PacketExchange/Mzima

Need a PacketExchange/Mzima admin to contact me off list regarding an AS Number issue. Andrwe

Re: Software DNS hghi availability and load balancer solution [SEC=UNCLASSIFIED]

0n Tue, Jan 18, 2011 at 02:42:57PM -0500, david raistrick wrote: >On Tue, 18 Jan 2011, Rhys Rhaven wrote: > >> Having hit these issues myself, I heavily recommend a real frontend >> proxy like nginx or varnish. > >A frontend proxy (nginx, varnish, haproxy, or anything

Re: Software DNS hghi availability and load balancer solution

On Tue, 18 Jan 2011, Charles N Wyble wrote: He asked about DNS based loadbalancing (also known as GSLB, among other things) software packages Ah. DNS based load balancing. I've heard good things about powerdns for that. I assume the "good things" is that with powerdns and the gmysql ba

Re: Software DNS hghi availability and load balancer solution

On 01/18/2011 07:42 AM, Sergey Voropaev wrote: Does any one know software sollutions (free is preferable) like as cisco GSS and F5 BIG-IP? The main point is that DNS-server (or dns server plugin) must be able to monitor server availability (for example by TCP connect) and from DNS-reply depends o

Re: Software DNS hghi availability and load balancer solution

> PowerDNS has an awsome geolocation plugin, and that probably can be tied to > a check to see if the IP is up so it's actually checking the status of IPs > to make it more automated. > > Gary > gdnsd is very robust and fast and has an interface that a networking engineer won't mind. It comes wit

Re: Routing Suggestions

On Jan 18, 2011, at 4:54 PM, Robert Bonomi wrote: > >> Date: Fri, 14 Jan 2011 01:50:40 -0800 >> From: Randy Bush >> Subject: Re: Routing Suggestions >> >> i'm with jon and the static crew. brutal but simple. >> >> if you want no leakage, A can filter the prefix from it's upstreams, both >>

RE: Auto ACL blocker

LOL.. oops.. I guess I could just use 65xxx. -Original Message- From: Thomas Magill [mailto:tmag...@providecommerce.com] Sent: Tuesday, January 18, 2011 5:23 PM To: m...@kenweb.org; nanog@nanog.org Subject: RE: Auto ACL blocker -Original Message- From: ML [mailto:m...@kenweb.org]

RE: Auto ACL blocker

-Original Message- From: ML [mailto:m...@kenweb.org] Sent: Tuesday, January 18, 2011 4:28 PM To: nanog@nanog.org Subject: Re: Auto ACL blocker > I know Spamhaus doesn't offer a BGP feed of the DROP list. Has anyone > made a homegrown solution? "DROP is currently available only as a sim

Re: Software DNS hghi availability and load balancer solution

>What does that mean? Load balance DNS lookups across multiple servers? >Or use DNS to load balance? I've never setup a load balancer for DNS >before. Always just had one server and moved the VM in event of >failure/maintenance. * * I think using DNS to load balance is what was meant, PowerDNS can

Re: Routing Suggestions

> Date: Fri, 14 Jan 2011 01:50:40 -0800 > From: Randy Bush > Subject: Re: Routing Suggestions > > i'm with jon and the static crew. brutal but simple. > > if you want no leakage, A can filter the prefix from it's upstreams, both > can low-pref blackhole it, ... > One late comment -- OP stated

Re: Software DNS hghi availability and load balancer solution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/18/2011 04:01 PM, david raistrick wrote: > >> On 01/18/2011 09:42 AM, Sergey Voropaev wrote: >>> Does any one know software sollutions (free is preferable) like as >>> cisco GSS >>> and F5 BIG-IP? The main point is that DNS-server (or dns server

Re: Authentication using Microsoft 2008 Active directory for Cisco RADIUS login

I've set it up on 2003 before, found this article... http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/bfbbbae4-a280-4b3f-b214-02867b7d33e3/ it may be of use. Essentially

Re: Authentication using Microsoft 2008 Active directory for Cisco RADIUS login

On 1/18/2011 4:15 PM, Michael Ruiz wrote: Hello all, I am having some trouble getting my Cisco routers to use Active directory to authenticate users. I have searched on Google and so far I am coming up dry on good documentation that will work. I know $myemployer Uses Cisco

Re: Auto ACL blocker

On 1/18/2011 6:48 PM, Thomas Magill wrote: Also, have you considered just using the spamhaus DROP list? They even have code to have the list pushed to IOS available. You could simply substitute your file for their list if you only want to use IPs caught by your honeypot. http://www.spamhaus.

