Re: [c-nsp] BGP MD5 DDOS ?

2012-09-18 Thread Robert E. Seastrom
Dobbins, Roland rdobb...@arbor.net writes: On Sep 16, 2012, at 7:05 PM, Robert E. Seastrom wrote: An extra knob, an extra data point to be collected, managed, (and possibly get wrong) as a proxy for are you sure? [y/N] is a huge step away from goodness. Given that the consequences

Re: [c-nsp] BGP MD5 DDOS ?

2012-09-16 Thread Robert E. Seastrom
Dobbins, Roland rdobb...@arbor.net writes: On Sep 15, 2012, at 7:58 PM, Nick Hilliard wrote: The general advice is still to use copp or acls to deprioritise unknown bgp traffic. Gtsm can help in some situations, particularly at Ixps. Otherwise md5 is a matter of choice. Some people like

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Robert E. Seastrom
Gert Doering g...@greenie.muc.de writes: Hi, On Wed, Aug 08, 2012 at 10:16:56AM +0300, Aivars wrote: Well, 19xx with a proper licensing will work. Everything else depends on pps and scale. I want to see that. MPLS over GRE over *IPSEC* with 1 Gbit/sec using a 19xx (the original poster

Re: [c-nsp] Small, Low Power Cisco Router Recommendation

2012-07-20 Thread Robert E. Seastrom
I've been reasonably happy with the RB750(G|GL|). The configuration language is not a Cisco knock-off, but you'll figure it out easily enough. Sure I have a laundry list of bugs and complaints, but that's the case for the big name guys as well, and it's easy to exceed expectations when one is

Re: [c-nsp] [j-nsp] Broadband Model suggestion?

2012-07-12 Thread Robert E. Seastrom
My experience with Zhone (the MALC and their ONTs) was that it was quite easy to get working and didn't rely on any kind of proprietary management software which is always a risk when playing in those areas. Web configuration UI on the ONT was not the most awesome thing in the world, but it

Re: [c-nsp] lsd

2012-04-25 Thread Robert E. Seastrom
While MPLS hides the underlying topology from you, LSD is good for exposing the metaphysical layer. ;-) Scott Granados sc...@granados-llc.net writes: Gee and I thought LSD was for the operator and not a feature. Nice, no reason the gear shouldn't share in the fun. :) On Apr 25, 2012,

Re: [c-nsp] Limits on virtual-access interfaces ?

2012-04-16 Thread Robert E. Seastrom
Mike mike-cisconspl...@tiedyenetworks.com writes: Howdy, I have a 7201 terminating pppoe sessions. I ran the following command and saw that the max virtual-access interface number was 900, per below: sh int virtual-access ? 1-900 Virtual-Access interface number I am

Re: [c-nsp] IPSEC + TFTP don't work

2012-04-06 Thread Robert E. Seastrom
Victor Sudakov v...@mpeks.tomsk.su writes: Randy wrote: Victor wrote: RS wrote: Try setting the MTU on the ethernet on the TFTP server to 1400 or so rather than 1500.  That oughta fix the problem, assuming that the tftp server software is sanely written.  If it were TCP

Re: [c-nsp] IPSEC + TFTP don't work

2012-04-05 Thread Robert E. Seastrom
Victor Sudakov v...@mpeks.tomsk.su writes: I feel that the issue may be in IP fragmentation of some sort which the dumb PXE TCP/IP stack cannot handle, but a google search did not help. At least neither an Intel NIC, nor a Realtek NIC nor a GPXE emulation work. I'm pretty sure you're on the

Re: [c-nsp] Need a Primer on WCCP / Web Hijacking

2008-07-30 Thread Robert E. Seastrom
or pfsense captive portal (easy to set up, cheaper than mikrotik) or openwrt + chilispot (somewhat more difficult to set up, even cheaper yet) ---rob a. rahman isnaini r.sutan [EMAIL PROTECTED] writes: Mikrotik with Hotspot Profile... for cheaper fast

Re: [c-nsp] High temperatures on cisco 6504-E chassis

2008-07-10 Thread Robert E. Seastrom
Koen [EMAIL PROTECTED] writes: We got 2 WS-C6504-E chassis both with 1 sup 7203CXL and 2 WS-X6748-GE-TX and we see that the asic temperature is always higher then 40C which is the max operational temperature according to the docs. The max operational temperature quoted in documentation is

Re: [c-nsp] BGP network stops being advertized

2008-06-16 Thread Robert E. Seastrom
Deepak Jain [EMAIL PROTECTED] writes: In the old days, null was handled by CPU (software switched), so lots of us old-timers got into the habit of using loopback instead of null. On a modern platform it should make no operational difference provided you have everything you need set up

