- mice-discuss - lists.micemn.net

Private VLAN Service
by Hannigan, Martin Oct. 22, 2014

Oct. 22, 2014

SInce we're on the subject of services, can we also add a PVLAN service?

2 1

Webex Reminder for Meeting - Starting Now
by Shaun Carlson Oct. 22, 2014

Oct. 22, 2014

*Remote Dial-in Info:* www.webex.com Meeting Number: 193 507 116 Meeting Password: MICEUG14 * Please try to have a web-cam hooked up to facilitate the best possible interaction. *Shaun Carlson*Senior Manager of Information Technology | Arvig ph: (218) 346-8673 | em: shaun.carlson(a)arvig.com

1 0

Meeting Agenda
by Shaun Carlson Oct. 22, 2014

Oct. 22, 2014

See attached for meeting agenda. See you at 4! s *Shaun Carlson*Senior Manager of Information Technology | Arvig ph: (218) 346-8673 | em: shaun.carlson(a)arvig.com

1 0

Discussion Topic Response : Community Lists
by Levi Pederson Oct. 22, 2014

Oct. 22, 2014

I will not be able to attend the UG meeting today but I would still like to respond to the discussion that is to take place during the meeting. This topic at hand is the decision to implement Community Strings in the Exchange. There have been a couple responses on this and the primary reasons stated is based on security from my understanding. I am opposed to this implementation. I believe the very idea of segregation in an Internet Exchange undermines the primary purpose of the exchange. We are here to make the internet better not honeycombed. The idea of segregation based on security is a bit odd to me. An allegorical situation would be the following : Invite multiple people over for a pot-luck dinner (BYO-Dish). Have someones kid break one said dish. Then have someone take ALL the food, secure in their house and grant access/monitor to specific pot-luck goers based entirely on their specific point of view. This process I feel will create too much segregation and deviate rather far from the ideological goal of the exchange. My thoughts on responses: 1. How can we continue to provide benefits and capabilities to new members or bgp sessions gone awry? a. We are currently implementing great layer 2 defenses and that is a great start. b. Create a list of best practices and configuration examples for connecting to the exchange as a community. Forgive the long post. Just my 2 cents on table tonight. Thank you,

2 2

Discussion - Another BGP Community Viewpoint
by Steve Howard Oct. 22, 2014

Oct. 22, 2014

I will not be able to attend the MICE UG meeting tonight. However, I would like to add my thoughts regarding route advertisement control using BGP communities. I am strongly in favor of this capability being added to the route servers. Specifically, I'd like to see the ability to block advertisement to particular ASes or to prepend just to particular AS(es). Perhaps something like Level3, Sprint, and others use: 65000:XXX - do not announce to AS XXX 65001:XXX - prepend one AS to AS XXX 65002:XXX - prepend two ASes to AS XXX 65003:XXX - prepend three ASes to AS XXX 65004:XXX - prepend four ASex to AS XXX I just had to block one customer's netblock at MICE because Netflix traffic shifted in an undesirable manner yesterday. In this case, they really just needed to prepend Netflix at MICE, but since that wasn't an option they requested that we just block their netblock completely from the MICE route servers. BGP Communities give individual MICE members the ability to control their route advertisements to best suit their needs and routing policies without having to block the MICE route servers completely.

2 1

MICE in the News
by Anthony Anderberg Oct. 22, 2014

Oct. 22, 2014

I stumbled on this article that mentioned MICE, apparently we could be part of some massive government conspiracy... also MICE takes up the whole building now so I assume Mike and Al will be looking for office space elsewhere. :-) http://www.citylab.com/tech/2013/10/how-government-might-tap-physical-infra… Anthony Anderberg Sr. Systems Analyst [NUtel_email_logo_1] 320-234-5239 anthonyanderberg(a)nu-telecom.net<mailto:anthonyanderberg@nu-telecom.net> www.nutelecom.net<http://www.nutelecom.net>

3 2

Netflix Ramping Up
by Jeremy Lumby Oct. 21, 2014

Oct. 21, 2014

I see Netflix is ramping up, and the link to the CNS switch is getting close to saturating. The University may need to move to the main switch soon to alleviate the link. Jeremy Lumby Minnesota VoIP 9217 17th Ave S Suite 216 Bloomington, MN 55425 Main: 612-355-7740 x211 Direct: 612-392-6814 EFax: 952-873-7425 jlumby(a)mnvoip.com

