- mice-discuss - lists.micemn.net

Re: FYII: MICE 10Gig Switch

by James Montz

CNS added to Route Servers (IPv4). Waiting on permissions issue to be resolved on the IPv6 Router Server daemon. --------------------------------------------------- *James C. Montz* Senior Consultant *Mankato Networks LLC* <http://www.mankatonetworks.net/>320 East Liberty Street <http://maps.google.com/maps?q=320+East+Liberty+Street%2CMankato%2CMN+56001&…>Mankato, MN 56001 *Phone:* *(320)-496-6689* *Email: jamesmontz(a)mankatonetworks.net* *Web: http://www.mankatonetworks.net Skype: james.montz* * http://www.linkedin.com/in/jmontz* On Wed, Jan 19, 2011 at 9:40 AM, Steve Howard <showard(a)paulbunyan.net>wrote: > The CNS ASN is 32609 > > Thanks, > Steve > > > On 01/17/2011 09:02 AM, James Montz wrote: > > Just nees their ASN > On Jan 16, 2011 12:30 PM, "Jay Hanke" <jayhanke(a)mankatonetworks.net> > wrote: > >> management/monitoring/whatever. I also installed a 10Gig connection for > >> CNS and have sent a request to FWR for a cross-connect to the MICE1 > >> Switch. (CNS will pay the monthly on the cross connect). > > > > Steve, I assume you're coming in on fiber so I assigned you Gi1/2. The > > CNS IP is .50 and :0050 for v6. > > > > James/Anthony, can you build the peering config for CNS in the route > servers? > > > > > > -- > > Jay Hanke > > CTO, CCIE #19093 > > Mankato Networks LLC > > 320 East Liberty Street > > Mankato, MN 56001-3838 > > Google 530-618-2398 > > jayhanke(a)mankatonetworks.net > > http://www.mankatonetworks.com > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: Route Server Security

by Jay Hanke

Bogons are being filtered and I believe we are capping the prefixes. Default routes are also filtered. We can look into the irr but it does add a bit of burden for those not currently using a registry. I would add that private as numbers need to be filtered on the route server. On Jan 19, 2011 2:53 PM, "Andrew Hoyos" <hoyosa(a)gmail.com> wrote: > Welcome to the insecurities of how the internet works :) > > But, I'd agree - this seems like a lot of work for folks to maintain > prefix filters... > > If everyone can agree to maintain proper IRR policy/objects, we could > have irrpt or the like build prefix filters on an automated basis and > suck into the route servers, but we'd have to get consensus of the > group. > > At the very least, the route servers could check as-path, filter > bogons, and police a reasonable max-prefix (if they don't already). > > On Wed, Jan 19, 2011 at 2:36 PM, Steve Howard <showard(a)paulbunyan.net> wrote: >> I haven't heard any discussions about this, but I think that is >> something that we should look into. The downside is that every time >> somebody adds a network or a customer with an ARIN allocation it would >> require human maintenance. I wouldn't want to have that job. I also >> suspect that it could be problematic for organizations with a large >> number of netblocks. >> >> Can our route servers read routes from a routing registry? >> >> >> >> On 01/19/2011 02:05 PM, Jeremy Lumby wrote: >>> I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? >>> >>> Jeremy >>> >>> ######################################################################## >>> >>> To unsubscribe from the MICE-DISCUSS list, click the following link: >>> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >>> >>> >> >> ######################################################################## >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: Route Server Security

by Andrew Hoyos

Welcome to the insecurities of how the internet works :) But, I'd agree - this seems like a lot of work for folks to maintain prefix filters... If everyone can agree to maintain proper IRR policy/objects, we could have irrpt or the like build prefix filters on an automated basis and suck into the route servers, but we'd have to get consensus of the group. At the very least, the route servers could check as-path, filter bogons, and police a reasonable max-prefix (if they don't already). On Wed, Jan 19, 2011 at 2:36 PM, Steve Howard <showard(a)paulbunyan.net> wrote: > I haven't heard any discussions about this, but I think that is > something that we should look into. The downside is that every time > somebody adds a network or a customer with an ARIN allocation it would > require human maintenance. I wouldn't want to have that job. I also > suspect that it could be problematic for organizations with a large > number of netblocks. > > Can our route servers read routes from a routing registry? > > > > On 01/19/2011 02:05 PM, Jeremy Lumby wrote: >> I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? >> >> Jeremy >> >> ######################################################################## >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> >> > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: Route Server Security

by Steve Howard

I haven't heard any discussions about this, but I think that is something that we should look into. The downside is that every time somebody adds a network or a customer with an ARIN allocation it would require human maintenance. I wouldn't want to have that job. I also suspect that it could be problematic for organizations with a large number of netblocks. Can our route servers read routes from a routing registry? On 01/19/2011 02:05 PM, Jeremy Lumby wrote: > I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? > > Jeremy > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Route Server Security

by Jeremy Lumby

I was just wondering if when new members are added to the route server, are there filters setup so that they can only advertise networks that can be verified to be associated with their company via an ARIN WHOIS lookup? Just wondering since prior to connecting, I am concerned about people advertising routes that they might not have connectivity to. I could see someone making a simple mistake in their BGP configuration, and accidentally advertising routes that were not theirs, that then could then be blocked from transiting through their router by an access list that is designed to stop spoofing of their IP addresses. Not to mention possible issues that could come up if someone had some malicious intent to disrupt traffic to a specific netblock. Just wondering if there have been any discussions on this issue? Jeremy ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: FYII: MICE 10Gig Switch

