Re: Nat

2015-12-18 Thread Matt Palmer
On Fri, Dec 18, 2015 at 07:30:35PM +0300, Ahmed Munaf wrote: > > On Dec 17, 2015, at 8:47 PM, Nick Hilliard wrote: > > > > On 17/12/2015 17:36, Ahmed Munaf wrote: > >> we are using ESP 20 > > > > You haven't said what you mean by "better". This could mean "faster" or > > "copes with more sessi

Re: Nat

2015-12-18 Thread Matthew Newton
On Fri, Dec 18, 2015 at 04:20:48PM -0500, Lee Howard wrote: > On 12/17/15, 1:59 PM, Matthew Petach wrote: > > I'm still waiting for the IETF to come around to allowing > > feature parity between IPv4 and IPv6 when it comes to DHCP. > > The stance of not allowing the DHCP server to assign a default

Re: IPv4 subnets for lease?

2015-12-18 Thread Bob Evans
I see it different than Lee ... because, there are no new ipv4 addresses they are all used. I have seen the same spam issue with IP space that is sold. So be careful. I have been involved in both leasing and purchasing IPv4 space. Like everything else you want to check the mileage/usage and look f

Re: Nat

2015-12-18 Thread Mark Andrews
In message , Lee Howard writes: > > > On 12/16/15, 7:14 PM, "NANOG on behalf of Mel Beckman" > wrote: > > >Mark, > > > >Why? Why do WE "need" to force people to bend to our will? The market > >will get us all there eventually. > > Some companies will run out of IPv4 addresses before others. W

Re: Nat

2015-12-18 Thread Owen DeLong
> On Dec 18, 2015, at 13:35 , Lee Howard wrote: > > > > On 12/16/15, 7:14 PM, "NANOG on behalf of Mel Beckman" > wrote: > >> Mark, >> >> Why? Why do WE "need" to force people to bend to our will? The market >> will get us all there eventually. Not all problems are well solved by markets, c

Re: Nat

2015-12-18 Thread Lee Howard
On 12/16/15, 7:14 PM, "NANOG on behalf of Mel Beckman" wrote: >Mark, > >Why? Why do WE "need" to force people to bend to our will? The market >will get us all there eventually. Some companies will run out of IPv4 addresses before others. When that happens, they have four choices: 1. Buy IPv4

Re: Nat

2015-12-18 Thread Lee Howard
On 12/16/15, 8:53 PM, "NANOG on behalf of Berry Mobley" wrote: >At 08:22 PM 12/16/2015, Randy Bush wrote: >> > We need to put some pain onto everyone that is IPv4 only. >> >>this is the oppress the workers so they will revolt theory. load of >>crap. >> >>make ipv6 easier to deploy, especially

Re: Nat

2015-12-18 Thread Lee Howard
On 12/17/15, 1:59 PM, "NANOG on behalf of Matthew Petach" wrote: >On Wed, Dec 16, 2015 at 5:22 PM, Randy Bush wrote: >>> We need to put some pain onto everyone that is IPv4 only. >> >> this is the oppress the workers so they will revolt theory. > >Ah, yes, the workers are quite revolting! > >>

Re: Nat

2015-12-18 Thread Lee Howard
On 12/17/15, 2:27 PM, "NANOG on behalf of Chuck Church" wrote: >-Original Message- >From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Matthew Petach >Sent: Thursday, December 17, 2015 1:59 PM >Cc: North American Network Operators' Group >Subject: Re: Nat > >>I'm still waiting f

Re: IPv4 subnets for lease?

2015-12-18 Thread Lee Howard
Leasing is ill-advised; the addresses will be unsellable once the spammers are through with them. Really, there¹s no other reason to lease. If you want to buy or sell addresses in the ARIN region, some of the facilitators at https://www.arin.net/resources/transfer_listing/facilitator_list.html ar

Re: failover via comcast tunnel?