Re: adaptec 5405 wedged

Not sure, but I have seen issues with keyboard input on IPMI or serial-port console systems not working very well in controller BIOS screens. Has this worked before using the same method? Also, were you able to flash the BIOS of the WD drives with a hacked firmware that has TLER enabled? If no

Re: Software DNS hghi availability and load balancer solution

Hi Guys, First time post so please excuse. * * I think you can get a free Citrix NetScaler virtual applicance (VPX) that will do this with GSLB. other then that PowerDNS has a very good geolocation plugin, so they may also have an availabiliy plugin for checks... * * I am also looking for a combi

Re: Software DNS hghi availability and load balancer solution

On 01/18/2011 09:42 AM, Sergey Voropaev wrote: Does any one know software sollutions (free is preferable) like as cisco GSS and F5 BIG-IP? The main point is that DNS-server (or dns server plugin) must be able to monitor server availability (for example by TCP connect) and from DNS-reply depends

Re: Software DNS hghi availability and load balancer solution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ha-proxy and linux virtual server are popular packages. On 01/18/2011 09:42 AM, Sergey Voropaev wrote: > Does any one know software sollutions (free is preferable) like as cisco GSS > and F5 BIG-IP? The main point is that DNS-server (or dns server plu

RE: Auto ACL blocker

Also, have you considered just using the spamhaus DROP list? They even have code to have the list pushed to IOS available. You could simply substitute your file for their list if you only want to use IPs caught by your honeypot. http://www.spamhaus.org/faq/answers.lasso?section=DROP%20FAQ --

Re: adaptec 5405 wedged

On 19/01/2011, at 00.23, Randy Bush wrote: > any adaptec bios-level fu out there? if so, please see > http://archive.psg.com/110119.adaptec.pdf > Hi Randy, Did you see this bit about transfer speed issues? http://ask.adaptec.com/scripts/adaptec_tic.cfg/php.exe/enduser/std_adp.php?p_faqid=

RE: Auto ACL blocker

> From: Larry Smith [mailto:lesm...@ecsis.net] > Sent: Tuesday, January 18, 2011 8:32 PM > > On Tue January 18 2011 13:12, Brian R. Watters wrote: > > We are looking for the following solution. > > > > Honey pot that collects attacks against SSH/FTP and so on > > > > Said attacks are then sent to

Re: Request Spamhaus contact

On 01/18/2011 06:21 AM, Ken Gilmour wrote: > On 18 January 2011 13:10, Simon Waters wrote: > >>> Obviously they know about them because google has the information. >> >> I'm not sure this is a reasonable deduction. >> >> > Correct - It is completely unreasonable. I was using it as an example in >

Re: Dual Homed BGP for failover

On Tue, Jan 18, 2011 at 12:05 PM, George Bonser wrote: >> -Original Message- >> From: Brandon Kim >> Sent: Tuesday, January 18, 2011 11:57 AM >> To: jba...@brightok.net; b...@herrin.us >> Cc: ayousuf0...@gmail.com; nanog group >> Subject: RE: Dual Homed BGP for failover > One can take a fu

adaptec 5405 wedged

any adaptec bios-level fu out there? if so, please see http://archive.psg.com/110119.adaptec.pdf thanks randy

PCCW Admin

Would a PCCW admin contact me off-list regarding one of your customers? Andrew

Re: Software DNS hghi availability and load balancer solution

On Tue, Jan 18, 2011 at 3:49 PM, Dorn Hetzel wrote: > If it wouldn't be too ugly, could this be circumvented by having the web > application continually do its next operation against an incrementing > subhost name like syymmddhhmmss or snnn.www.foo.com in order to convince > the local browser

Re: Dual Homed BGP for failover

Me <3's "commit confirmed" ... maybe someone from Cisco should be watching :) On Tue, Jan 18, 2011 at 3:21 PM, Jack Carrozzo wrote: > Yep, the great thing about IOS without 'commit confirmed' is when you > remove > a bgp filter, it runs out of memory, reboots, brings up peers, runs out of > memo

Re: Dual Homed BGP for failover

I would be hesitant to do full tables on an SRX210, particularly if you only have an SRX210B with 512MB of RAM. I'm not sure what filtering would do in terms of memory usage, because I have not tried it. I generally put a separate edge device in to handle the upstream and BGP, and use the SRX p

RE: Authentication using Microsoft 2008 Active directory for Cisco RADIUS login

Can you post your config on the router? Also, this may be better to post over at cisco-nsp. B -Original Message- From: Michael Ruiz [mailto:mr...@lstfinancial.com] Sent: Tuesday, January 18, 2011 1:15 PM To: nanog@nanog.org Subject: Authentication using Microsoft 2008 Active directory