by Steve Howard

The CNS ASN is 32609 Thanks, Steve On 01/17/2011 09:02 AM, James Montz wrote: > > Just nees their ASN > > On Jan 16, 2011 12:30 PM, "Jay Hanke" <jayhanke(a)mankatonetworks.net > <mailto:jayhanke@mankatonetworks.net>> wrote: > >> management/monitoring/whatever. I also installed a 10Gig > connection for > >> CNS and have sent a request to FWR for a cross-connect to the MICE1 > >> Switch. (CNS will pay the monthly on the cross connect). > > > > Steve, I assume you're coming in on fiber so I assigned you Gi1/2. The > > CNS IP is .50 and :0050 for v6. > > > > James/Anthony, can you build the peering config for CNS in the route > servers? > > > > > > -- > > Jay Hanke > > CTO, CCIE #19093 > > Mankato Networks LLC > > 320 East Liberty Street > > Mankato, MN 56001-3838 > > Google 530-618-2398 > > jayhanke(a)mankatonetworks.net <mailto:jayhanke@mankatonetworks.net> > > http://www.mankatonetworks.com > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > ------------------------------------------------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: FYII: MICE 10Gig Switch

by Steve Howard

Jay, We built it for copper because that was requested at the last meeting. We would prefer fiber, is that still an option? Thanks, Steve On 01/16/2011 12:30 PM, Jay Hanke wrote: >> management/monitoring/whatever. I also installed a 10Gig connection for >> CNS and have sent a request to FWR for a cross-connect to the MICE1 >> Switch. (CNS will pay the monthly on the cross connect). > Steve, I assume you're coming in on fiber so I assigned you Gi1/2. The > CNS IP is .50 and :0050 for v6. > > James/Anthony, can you build the peering config for CNS in the route servers? > > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 19, 2011

Re: FYII: MICE 10Gig Switch

by James Montz

Steve, Can you provide me w/ your ASN so I can add you to the route server? Jay has already provided your IPv4 & IPv6 address on the MICE network; The CNS IP is .50 and :0050 for v6. --------------------------------------------------- *James C. Montz* Senior Consultant *Mankato Networks LLC* <http://www.mankatonetworks.net/>320 East Liberty Street <http://maps.google.com/maps?q=320+East+Liberty+Street%2CMankato%2CMN+56001&…>Mankato, MN 56001 *Phone:* *(320)-496-6689* *Email: jamesmontz(a)mankatonetworks.net* *Web: http://www.mankatonetworks.net Skype: james.montz* * http://www.linkedin.com/in/jmontz* On Sat, Jan 15, 2011 at 10:44 AM, Steve Howard <showard(a)paulbunyan.net>wrote: > Hello, > > The MICE2 10Gig switch was installed after the User Group meeting last > week. > > I wasn't really sure what the plan for management is, so I went with the > "worry about it later" strategy (I really like that!). I connected & > configured the out-of-band management port so we can get into it > remotely when we decide we want to setup formal > management/monitoring/whatever. I also installed a 10Gig connection for > CNS and have sent a request to FWR for a cross-connect to the MICE1 > Switch. (CNS will pay the monthly on the cross connect). > > The switch is a Cisco WS-C3560E-12D-S. This has 12 10Gig X2 ports. The > 10Gig ports can be converted to Two 1Gig SFP ports with the installation > of a TwinGig module. We went ahead and put in eight TwinGig modules for > now. That will give us an option for MICE members that would like a > 1Gig fiber connection. They will need to provide an SFP for a 1Gig or > X2 for 10Gig. > > Thanks, > Steve > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 17, 2011

Re: Errors with an email address

by Tom Drill

Citilink was acquired by Nextera. On Mon, Jan 17, 2011 at 12:04 PM, Mike Horwath <drechsau(a)iphouse.net> wrote: > The following subscriber was deleted from the MICE-DISCUSS list today: > > "T.J. Albrecht" <talbrecht(a)MYCITILINK.COM> > Last error was: 5.0.0 554 No relaying allowed - psmtp > > > It bounced repeatedly over the last week and LISTSERV removed it > automatically. > > Very interesting error message - from Postini. > > -- > Mike Horwath ipHouse - Welcome home! drechsau(a)iphouse.net > The universe is an island, surrounded by whatever it is > that surrounds universes. - Berkeley Fortune > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- MyTELEPATH | Tom Drill tdrill(a)mytelepath.com 11970 Portland Ave. Burnsville, MN 55337 952-400-6004 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 17, 2011

Errors with an email address

by Mike Horwath

The following subscriber was deleted from the MICE-DISCUSS list today: "T.J. Albrecht" <talbrecht(a)MYCITILINK.COM> Last error was: 5.0.0 554 No relaying allowed - psmtp It bounced repeatedly over the last week and LISTSERV removed it automatically. Very interesting error message - from Postini. -- Mike Horwath ipHouse - Welcome home! drechsau(a)iphouse.net The universe is an island, surrounded by whatever it is that surrounds universes. - Berkeley Fortune ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Jan. 17, 2011