2015-12-18 Thread bzs
FWIW we do expect to pay for this service, by "cheap" I just meant, well, cheap, but not free. It's all relative I suppose. But thanks for the response thus far! On December 17, 2015 at 16:15 mhop...@indigowireless.com (Matt Hoppes) wrote: > You could tunnel to a data center. > > Or NAT out

Weekly Routing Table Report

2015-12-18 Thread Routing Analysis Role Account
This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, PaNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-st...@lists

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Steven M. Bellovin
Yes. He's backing off a bit on the claim, since he doesn't have full context. --Steve Bellovin, https://www.cs.columbia.edu/~smb Sent from from a handheld; please excuse tyops > On Dec 18, 2015, at 12:27 PM, Royce Williams wrote: > >> On Fri, Dec 18, 2015 at 8:03 AM, Steven M. Bellovin >> w

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Royce Williams
On Fri, Dec 18, 2015 at 8:03 AM, Steven M. Bellovin wrote: > On 18 Dec 2015, at 11:52, Steven M. Bellovin wrote: > >> On 18 Dec 2015, at 7:28, Dave Taht wrote: >> >>> I think "unauthorized code" is still plausible newspeak for "bug". >>> >>> Why blame finger foo when you can blame terrorists? >>

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Steven M. Bellovin
On 18 Dec 2015, at 11:52, Steven M. Bellovin wrote: > On 18 Dec 2015, at 7:28, Dave Taht wrote: > >> I think "unauthorized code" is still plausible newspeak for "bug". >> >> Why blame finger foo when you can blame terrorists? > > It looks like two different holes, one a back door for unauthorize

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Steven M. Bellovin
On 18 Dec 2015, at 7:28, Dave Taht wrote: > I think "unauthorized code" is still plausible newspeak for "bug". > > Why blame finger foo when you can blame terrorists? It looks like two different holes, one a back door for unauthorized console login and one to somehow leak VPN encryption keys.

Re: Nat

2015-12-18 Thread Ahmed Munaf
Thanks, we are speaking with few vendors and A10 one of them. they offer the model Thunder 3030S, the price was good in comparison with the specifications of this model. its good to know that it works good at your university. > On Dec 17, 2015, at 9:34 PM, Netideainc wrote: > > At $dayjo

Re: Nat

2015-12-18 Thread Ahmed Munaf
> On Dec 17, 2015, at 8:47 PM, Nick Hilliard wrote: > > On 17/12/2015 17:36, Ahmed Munaf wrote: >> we are using ESP 20 > > You haven't said what you mean by "better". This could mean "faster" or > "copes with more sessions" or "cheaper". If your ISP is large, then it > might be "cost per us

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread A . L . M . Buxey
Hi, > > Should we blame Juniper for letting a git repository open to > > "unauthorized code" or should we congratulate them for their frankness > > (few corporations would have admitted the problem)? 'un-authorized' - not authorized. this could be code/idea by some/one engineer for eg debugging

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Dave Taht
I think "unauthorized code" is still plausible newspeak for "bug". Why blame finger foo when you can blame terrorists?

Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Karsten Thomann
Am Freitag, 18. Dezember 2015, 09:28:11 schrieb Stephane Bortzmeyer: > http://forums.juniper.net/t5/Security-Incident-Response/Important-Announceme > nt-about-ScreenOS/ba-p/285554 > https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat= SIRT_1 > &actp=LIST > > Should we blame Junip

[CVE-2015-7755] Backdoor in Juniper/ScreenOS

2015-12-18 Thread Stephane Bortzmeyer
http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554 https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST Should we blame Juniper for letting a git repository open to "unauthorized code" or should we congratulate

Re: ISP marking ipsec traffic based on certificate, how is this possible?

2015-12-18 Thread Tin, James
If you’re using certificates, It could be possible you may have changed your VPN from IPSEC to SSLVPN. In which case it now runs over TCP port 443. So maybe they’re not doing traffic shaping on TCP 443. James On 18/12/2015 2:21 pm, "Nick Ellermann" wrote: >Sure your VPN tunnel wasn't 'stuck