Re: Dual Homed BGP for failover

Yep, the great thing about IOS without 'commit confirmed' is when you remove a bgp filter, it runs out of memory, reboots, brings up peers, runs out of memory, reboots... meanwhile if you're trying to get in over a public interface you're cursing John Chamber's very existence. Not that that's ever

RE: Auto ACL blocker

> From: Brian R. Watters > Sent: Tuesday, January 18, 2011 1:14 PM > To: Dorn Hetzel > Cc: nanog@nanog.org > Subject: Re: Auto ACL blocker > > Agreed, time to live in the ACL is critical as well .. this is primary > to be used to stop sweeps and penetration testing .. We have SNORT > deployed

Re: Dual Homed BGP for failover

On 1/18/2011 3:03 PM, Jack Carrozzo wrote: I don't think this is the case, on IOS at least. Some years ago I was rocking some 7500s with $not_enough ram for multiple full tables, but with a prefix list to accept le 23 they worked fine. On JunOS, I know I can view pre and post filtered bgp u

Authentication using Microsoft 2008 Active directory for Cisco RADIUS login

Hello all, I am having some trouble getting my Cisco routers to use Active directory to authenticate users. I have searched on Google and so far I am coming up dry on good documentation that will work. I have used these links. http://briandesmond.com/blog/how-to-authenticat

Re: Auto ACL blocker

Agreed, time to live in the ACL is critical as well .. this is primary to be used to stop sweeps and penetration testing .. We have SNORT deployed now but the process is still manual on the back end and of course does not respond in the time required. - Original Message - From: " Dorn

Re: Dual Homed BGP for failover

On Tue, Jan 18, 2011 at 3:57 PM, Jack Bates wrote: > You should still be careful, as most processors keep a copy of filtered > routes as well, so while your forwarding table may not increase, your route > processor memory most likely will. > > I don't think this is the case, on IOS at least. Some

Re: Software DNS hghi availability and load balancer solution

On Tue, 18 Jan 2011, Jack Bates wrote: On 1/18/2011 1:42 PM, david raistrick wrote: Normally, VRRP would be the way to go. But these days multicast isn't supported everywhere (major example - Amazon EC2), leaving DNS... Many HA environments use both, and F5 is designed to do both, support

Re: Dual Homed BGP for failover

On 1/18/2011 2:05 PM, George Bonser wrote: One can take a full feed but filter so only a subset of the routes are actually installed. For example, filter all routes that are more than one AS away from the immediate upstream. You should still be careful, as most processors keep a copy of filte

Re: Software DNS hghi availability and load balancer solution

On 1/18/2011 1:42 PM, david raistrick wrote: Normally, VRRP would be the way to go. But these days multicast isn't supported everywhere (major example - Amazon EC2), leaving DNS... Many HA environments use both, and F5 is designed to do both, supporting DNS tricks (of which, you could poss

Re: Auto ACL blocker

We have used this solution for some time and find it works pretty well .. http://www.rfxn.com/projects/ However need to find a way to pass this info off to a router, this project used to hold promise however its dead now .. www.ipblocker.org - Original Message - From: "Joe Blanch

Re: Auto ACL blocker

On Tue, Jan 18, 2011 at 1:12 PM, Brian R. Watters wrote: > We are looking for the following solution. > > Honey pot that collects attacks against SSH/FTP and so on > > Said attacks are then sent to a master ACL on a edge Cisco router to block > all traffic from these offenders .. > > Of course we

RE: Dual Homed BGP for failover

> -Original Message- > From: Brandon Kim > Sent: Tuesday, January 18, 2011 11:57 AM > To: jba...@brightok.net; b...@herrin.us > Cc: ayousuf0...@gmail.com; nanog group > Subject: RE: Dual Homed BGP for failover > > > Someone should advise him that if he wants to take in a full BGP > rou

Re: Auto ACL blocker

Ron, I am sure any solution given enough time could be used against you, However my hope was that a whitelist could help in that regard however I know your correct. - Original Message - From: "Ronald Bonica" To: "Brian R. Watters" , nanog@nanog.org Sent: Tuesday, January 18, 2011 11:55

RE: Auto ACL blocker

Brian, Have you thought about what a bad guy might do if he knew that you had such a policy deployed? Is there a way that the bad guy might turn the policy against you? Ron > -Original Message- > From: Brian R. Watters [mailto:brwatt

RE: Dual Homed BGP for failover

Someone should advise him that if he wants to take in a full BGP routing table that he makes sure his router can handle it! I would hate for him to open the floodgates and his production router shuts down. LOL > Date: Tue, 18 Jan 2011 13:12:18 -0600 > From: jba...@brightok.net > To: b..

