Re: [j-nsp] DDoS to core interface - mitigation

2018-03-08 Thread Roland Dobbins
On 9 Mar 2018, at 3:35, Saku Ytti wrote: a) have edgeACL which polices ICMP and UDP high ports to your links and drops rest b) don't advertise your links in IGP or iBGP This. iACL plus no link advertisement (need a sound addressing plan to make both practical at scale). Here's a link to a

[j-nsp] Juniper EX4550 load balancing of MPLS over LAG

2018-03-08 Thread Erdal Rasid
Just sharing. maybe it saves your time when it pops up on next search. yes, EX4550 does load balancing of MPLS packets over LAG links and no, not always working as eloquently explained in (yes, cisco link :) ) https://supportforums.cisco.com/t5/service-providers-documents/asr9000-xr-load-balanci

Re: [j-nsp] Publish API data over SNMP

2018-03-08 Thread Saku Ytti
On 8 March 2018 at 22:43, Phil Shafer wrote: > Unfortunately not, since MIBs use numeric identifier for fields, > so if a developer inserts "leaf foxtrot" between "leaf echo" and > "leaf geronimo" (where it really belongs) then the MIB ordering has > changed and the numbers and all off. The MIB

Re: [j-nsp] Publish API data over SNMP

2018-03-08 Thread Phil Shafer
Saku Ytti writes: >As a user I'd be comfortable at stability which matches display >XML/JSON stability, and I think that level of stability would be >implied. Unfortunately not, since MIBs use numeric identifier for fields, so if a developer inserts "leaf foxtrot" between "leaf echo" and "leaf ger

Re: [j-nsp] DDoS to core interface - mitigation

2018-03-08 Thread Saku Ytti
Hey Daniel, Apologies for not answering your question, but generally this is not a problem, because: a) have edgeACL which polices ICMP and UDP high ports to your links and drops rest b) don't advertise your links in IGP or iBGP On 8 March 2018 at 22:17, Dan Římal wrote: > Hi all, > > I would

[j-nsp] DDoS to core interface - mitigation

2018-03-08 Thread Dan Římal
Hi all, I would like to discuss, how do you handle ddos attack pointing to IP address of any router core interface, if your UPLINK/ISP support RTBH and you would like to drop traffic at ISP level because of congested links. I have tried to implement "classic" BGP signalized RTBH, via changing n

Re: [j-nsp] Publish API data over SNMP

2018-03-08 Thread Saku Ytti
Hey, > I'm not an snmp-head, but something could certainly be done here. > I see two issues, one being the need for a formal MIB where our > content evolves release-to-release. Making per-release MIBs would > be a pain, and I'm not sure how well tools would handle those. A > "generic" MIB might

Re: [j-nsp] Publish API data over SNMP

2018-03-08 Thread Phil Shafer
[changed subject line) Saku Ytti writes: >You have | display json and xml, I assume json was relatively modest >amount of work, as you have formal source of data, so someone only >needed to write translator, without being aware of all context to >support | display json, which also means, no one ne

Re: [j-nsp] certain commands executed on CLI provide additional information over corresponding RPCs

2018-03-08 Thread Saku Ytti
Hey Phil, I'm hijacking this for a bit. You have | display json and xml, I assume json was relatively modest amount of work, as you have formal source of data, so someone only needed to write translator, without being aware of all context to support | display json, which also means, no one needs