Re: BGP - Traffic Management

2021-08-19 Thread Ross Tajvar
Atlantic Metro (now 365 Datacenters) AS29838 allows more specifics on our backbone. We filter outbound to transit and peering obviously, but we allow e.g. granular steering if you have more than one port with us. On Thu, Aug 19, 2021, 1:23 PM Ryan Hamel wrote: > Hello, > > > > Does anyone know

What does it mean to be issued an IP address block? (Re: Newbie Questions: How-to monitor/control unauthorized uses of our IPs and DNS zones?)

2021-08-19 Thread John Curran
Folks - (I’ve changed the subject to keep this part of the thread separate - but it would be nice if others more clueful than myself in such matters addressed Pirawat’s actual questions regarding DNS zone and redirection monitoring…) Regarding IP address blocks, I’m going to provide the

Re: BGP - Traffic Management

2021-08-19 Thread heasley
Thu, Aug 19, 2021 at 08:40:21PM +0200, Lukas Tribus: > On Thu, 19 Aug 2021 at 19:21, Ryan Hamel wrote: > > Does anyone know of any US carriers that will accept more > > specific routes other than what’s required for the DFZ, like > > “le 31” or “upto /31” (junos speak)? > > NTT was mentioned

Re: Newbie Questions: How-to monitor/control unauthorized uses of our IPs and DNS zones?

2021-08-19 Thread Owen DeLong via NANOG
> On Aug 19, 2021, at 12:34 , Adam Thompson wrote: > > I just had a conversation with John Curran (of ARIN) about this, in fact... > > You don't own IP addresses. But you also don't rent IP addresses, either. True, but you can rent the registration of an IP address, or, you can acquire a

Zayo BGP filter update contact

2021-08-19 Thread Adam Korab
Hi, It was requested on July 7 that Zayo build our inbound prefix filter from our as-set object in RADB. As of today, six weeks or so later, after beating them up for updates, all we get back from support is “we have engaged our engineering team on this” Anybody around willing and able to

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Seth Mattinen
On 8/19/21 11:19 AM, Ross Tajvar wrote: I, and many others that I know, have successfully listed our networks in PeeringDB while having no peering. You may just need to try again. All of the argument is based around an email dated in *2015*. So yeah, try again.

Re: Newbie Questions: How-to monitor/control unauthorized uses of our IPs and DNS zones?

2021-08-19 Thread Adam Thompson
I just had a conversation with John Curran (of ARIN) about this, in fact... You don't own IP addresses. But you also don't rent IP addresses, either. IP addresses are not a thing, good, or object, not even an intangible good. They are an address, or an index, if you will. (You might think of

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Adam Thompson
I have an example locally: BellMTS (ASNs 684, 7122, 4398), the local ILEC. To the best of my knowledge, they only peer with downstream customers (including myself) and their sole upstream, Bell Canada (AS577). Meanwhile that's a ~700k eyeball network (with some hosting, sure), roughly ~400Gbps

Re: BGP - Traffic Management

2021-08-19 Thread Lukas Tribus
On Thu, 19 Aug 2021 at 19:21, Ryan Hamel wrote: > Does anyone know of any US carriers that will accept more > specific routes other than what’s required for the DFZ, like > “le 31” or “upto /31” (junos speak)? NTT was mentioned just a few days ago here:

Re: Newbie Questions: How-to monitor/control unauthorized uses of our IPs and DNS zones?

2021-08-19 Thread Pirawat WATANAPONGSE via NANOG
Huh. And I thought that I did lay down information (and questions) pretty clearly, but as you correctly pointed out, I didn't. So, here goes the second version: Background Information Section (v2): We are a Registrant and already registered a zone/domain with a Registry, we are also a LIR and

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Brielle
On 8/19/21 12:19 PM, Ross Tajvar wrote: I, and many others that I know, have successfully listed our networks in PeeringDB while having no peering. You may just need to try again. Yup, can confirm I had no issues registering too and I've only got a pretty small setup these days. Looks

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Ross Tajvar
I, and many others that I know, have successfully listed our networks in PeeringDB while having no peering. You may just need to try again. On Wed, Aug 18, 2021, 5:53 PM Sabri Berisha wrote: > - On Aug 18, 2021, at 2:21 PM, Patrick W. Gilmore patr...@ianai.net > wrote: > > Hi, > > > On Aug

Meet our Scholarship Recipients (VIDEO) + Poll Results + Digital Blast from the Past

2021-08-19 Thread Nanog News
Meet our 2021-22 Scholarship Recipients *We love supporting our builders of the Internet of tomorrow. * Meet Esu, Charly, Wendy, and Juan. Four incoming undergrad freshman engineering students from all over the United States, that NANOG was able to help support their career dreams. Learn more

BGP - Traffic Management

2021-08-19 Thread Ryan Hamel
Hello, Does anyone know of any US carriers that will accept more specific routes other than what's required for the DFZ, like "le 31" or "upto /31" (junos speak) ? I know Zayo supports this internally but would like to know of other carriers for redundancy. I am currently dealing with a

Re: Outbound Route Filtering (ORF) vendor support

2021-08-19 Thread Jeffrey Haas
> On Aug 19, 2021, at 9:04 AM, james jones wrote: > > PCRE or death. Tell me if I am wrong, but I thought PCRE was the most widely > used regex lib these day anyways. I also thought it was already in Junos. Junos is a very wide topic. In Juniper's BGP implementation, there are two regular

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Eric Kuhnke
I agree with you in the utility of that, but sort of as a side topic... I wonder how many ASes are out there that have any significant volume of traffic/multi-site presences, but are exclusively 100% transit customers, do not have any PNIs at major carrier hotels, and are not members of any IX.

