9217 17th Ave SSuite 216Bloomington MN 55425Main 612-355-7740Direct 612-392-6814EFax 952-873-7425jlumby(a)mnvoip.com -------- Original message --------From: Miles McCredie <Miles.McCredie(a)MIDCO.COM> Date: 8/23/24 6:34 AM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] [EXTERNAL] - Re: [MICE-DISCUSS] Peering with Google no longer available at MICE IX Curious how many MICE members are in each of the following buckets. Receive limited portion of Google traffic via MICE Midco and, I assume, US Internet are in this bucket Receive a significant portion of Google traffic via MICE today I’ve only got a couple years of experience with Google for Midco but my experience has been that Google will not always provide the cache capacity that I think is appropriate. The last two augments were triggered 9-12 months later than I would have liked. Could be my fault for creating new GNLs but… Miles McCredie Principal Network Engineer II-Core IP Office: 6052755192 Miles.McCredie(a)midco.com Midco.com Let's go beyond. From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Justin Krejci Sent: Thursday, August 22, 2024 5:25 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: [EXTERNAL] - Re: [MICE-DISCUSS] Peering with Google no longer available at MICE IX CAUTION: This email originated from outside of MIDCO. Do not click links or open attachments unless you recognize the sender and know the content is safe. I am not sure what Google's stance is on deploying cache servers at an IX vs remote connection like the ones pending disconnection. If they were to deploy caching nodes at an IX, I assume they would still have a cache-fill requirement in terms of connectivity that has to come from somewhere... of which they appear to be disinterested in maintaining long distance connections going forward. So perhaps this is a donation opportunity for some to entice Google to deploy caching nodes at MICE? Donate local colo and transit bandwidth along with local MICE connectivity? We have numerous Google caching nodes in our network as well as multiple PNIs to Google, so their pending disconnect from MICE will likely have minimal direct impact on our eyeballs. -----Original Message----- From: Aaron Wendel <aaron(a)WHOLESALEINTERNET.NET> Reply-To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Peering with Google no longer available at MICE IX Date: Thu, 22 Aug 2024 22:03:01 +0000 Has MICE requested a cache box from Google? ------ Original Message ------ From "Anthony Anderberg" <AnthonyAnderberg(a)NUVERA.NET> To MICE-DISCUSS(a)LISTS.IPHOUSE.NET Date 8/22/2024 4:28:18 PM Subject Re: [MICE-DISCUSS] Peering with Google no longer available at MICE IX I've been surprised that folks haven't been talking about this more and am curious about everyone's thoughts - as MICE user-members but also in terms of MICE leadership and direction. As a user-member I feel somewhat conflicted: on one hand in an effort to maximize performance I could obtain transport to Chicago and connect to Google there, but I feel like doing so is making Google's problem into my problem and that doing so undercuts the goals of MICE. We've seen content providers move MICE's larger members toward local direct private peering, and I can understand rational behind that even if it shifts traffic away from MICE - but Google is proposing remote direct peering at member's cost which feels different. Of course nobody expects Google to subsidize our corner of the world, I am just curious if there are other aspects we should be thinking about. Thanks in advance, Anthony On 8/22/24, 7:24 AM, "Google Peering Operations No-reply" <peering-ops-noreply(a)google.com <mailto:peering-ops-noreply@google.com>> wrote: Dear Peer, This is a reminder that peering with Google will no longer be available at MICE Internet Exchange from 16th of September. As a result of unsustainable overheads associated with connecting to an IX using remote waves, we have made a decision to stop connecting to IXs that way. MICE IX falls under the category of IXs we remotely connect to. We will withdraw prefixes on 16th of September, and disconnect from the IX on 24th of September. We realize this may cause inconvenience for some peers. If there is another mutually present IX that we can peer in, we will be happy to help set up a bilateral session there - no multilaterals. If there is no mutual IX, traffic may have to be exchanged via indirect paths (transit links). We are not looking to connect to any additional IXs to replace the IX that we are leaving, but if you are considering connecting to another IX and not sure if Google will also be leaving that IX because of this measure, please reach out to us and we can share more. Thank you for your understanding. Sincerely, Google Network Operations To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