Re: Software DNS hghi availability and load balancer solution

On Tue, 18 Jan 2011, Rhys Rhaven wrote: Having hit these issues myself, I heavily recommend a real frontend proxy like nginx or varnish. A frontend proxy (nginx, varnish, haproxy, or anything else) doesnt give you HA any more than any other loadbalancer solution does. You need a way to send

Re: Software DNS hghi availability and load balancer solution

On Tue, 18 Jan 2011, William Herrin wrote: Net result is that in some cases a user's long-running browser will indefinitely ignore the change you made to the DNS. I've seen such things persist for months. Do you have any recent evidence to support this? The what-browsers-do-with-what world c

RE: Auto ACL blocker

I would consider doing it through BGP via quagga or such. Nullrouting with BGP is much cleaner than ACLs as your config stays static and only your routing table changes. I also imagine due to existing BGP blacklisting methods, that much of the work is already done and all you need is to get th

Re: Auto ACL blocker

On Tue January 18 2011 13:12, Brian R. Watters wrote: > We are looking for the following solution. > > Honey pot that collects attacks against SSH/FTP and so on > > Said attacks are then sent to a master ACL on a edge Cisco router to block > all traffic from these offenders .. > > Of course we woul

Re: Auto ACL blocker

send/expect? On Jan 18, 2011, at 2:12 PM, Brian R. Watters wrote: > We are looking for the following solution. > > Honey pot that collects attacks against SSH/FTP and so on > > Said attacks are then sent to a master ACL on a edge Cisco router to block > all traffic from these offenders .. > > Of

Re: Auto ACL blocker

On Jan 18, 2011, at 1:12 PM, Brian R. Watters wrote: > Any current solutions or ideas ?? This sort of thing can be gamed by attackers to cause DoS on your network/for your users/for others trying to access resources on your network. It's a Bad Idea. Set up S/RTBH and do it by hand. ---

RE: Auto ACL blocker

Dionaea (nephentes successor) and Kippo (ssh honeypot) are a good start for the honeypot side. http://carnivore.it/ http://dionaea.carnivore.it/ http://code.google.com/p/kippo/ Watching the tty logs in kippo is great entertainment. Perfect way to collect the skiddies tools. As far as the

Re: Dual Homed BGP for failover

On 1/18/2011 1:00 PM, William Herrin wrote: IMO, that would be a mistake. Taking significantly less than a full table severely limits your options for balancing traffic between the links. It should also be noted that taking a full table, doesn't mean you have to use the full table. Apply fi

Re: Software DNS hghi availability and load balancer solution

>Message: 7 >Date: Tue, 18 Jan 2011 12:31:32 -0600 >From: Jack Bates >Subject: Re: Software DNS hghi availability and load balancer solution >To: Sergey Voropaev >Cc: NANOG list >Message-ID: <4d35dc84.8020...@brightok.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >On 1/18

Auto ACL blocker

We are looking for the following solution. Honey pot that collects attacks against SSH/FTP and so on Said attacks are then sent to a master ACL on a edge Cisco router to block all traffic from these offenders .. Of course we would require a master whitelist as well as to not be blocked from

Re: Software DNS hghi availability and load balancer solution

Having hit these issues myself, I heavily recommend a real frontend proxy like nginx or varnish. On 01/18/2011 12:45 PM, William Herrin wrote: > On Tue, Jan 18, 2011 at 12:42 PM, Sergey Voropaev > wrote: >> Does any one know software sollutions (free is preferable) like as cisco GSS >> and F5 BIG

Re: Dual Homed BGP for failover

On Tue, Jan 18, 2011 at 1:32 PM, Ahmed Yousuf wrote: >  It > has now been requested to be able to distribute traffic across both links > rather than preference traffic to the higher speed link. > -          Is this really a good idea, as the BGP process won't care what > the utilisation of the lin

RE: Dual Homed BGP for failover

> From: Ahmed Yousuf > Sent: Tuesday, January 18, 2011 10:32 AM > To: nanog@nanog.org > Subject: Dual Homed BGP for failover > > > > - Is this really a good idea, as the BGP process won't care > what > the utilisation of the links are and you will see situations where the > lower > spe

Re: Software DNS hghi availability and load balancer solution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Am 18.01.11 19:31, schrieb Jack Bates: > On 1/18/2011 11:42 AM, Sergey Voropaev wrote: >> I know that it is possible by BIND with set of script. But we are >> trying to >> find more usable solution with frendly interface. >> > > I think powerdns