Re: "Tactical" /24 announcements

2021-08-19 Thread Ben Maddison via NANOG
Hi David, On 08/19, David Bass wrote: > Ben, > > Yes, sorry. > > Pulling/pushing the config data to a server, and then managing it there in > addition to on the box. Like, if I want to run some reports to see how > many PL are defined on each box, it’s easier to do that with the data >

Re: Newbie Questions: How-to monitor/control unauthorized uses of our IPs and DNS zones?

2021-08-19 Thread Bill Woodcock
> On Aug 19, 2021, at 4:05 PM, Pirawat WATANAPONGSE via NANOG > wrote: > Background Information Part: > We rent an IP Address Block and a DNS zone. > [We have to pay the annual fees, so they are renting, yes? :-) ] We don’t have enough information to know whether you’re renting or are the

Newbie Questions: How-to monitor/control unauthorized uses of our IPs and DNS zones?

2021-08-19 Thread Pirawat WATANAPONGSE via NANOG
Dear Gurus, Background Information Part: We rent an IP Address Block and a DNS zone. [We have to pay the annual fees, so they are renting, yes? :-) ] We run our own DNS authoritative server, with DNSsec on. We register our IP block on both IRR and ROA, and monitor them both for ‘poisoning

Re: Outbound Route Filtering (ORF) vendor support

2021-08-19 Thread james jones
PCRE or death. Tell me if I am wrong, but I thought PCRE was the most widely used regex lib these day anyways. I also thought it was already in Junos. Sent from my iPhone > On Aug 19, 2021, at 7:56 AM, Jeffrey Haas wrote: > > ORFs are a challenging feature and haven't gotten a lot of

Re: Outbound Route Filtering (ORF) vendor support

2021-08-19 Thread Jeffrey Haas
> On Aug 19, 2021, at 12:18 AM, Douglas Fischer > wrote: > > I agree that without combining prefix-list and as-path, the effectiveness of > ORF, considering its initial purpose, the pros and cons does not pay > themselves. > > > But (there is always a but), I was imagining a different

Re: Outbound Route Filtering (ORF) vendor support

2021-08-19 Thread Jeffrey Haas
ORFs are a challenging feature and haven't gotten a lot of deployment for a number of reasons. At a high level, they're a very coarse filter. Since each new ORF type adds to the logical AND condition, you start having to be more and more permissive in what you permit in the policy. Since a

Re: "Tactical" /24 announcements

2021-08-19 Thread David Bass
Ben, Yes, sorry. Pulling/pushing the config data to a server, and then managing it there in addition to on the box. Like, if I want to run some reports to see how many PL are defined on each box, it’s easier to do that with the data centralized and managed. David On Thu, Aug 19, 2021 at 6:35

Re: "Tactical" /24 announcements

2021-08-19 Thread Ben Maddison via NANOG
Hi Randy, On 08/17, Randy Bush wrote: > for junos, i build the prefix list externally and push config. sad to > say, the code is so old ('90s) that it's pearl and uses `peval`. i > should fix but (copious spare time) == 0. > Spare time must be > 0 if you're willing to wait for peval to finish

Re: "Tactical" /24 announcements

2021-08-19 Thread Ben Maddison via NANOG
Hi David, On 08/18, David Bass wrote: > I'm also in the externally managed space...very cool tool though. I love > the idea of distributing some of this functionality. > > Are you also exporting and managing this data outside? > [assuming that was directed to me...] I'm not sure what you mean

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Ben Maddison via NANOG
Hi Patrick, On 08/18, Patrick W. Gilmore wrote: > > Of course! Including headers to show authenticity. I was very amused by the > > explanation of the "chicken and egg" problem. Who's creating that? The > > networks > > who refuse to peer with non-peeringdb registered ASNs, or peeringdb who >

Re: PeerinDB refuses to register certain networks [was: Setting sensible max-prefix limits]

2021-08-19 Thread Nick Hilliard
Sabri Berisha wrote on 19/08/2021 00:57: - On Aug 18, 2021, at 4:03 PM, Rubens kuhlrube...@gmail.com wrote: Hi, Currently RPKI can only validate origin, not paths. If/when a path validation solution is available, then one easy way to know that network A really means to peer with network

Re: Outbound Route Filtering (ORF) vendor support

2021-08-19 Thread Robert Raszuk
Hi Doug, But what you need you can do today in any shipping decent implementation of BGP using RTC. https://datatracker.ietf.org/doc/html/rfc4684 While originally designed for L3VPNs long ago the use of RTC has been extended for other address families including SAFI 1. As a matter of fact