4 4

Re: Peering with Google no longer available at MICE IX
by Anthony Anderberg 23 Aug '24

23 Aug '24

I've been surprised that folks haven't been talking about this more and am curious about everyone's thoughts - as MICE user-members but also in terms of MICE leadership and direction. As a user-member I feel somewhat conflicted: on one hand in an effort to maximize performance I could obtain transport to Chicago and connect to Google there, but I feel like doing so is making Google's problem into my problem and that doing so undercuts the goals of MICE. We've seen content providers move MICE's larger members toward local direct private peering, and I can understand rational behind that even if it shifts traffic away from MICE - but Google is proposing remote direct peering at member's cost which feels different. Of course nobody expects Google to subsidize our corner of the world, I am just curious if there are other aspects we should be thinking about. Thanks in advance, Anthony On 8/22/24, 7:24 AM, "Google Peering Operations No-reply" <peering-ops-noreply(a)google.com <mailto:peering-ops-noreply@google.com>> wrote: Dear Peer, This is a reminder that peering with Google will no longer be available at MICE Internet Exchange from 16th of September. As a result of unsustainable overheads associated with connecting to an IX using remote waves, we have made a decision to stop connecting to IXs that way. MICE IX falls under the category of IXs we remotely connect to. We will withdraw prefixes on 16th of September, and disconnect from the IX on 24th of September. We realize this may cause inconvenience for some peers. If there is another mutually present IX that we can peer in, we will be happy to help set up a bilateral session there - no multilaterals. If there is no mutual IX, traffic may have to be exchanged via indirect paths (transit links). We are not looking to connect to any additional IXs to replace the IX that we are leaving, but if you are considering connecting to another IX and not sure if Google will also be leaving that IX because of this measure, please reach out to us and we can share more. Thank you for your understanding. Sincerely, Google Network Operations

8 9

RFP: 511 IP Transit
by Richard Laager 22 Aug '24

22 Aug '24

MICE is in need of IP transit at 511. This is for our management connection. We are looking for IPv4 + IPv6 transit delivered over a 1G copper (if in the same suite), 1G optical, or 10G optical. MICE will take care of the cross-connect. No BGP necessary. We need a /29 of IPv4 space and a /60 of IPv6 space. The current IP space is routed to us over a separate point-to-point (e.g. the /29 is over a /31 point-to-point). Our actual bandwidth usage is very minimal; 100 Mbps is more than plenty. Please specify the speed you are offering. I don't know that we have a specific term length in mind. Month-to-month, 1 year, or 3 year is probably fine. Please specify the term length(s) you are offering. You can reply off-list to Anthony Anderberg <AnthonyAnderberg(a)nuvera.net>. He intends NOT to bid on this. Conflict of interest note: My employer will bid on this. I will recuse from the board vote on it. -- Richard

1 0

bgp down to 206.108.255.117 and 2001:504:27::80a6:0:2 for both as3128 and as2381.. others?
by Michael Hare 09 Jul '24

09 Jul '24

As the subject says, at least two ASN seem to bgp down v4/v6 as of roughly 03:48:42 local [UTC-5]. Is this a bigger thing? Apologies if I missed something. -Michael

3 2

Global Net (AS395466) - Transport Outages
by Global Net NOC 24 Jun '24

24 Jun '24

MICEMN Members – We have been experiencing ongoing outages with our carrier into Minneapolis (whom I will not name) which directly affects our connectivity with MICE. I want to apologize for the drops in our BGP sessions that seem to be happening more and more frequently as our carrier refuses to do anything to address the problem. We are actively seeking another transport option as a long term solution. Short term, all I can do is apologize for all the flaps and outages. GLOBAL NET AS 395466 IPV4 206.108.255.97 IPV6 2001:504:27:0:6:8ca:0:1 Thanks, Global Net NOC noc(a)theglobal.net<mailto:noc@theglobal.net> Global Net Peering peering(a)theglobal.net<mailto:peering@theglobal.net>