Re: Dual Homed BGP for failover

You really limit yourself when you just take a default from a provider. If you take 2 default's (one from each provider) for whatever reason, once you change the local pref on one of them, it's all your traffic outbound or none. I always request a full table + default, so you can filter to best su

Re: Software DNS hghi availability and load balancer solution

On Tue, Jan 18, 2011 at 12:42 PM, Sergey Voropaev wrote: > Does any one know software sollutions (free is preferable) like as cisco GSS > and F5 BIG-IP? The main point is that DNS-server (or dns server plugin) must > be able to monitor server availability (for example by TCP connect) and from > DN

Re: Dual Homed BGP for failover

You can just accept directly-connected peers from each network (or within 2 AS's, etc) then point a default at each one with different preferences. You can do with with two edges if you like also: iBGP between the edges, and push default into OSPF from both. WRT dynamic load balancing... generally

Dual Homed BGP for failover

Hi, I'm looking at a setup where we use BGP to announce PI space to two upstream ISPs. ISP A provides a 30Mb/s connection and ISP B provides a 10Mb/s. Originally the plan was to use ISP B's link as a backup and local pref traffic outbound via ISP A and pref inbound using AS prepend via ISP A.

Re: Software DNS hghi availability and load balancer solution

On 1/18/2011 11:42 AM, Sergey Voropaev wrote: I know that it is possible by BIND with set of script. But we are trying to find more usable solution with frendly interface. I think powerdns is more flexible in this regard. Not sure about a friendly interface, though. Jack

Software DNS hghi availability and load balancer solution

Does any one know software sollutions (free is preferable) like as cisco GSS and F5 BIG-IP? The main point is that DNS-server (or dns server plugin) must be able to monitor server availability (for example by TCP connect) and from DNS-reply depends on it. I know that it is possible by BIND with se

Looking for fiber

We are looking for fiber in the Port St Lucie/Stuart area of Florida, Maybe as north as Fort Pierce. Anyone have, Or know who has fiber in this area? Feel free to hit me on or offlist. Thanks. Nick Olsen Network Operations (855) FLSPEED x106

AW: Nexus 5000 with 4G FC module - initialization ?

Steve Fischer wrote: > If I'm not mistaken, there is an additional license needed to activate Fibre- > Channel services on the Nexus family of switches. Dantzig, Brian wrote: > You need to turn on fcoe support with the configuration command "feature > fcoe". You will also need the appropriate li

Re: Request Spamhaus contact

> We don't *care* if you got this issue with Spamhaus resolved. You > turned it into a much *larger* problem than that. Really? Problem solved: % cat - >> sendmail-access From:jeffrey.l...@gmail.com 550 Mail refused From:jeffrey.l...@blacklotus.net550 Mail refused Connect:199.59.160

Re: Request Spamhaus contact

On 18 January 2011 13:10, Simon Waters wrote: > > Obviously they know about them because google has the information. > > I'm not sure this is a reasonable deduction. > > Correct - It is completely unreasonable. I was using it as an example in reference to a larger, well known provider since earli

Re: Request Spamhaus contact

On Tuesday 18 January 2011 11:46:53 Ken Gilmour wrote: > > Obviously they know about them because google has the information. I'm not sure this is a reasonable deduction.

Re: Request Spamhaus contact

On 18 January 2011 10:00, Michael Painter wrote: > >> http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=AS:32421 >> >> I'm completely neutral in all of this but to be fair to BL - Here's the well respected Level3's results: http://safebrowsing.clients.google.com/safebrowsing/dia

RE: Request Spamhaus contact

> It was blocked and I did verify it. A very small amount of our traffic > comes in on PCCW and *they* were not honoring a tag that they've > contractually agreed to honor. I can understand why it may be fun to > make this look like a product of my own incompetence, and perhaps it > is something I

Re: Request Spamhaus contact

On 17/01/11 5:40 PM, Jeffrey Lyon wrote: I'm not a spammer. I'm an ISP asking to be removed from Spamhaus for having fixed the SBL listings set in the last< 72 hours. I'm not exactally ROKSO material. Jeff http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=AS:32421 Safe Bro

Re: Request Spamhaus contact

On Mon, Jan 17, 2011 at 11:59 PM, JC Dill wrote: > > > On 17/01/11 5:40 PM, Jeffrey Lyon wrote: >> >> I'm not a spammer. I'm an ISP asking to be removed from Spamhaus for >> having fixed the SBL listings set in the last<  72 hours. I'm not >> exactally ROKSO material. >> >> Jeff >> >> On Mon, Jan