Re: [c-nsp] Problems doing NPE upgrade

2008-05-02 Thread Robert E. Seastrom
Chris Conn [EMAIL PROTECTED] writes: Roy wrote: A client has a 7206VXR that we are attempting to just upgrade the NPE. When we replace the NPE-300 with an NPE-400 we get a crash loop during the boot. The OS we are using is Cisco IOS Software, 7200 Software (C7200-P-M), Version

Re: [c-nsp] External Firewall

2008-03-27 Thread Robert E. Seastrom
The HAR is going to be announced on April Fool's day. My lawyers told me that as long as I didn't reveal anything about the feature set (which I find laughable), that I wasn't breaking the NDA, so don't sweat it. Remember folks, you heard it here first...

Re: [c-nsp] Recommendations for T1 Extender

2008-01-21 Thread Robert E. Seastrom
Adam Piasecki [EMAIL PROTECTED] writes: In the past we used Pargain equipment, but it's becoming hard to find that stuff. So we are starting to look for a new product. Basically we want to take a T1 from the LEC extended it 1-4miles and have the receving end connect into our router. You

Re: [c-nsp] OC3 Throughput

2007-11-26 Thread Robert E. Seastrom
Of course, the *real* answer which everyone seems to be overlooking is that you're terminating PPPoE-over-L2TP per Paul's original mail. The encap/deencap is the limiting factor, and you're gonna pummel any known NPE up to and including the NPE-G1 before you hit the link speed limit with ATM or

Re: [c-nsp] OC3 Throughput

2007-11-26 Thread Robert E. Seastrom
; take Cisco's and your colleagues' numbers with a grain of salt, hedge the numbers in your model, and come out looking like a hero. :-) ---Rob - Original Message --- Subject: Re: [c-nsp] OC3 Throughput From: Robert E. Seastrom [EMAIL

Re: [c-nsp] what limits bw on a tcp stream?

2007-11-21 Thread Robert E. Seastrom
I have gear in Amsterdam and in San Jose. Pushing log files from Amsterdam to San Jose through rsync seems to top out at 7Mbps even Is rsync using ssh to move the data? ssh has its own windowing issues. There's a high perf fix for that which you should be able to find via google.

Re: [c-nsp] what limits bw on a tcp stream?

2007-11-21 Thread Robert E. Seastrom
Peter Lothberg [EMAIL PROTECTED] writes: I have gear in Amsterdam and in San Jose. Pushing log files from Amsterdam to San Jose through rsync seems to top out at 7Mbps even Is rsync using ssh to move the data? ssh has its own windowing issues. There's a high perf fix for that

Re: [c-nsp] vty access-list

2007-09-13 Thread Robert E. Seastrom
Try using an access-class on the VTY and a simple acl (number 1-99) instead. ---rob C and C Dominte [EMAIL PROTECTED] writes: Hi, I am trying to filter SSH access on a router from outside by source and destination ip address. To be more clear, the

Re: [c-nsp] ipv6 autoconfig linux

2007-05-22 Thread Robert E. Seastrom
Harold Ritter \(hritter\) [EMAIL PROTECTED] writes: Oops. I guess I should have looked at that first ;0) I don't understand you got assigned a /64. I though the smallest block that could be assigned to a customer site was /48. It's actually anywhere from a /64 to a /48, in the ARIN region

Re: [c-nsp] NPE-G1 vs NSE-1

2007-05-22 Thread Robert E. Seastrom
Kanagaraj Krishna [EMAIL PROTECTED] writes: Hi, Whats the difference btw both this cards and which would suit an ISP environment running BGP, IPv6 etc? The NSE-1 was an oddball card even in its day. End of software maintenance for it was back in 2005. It has similar performance to the

Re: [c-nsp] Feedback on: Security Advice for Routers and Switches

2007-05-17 Thread Robert E. Seastrom
Matthew Lange [EMAIL PROTECTED] writes: * Implement blackhole routing on the Internet interface, using the Bogon list[3] Actually, I would put static bogon lists in the common but bad advice section, right there with turning off ICMP (sorry, RobT!). Why? Well, except for certain networks

Re: [c-nsp] New hardware choose help needed

2007-04-20 Thread Robert E. Seastrom
Dmitriy Sirant [EMAIL PROTECTED] writes: Cisco 7204VXR NPE-G1 What we need from it: 1. Terminate about 50-150 VLANs 2. Terminate about 2500-4000 PPPoE users (at 100Mb, not ADSL) 3. Dynamic access lists and rate-limits for PPPoE users via Radius. 4. 2 x 1000Mbit/s ports to clients with