1 0

outage of some sort last night
by Jeff Wilde 17 Jun '24

17 Jun '24

Did anyone experience some type of odd outage in the middle of the night? Like before 5am? I don't know if it was a dns issue or what, but it seems to have resolved itself. [A picture containing icon Description automatically generated] Jeff Wilde * Network Engineer * Park Region Office 218.826.6161 * Direct 218.826.8330 * Fax 218.826.6298

4 3

Link to Ridgeview down
by Jeremy Lumby 10 Jun '24

10 Jun '24

An FYI that we are aware that the link between the MICE core switch @ 511, and the MICE core switch @ Ridgeview is down. There is a complete loss of light. I have contacted the dark fiber provider to begin troubleshooting the link. Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington MN 55425 Main 612-355-7740 x211 Direct 612-392-6814 Fax 952-873-7425 jlumby(a)mnvoip.com

2 2

Minnesota Repeals Municipal Broadband Restrictions
by David Farmer 24 May '24

24 May '24

https://arstechnica.com/tech-policy/2024/05/another-us-state-repeals-law-th… Minnesota this week eliminated two laws that made it harder for cities and towns to build their own broadband networks. The state-imposed restrictions were repealed in an omnibus commerce policy bill signed on Tuesday by Gov. Tim Walz, a Democrat. .... -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 ===============================================

3 3

Traffic spike starting at 2:00am today
by Dean Bahls 24 May '24

24 May '24

Curious if anyone knows why we are seeing about 25-30% increase in traffic today. Some big updates going on perhaps? Thanks, Dean Dean Bahls COO | Fiber Minnesota & Aurora Fiber Optic Networks 14 Main St SW | PO Box J | Menahga, MN 56464 218.564-1321 (Direct) | 218.564.3000 (Main Office) dean.bahls(a)fiberminnesota.com<mailto:dean.bahls@fiberminnesota.com> [cid:image001.png@01DAADBE.2C9CB570] [cid:image002.jpg@01DAADBE.2C9CB570]

16 19

Cacti vulnerabilities
by Michael Horwath 14 May '24

14 May '24

https://thehackernews.com/2024/05/critical-flaws-in-cacti-framework-could.h… Sharing is caring, and I care about sharing! -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

1 0

Server Updates
by Cameron Skappel 03 May '24

03 May '24

We plan to update MICE servers and firewalls Friday 11:00AM Central. We'll only be doing 1 route server at a time. -- Cameron

1 1

Peering Summit Bus Mankato->Kansas City
by Jay Hanke 24 Apr '24

24 Apr '24

The Midwest Peering Summit bus is a go. Here's the schedule: Wednesday 6/12/2024 10:00 AM Leave Mankato, We have free parking available 5:20 PM Arrive at Westin Crown Plaza Kansas City Friday 6/14/2024 4:00 PM Leave Kansas City Westin Crown Plaza Kansas City 11:25 PM Arrive in Mankato Cost is $150.00 round trip per person There is space on the bus to transport down exhibit equipment as well if needed. Email mwps(a)southfront.io to register. -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 507-327-2398 https://southfront.io/

1 0

MWPS 2024 Transportion
by Jay Hanke 18 Apr '24

18 Apr '24

If I had a coach bus going from MN to Kansas City Peering Summit, are others interested? -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 507-327-2398 https://southfront.io/

4 4

Fwd: Google - Drain of routes for Route-Servers in your IX
by Richard Laager 05 Apr '24

