- NZNOG - lists.nznog.org

IPSec vendor interoperability war stories
by Mark Goldfinch 10 Sep '13

10 Sep '13

Hi everyone, I have a business need to support IPSEC tunnels with many different vendors as we don't get to select our partner's equipment vendors. We've had some recent problems with our existing equipment. At the moment we're look at whether whether software upgrades will help our current situation. While we're doing that we're also looking at what other options exist. I'd appreciate anyone's operational experiences between different IPSec vendors, either on-list or to me directly if you want to protect the identities of the not so innocent :-) Beer for those who can offer their experiences! Thanks, -- * *Mark Goldfinch | Systems Team Leader MODICA GROUP nz: +64 4 498 6000

6 7

Vodafone RBI Tower Cosite
by Jonathan Brewer 10 Sep '13

10 Sep '13

Hi Folks, Anyone want to share their experiences co-siting on one of Vodafone's new RBI funded towers? As I understand there are fixed prices for co-site, backhaul from Chorus, etc.. It should be a pretty sweet deal. If there's anyone from Vodafone listening, I'd appreciate a pointer to a location list, rate card, and application form. I can't find them online. Cheers, Jon

1 0

Xtra mail admin and ptr records...
by Don Gould 10 Sep '13

10 Sep '13

From:<gillian.halkett(a)nzvanlines.co.nz <mailto:gillian.halkett(a)nzvanlines.co.nz>> SIZE=50696 Tue 2013-09-10 15:27:37: [126020:1] <-- 250 2.1.0 Ok Tue 2013-09-10 15:27:37: [126020:1] --> RCPT To:<jenna(a)christchurchapartments.co.nz <mailto:jenna(a)christchurchapartments.co.nz>> Tue 2013-09-10 15:27:38: [126020:1] <-- 553 5.7.1 <222-154-247-46.adsl.xtra.co.nz <http://adsl.xtra.co.nz>[222.154.247.46]>: Client host rejected: AUTO_[A|X]DSL We aren't accept direct connection not from dedicated SMTP servers. Please use your internet provider SMTP Server. Tue 2013-09-10 15:27:38: [126020:1] --> QUIT We're rejecting mail from nzvanlines.co.nz because they're running their smtp server on a service with a|x|vdsl in the ptr record. I think we've had this discussion on list before, and iirc we decided that we just get providers to update ptr records, but I'm a bit scared to ring L1HD and ask for a ptr change. Is there an admin on list from Telecom who can work with your customer to fix this for as I doubt it's only us it's impacting? D -- Don Gould 31 Acheson Ave Mairehau Christchurch, New Zealand Ph: + 64 3 348 7235 Mobile: + 64 21 114 0699 Ph: +61 3 9111 1821 (Melb)

5 6

Fwd: [PAG] Fwd: [isoc-advisory-council] STATEMENT: Internet Society Responds to Reports of the U.S. Government’s Circumvention of Encryption Technology
by Dean Pemberton 09 Sep '13