9 11

Agenda - MICE UG 14 - 22 Oct 2014
by Shaun Carlson Oct. 21, 2014

Oct. 21, 2014

All, Please see the attached agenda, if you have any additions, please let me know. Please see the attached minutes from our previous meeting. If you have any additions or corrections, please let me know. One agenda note, we'll be discussing the potential change of MICE to a 501.(c)6 non-profit organization. I've attached some discussion points and would encourage you to *send your questions and comments to the list.* Jeff Clancy from Stinson Leonard Street LLP will be present at the meeting to answer questions and facilitate our next steps should we choose to move forward with the conversion. Last, we are still in need of a sponsor for refreshments at Wednesday's meeting, any volunteers? *Remote Dial-in Info:* www.webex.com Meeting Number: 193 507 116 Meeting Password: MICEUG14 * Please try to have a web-cam hooked up to facilitate the best possible interaction. ** I will start this web conference 15 minutes prior to the meeting to allow you to dial-in and work past any technical difficulties. One request, does anyone have a projector they could bring to the meeting for this web conference? I would need it approx. 30 minutes prior to the meeting. Thanks! s *Shaun Carlson*Senior Manager of Information Technology | Arvig ph: (218) 346-8673 | em: shaun.carlson(a)arvig.com

3 7

Route Server Announcement Control?
by Charles Monson Oct. 19, 2014

Oct. 19, 2014

Do the MICE route servers offer any way to control BGP announcement to specific peers? I didn't see anything on the micemn.net website about ways to do that. With some of the larger content providers connecting to the exchange, the folks who have mostly inbound traffic might want a way to stop the route servers announcements to those potentially high traffic peers without entirely withdrawing advertisements to the route servers. Some of the other exchanges we connect at let you send a community indicating the ASN you don't want your prefixes advertisements to reach (e.g. you send a community of "0:11796" to stop the route servers from advertising your prefixes to Airstream). It would be nice to have something similar at MICE. Is this something already supported that I missed? Or something that may be considered as a future feature? Charles Monson Associate Network Administrator Airstream Communications, LLC Wisconsin Independent Network, LLC

4 4

FW: MICE L2 Security Project
by Anthony Anderberg Oct. 16, 2014

Oct. 16, 2014

As a reminder, we're planning on making the last of the changes below that will include all of our ports. As before we don't expect there to be any issues or downtime, I can be reached at 320-234-5539 if anyone has issues. Cheers, anthony Anthony Anderberg Sr. Systems Analyst [NUtel_email_logo_1] 320-234-5239 anthonyanderberg(a)nu-telecom.net<mailto:anthonyanderberg@nu-telecom.net> www.nutelecom.net<http://www.nutelecom.net> From: Anthony Anderberg Sent: Wednesday, October 01, 2014 11:58 PM To: MICE Discuss (MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>); 'MICE-ANNOUNCE(a)LISTS.IPHOUSE.NET' Subject: MICE L2 Security Project We're at a point where the L2 security team feels ready to make the config changes we've talked about in the past. Although these changes can't protect us from every scenario they should protect the exchange from the many common issues. As discussed at the last meeting member ports will be limited to 5 MAC addresses, storm control will be enabled at 20%, and spanning tree BPDU packets will be filtered. Additionally the exchange will support jumbo frames should members want to exchange them with each other. Obviously if any member needs alternate configuration we'll strive to be as accommodating as possible within the larger project goals. We do not anticipate any downtime, but will send out a group reminder before starting the configuration work. Our schedule: Thursday 10/9/2014 at 10AM = Make global config changes and port changes for beta testers Thursday 10/16/2014 at 10AM = Make port config changes for all other members The beta testers are: US Internet, Paul Bunyan Communications, CNS, IP House, and Wikstrom Telephone. Below is the configuration we'll be using and will publish on our web site for members to review and enjoy. As always questions and comments are welcome, anthony ----------------------------- **Cisco Switch Config ** Global Config: system mtu 1998 # Already set system mtu jumbo 9198 # Already set mac address-table aging-time 14400 errdisable detect cause link-flap errdisable recovery cause link-flap errdisable recovery cause storm-control vtp mode transparent Cisco Port Config: switchport block multicast switchport block unicast # Unknown unicasts that is. switchport port-security maximum 5 switchport port-security switchport port-security violation restrict storm-control broadcast level 20.00 spanning-tree bpdufilter enable no cdp enable ----------------------------- ** Juniper Switch Config ** Juniper Core Switch Global: set protocols rstp bridge-priority 1 # On the main switch stack set ethernet-switching-options storm-control interface all Juniper Port Config: set interface XXX mtu 9216 set protocols rstp interface XXX edge set ethernet-switching-options bpdu-block interface XXX set ethernet-switching-options bpdu-block disable-timeout 60 set ethernet-switching-options secure-access-port interface XXX mac-limit 5 set storm-control interface XXX level 20 -----------------------------

1 0