05 Apr '24

I haven't heard this for MICE, but presumably they will be doing the same thing here? -------- Forwarded Message -------- Subject: Google - Drain of routes for Route-Servers in your IX (fwd) Date: Wed, 3 Apr 2024 14:31:55 +0000 (UTC) From: Chris Caputo <ccaputo(a)seattleix.net> To: members(a)seattleix.net FYI from Google... Chris ---------- Forwarded message ---------- Date: Wed, 03 Apr 2024 04:21:02 -0700 From: Google Peering Operations <peering-ops(a)google.com> To: info(a)seattleix.net Subject: Drain of routes for Route-Servers in your IX Dear Internet Exchange, As part of Google's effort to simplify peering operations and increase routing security we have decided to stop advertising and receiving prefix information from Route-Servers in Internet Exchanges. The BGP session with the route servers will remain established. We are planning to implement the change in your IX in the next few weeks. We won’t disconnect from the IX and we will keep current BGP bilateral sessions with individual peers on the IX. We invite other networks that rely on Route-Servers to request a bilateral session. Bilateral session request can be done at: https://isp.google.com/iwantpeering We kindly request you to inform peers in your Internet Exchange of these future changes so they can request bilateral sessions with us if they desire to do so. Sincerely, Google Network Operations

10 11

MICE interface flap
by Chris Wopat 18 Mar '24

18 Mar '24

WiscNet's remote switch flapped twice within the last half hour: Feb 14 16:34:16.657 2024 s-minneapolis-hub mib2d[8448]: %DAEMON-4-SNMP_TRAP_LINK_DOWN: ifIndex 540, ifAdminStatus up(1), ifOperStatus down(2), ifName et-0/0/23 Feb 14 16:39:29.456 2024 s-minneapolis-hub mib2d[8448]: %DAEMON-4-SNMP_TRAP_LINK_DOWN: ifIndex 540, ifAdminStatus up(1), ifOperStatus down(2), ifName et-0/0/23 Aggregate traffic definitely shows a hit: http://micelg.usinternet.com/export/graph_2625.html Curious if others experienced flaps or could reveal logs from the core Arista? -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

3 6

UG 45 Meeting Reminder
by Anthony Anderberg 18 Mar '24

18 Mar '24

The MICE UG 45 meeting will be held Wednesday, March 20, 3:00 pm at the University of Minnesota IT Building. 2218 University Ave SE Minneapolis, MN 55414, Room 185 Across University Ave SE from Huntington (TCF) Bank Stadium Parking, etc. details same as before: https://lists.iphouse.net/cgi-bin/wa?A2=MICE-DISCUSS;2c503e19.2209 Zoom Details: https://umn.zoom.us/j/94910223662?pwd=RUluTERkODlsdU93eHlQejR4eFVRdz09 ID: 94910223662, passcode: XdrNr3 651-372-8299 (passcode: 988007) Thanks everyone, Anthony

1 0

Re: MICE Usage Graphs
by Anthony Anderberg 06 Mar '24

06 Mar '24

Yes, this had been on my todo list since Jeremy’s port changes - guess I just needed my friends to prod me a bit. :-) I think I’ve got everything cleaned up; I was able to preserve CarverLink’s data history but most of the others are new since the port changes. Cheers, Anthony From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Randy Lehs <rlehs(a)CARVERLINK.COM> Reply-To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Date: Tuesday, March 5, 2024 at 5:26 PM To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] MICE Usage Graphs I noticed that several ports stopped graphing on the weathermap about a month ago, and just wanted to make sure someone was aware/working on it since I use the graphs all the time. Randy Lehs | CarverLink Fiber Manager CarverLink – A Department of Carver County Public Services 600 East Fourth Street Chaska, MN 55318-2102 www.carverlink.com<http://www.carverlink.com/> | rlehs(a)carverlink.com<mailto:rlehs@carverlink.com> Office: 952-361-1494 | Fax: 952-361-1582 | Cell: 612-719-1656 | Standard and Emergency Support 24/7/365: 952-361-1200 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

2 1

MICE Usage Graphs
by Randy Lehs - CarverLink 05 Mar '24

05 Mar '24

I noticed that several ports stopped graphing on the weathermap about a month ago, and just wanted to make sure someone was aware/working on it since I use the graphs all the time. Randy Lehs | CarverLink Fiber Manager CarverLink - A Department of Carver County Public Services 600 East Fourth Street Chaska, MN 55318-2102 www.carverlink.com<http://www.carverlink.com/> | rlehs(a)carverlink.com<mailto:rlehs@carverlink.com> Office: 952-361-1494 | Fax: 952-361-1582 | Cell: 612-719-1656 | Standard and Emergency Support 24/7/365: 952-361-1200

1 0

IRR Mandatory at MICE / New Route Servers
by Richard Laager 27 Feb '24

27 Feb '24

[I plan to send this to MICE-ANNOUNCE too, but I want to see if anyone has corrections.] MICE will soon be deploying new route servers which will require IRR (Internet Routing Registry) records, as is a best practice at IXPs. *What* * You MUST have an as-set object listing your AS and your downstream ASes (if any). o You MUST either list that as-set in PeeringDB or email the name of your as-set to me (off-list to rlaager(a)wiktel.com please). * A route/route6 object MUST exist for each prefix you announce to the route servers (whether originated by you or transited through you) and it must list an Origin AS that is in your as-set. *When* * *If you are a transit AS (i.e. have ASes behind you) and don't have an /as-set/ object, fix this **/now/**.* Without an as-set object, your downstream ASes announcements will be blocked (filtered) immediately when the /first/ new route server is cut in. (Granted, they will still work through the second route server until it is upgraded.) Figure you have 1-2 weeks at most. * Enforcement of the route/route6 objects (for both transit and non-transit ASes) will come later, but not a lot later. So please, start on this now. ** *Where* If you are not sure /where/ to create IRR records, use ARIN (assuming you are in the ARIN region). *How (with ARIN)* 1. Login to ARIN Online. (Go to arin.net and click Login in the top right.) 2. On the left side, expand "Routing Security" and click "IRR". 3. Click "as-set" at the top. 4. Click "Create an Object". 5. Fill in the fields: The "AS Set Name" is what you will list in PeeringDB (or email to me). "Description" is unparsed, but they suggest the location and have a button to "Copy the Address from My Org ID". "Members" is where you list your ASN and downstream ASes (if any). 6. Click "Review". Once ready, click "Submit". 7. Click "route/route6" at the top. 8. Click "Create an Object". 9. Fill in the fields: "Prefix" is the prefix, e.g. 192.0.2.0/24. "Origin" is your ASN. 10. Click "Review". Once ready, click "Submit". 11. Repeat to create additional route objects until all of your announcements are covered. Don't forget IPv6! *Examples* Here is my as-set: https://www.radb.net/query?keywords=AS-WIKTEL Here is one example route: https://www.radb.net/query?keywords=69.89.192.0%2F20 (I created the AS33362 one. The AS19905 one is because another AS can originate this route for DDoS scrubbing reasons.) -- Richard

10 34

Global Net - AS395466 Maintenance
by Global Net NOC 22 Feb '24

22 Feb '24

MICEMN Members - Our upstream provider, Zayo, will be undergoing a forced relocation at our datacenter in Montana. Expect our BGP sessions to drop during this time. 2/22 2200 – 2/23 0500 MST GLOBAL NET AS 395466 IPV4 206.108.255.97 IPV6 2001:504:27:0:6:8ca:0:1 Thanks, Global Net NOC noc(a)theglobal.net<mailto:noc@theglobal.net> Global Net Peering peering(a)theglobal.net<mailto:peering@theglobal.net>

1 0

UG 45 Meeting
by Richard Laager 21 Feb '24

21 Feb '24

The MICE UG 45 meeting will be held Wednesday, March 20, 3:00 pm at UMN. Parking, etc. details same as before: https://lists.iphouse.net/cgi-bin/wa?A2=MICE-DISCUSS;2c503e19.2209 Zoom Details: https://umn.zoom.us/j/94910223662?pwd=RUluTERkODlsdU93eHlQejR4eFVRdz09 ID: 94910223662, passcode: XdrNr3 651-372-8299 (passcode: 988007) -- Richard

1 1