09 Sep '13

Given that protocols and standards effect NZ network operators, this seems to be on topic. Seeing how IETF handles these issues and rebuilds trust will be interesting. ---------- Forwarded message ---------- From: Alicia Jackson <jackson(a)isoc.org> Date: 10 September 2013 08:03 Subject: [isoc-advisory-council] STATEMENT: Internet Society Responds to Reports of the U.S. Government’s Circumvention of Encryption Technology To: "isoc-advisory-council(a)elists.isoc.org" <isoc-advisory-council(a)elists.isoc.org> Internet Society Responds to Reports of the U.S. Government’s Circumvention of Encryption Technology The Internet Society is alarmed by continuing reports alleging systematic United States government efforts to circumvent Internet security mechanisms. The Internet Society President and CEO, Lynn St. Amour, said, “If true, these reports describe government programmes that undermine the technical foundations of the Internet and are a fundamental threat to the Internet’s economic, innovative, and social potential. Any systematic, state-level attack on Internet security and privacy is a rejection of the global, collaborative fabric that has enabled the Internet's growth to extend beyond the interests of any one country.” The Internet Society believes that global interoperability and openness of the Internet are pre-requisites for confidence in online interaction, they unlock the Internet as a forum for economic and social progress, and they are founded on basic assumptions of trust. We are deeply concerned that these principles are being eroded and that users' legitimate expectations of online security are being treated with contempt. As the institutional home of the Internet Engineering Task Force (IETF), we believe that open and transparent processes are essential for security standardization, and result in better outcomes than any alternative approach. For example, protocols developed by the IETF are open for all to see, inspect, and verify, as are the open and inclusive processes by which they are specified. IETF Chairman Jari Arkko has strongly reiterated the IETF’s commitment to improving security in the Internet, and to seeking ways of improving security protocols in light of these new revelations and security threats. “The IETF has a long-standing commitment to openness and transparency in developing security protocols for the Internet, and sees this as critical to confidence in their use and implementation.” To read more, visit: http://www.ietf.org/blog/2013/09/security-and-pervasive-monitoring/. However, the open development of robust technical specifications is just one link in the chain. Security standards must be properly implemented and used. This is a wake-up call for technology developers and adopters alike, to reexamine what we can do to ensure that all links in the chain are equally strong. This is key to helping restore public trust and confidence in the Internet. The Internet has tremendous potential for economic and social good, but unless all stakeholders trust the Internet as a safe place for business, social interaction, academic enquiry, and self-expression, those economic and social benefits are put at risk. To fulfill its potential, the Internet must be underpinned by the right combination of technology, operational processes, legislation, policy, and governance. The recent reports suggest that U.S. Government programmes have systematically undermined some or all of those measures, and that is why we view the revelations with such grave concern. With this mind, we issue these calls to action for the global community: • To every citizen of the Internet: let your government representatives know that, even in matters of national security, you expect privacy, rule of law, and due process in any handling of your data. Security is a collective responsibility that involves multiple stakeholders. In this regard, we call on: •Those involved in technology research and development: use the openness of standards processes like the IETF to challenge assumptions about security specifications. •Those who implement the technology and standards for Internet security: uphold that responsibility in your work, and be mindful of the damage caused by loss of trust. •Those who develop products and services that depend on a trusted Internet: secure your own services, and be intolerant of insecurity in the infrastructure on which you depend. •To every Internet user: ensure you are well informed about good practice in online security, and act on that information. Take responsibility for your own security. At the Internet Society, we remain committed to advancing work in areas such as browser security, privacy settings, and digital footprint awareness in order to help users understand and manage their privacy and security. The citizens of the Internet deserve a global and open platform for communication built on solid foundations of security and privacy. _______________________________________________ Isoc-advisory-council mailing list Isoc-advisory-council(a)elists.isoc.org https://elists.isoc.org/mailman/listinfo/isoc-advisory-council

6 7

One block of AS Numbers allocated to the RIPE NCC
by Leo Vegoda 09 Sep '13

09 Sep '13

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of one block of 1,024 AS Numbers to the RIPE NCC in September 2013: 61952-62463 Assigned by RIPE NCC whois.ripe.net 2013-09-09 199680-200191 Assigned by RIPE NCC whois.ripe.net 2013-09-09 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/ Regards, Leo Vegoda ICANN IANA

1 0

Maxnet/Vocus Colo - sublet
by Skeeve Stevens 08 Sep '13

08 Sep '13

Hey all, I am looking for about 5RU in the Maxnet/Vocus DC. I think they only sell in minimum half racks - which is excessive for our needs. Does anyone have some space they are subletting? I am also looking for a quote on a cross-connect from Maxnet DC to SkyTower. Responses off-list please (via email only!) ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.com ; www.eintellegonetworks.com Phone: 1300 239 038; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/networkceoau ; blog: www.network-ceo.net The Experts Who The Experts Call Juniper - Cisco - Cloud

1 0

Mail admins for dmzglobal, yahoo and ihug
by Don Gould 04 Sep '13

04 Sep '13

Could mail admins for dmzglobal, yahoo and ihug please make them selves known off list please. I have a client who is having trouble getting mail to some of your customers. I've run a trace on our log files and proven that your mail systems are accepting mail from our server on behalf of our client. I can provide mail logs, but I'll do that directly off list. Thanks D -- Don Gould 31 Acheson Ave Mairehau Christchurch, New Zealand Ph: + 64 3 348 7235 Mobile: + 64 21 114 0699 Ph: +61 3 9111 1821 (Melb)

1 0

Kiwicon 7 CFP
by Mike Forbes 02 Sep '13

02 Sep '13

HI NZNOG FRIENDS Just advising the list the Kiwicon 7 CFP is out. We welcome submissions from our networky chums. https://www.kiwicon.org/cfp2013.txt -- On behalf of the Kiwicon Crüe

1 0

Orcon IPv6 rDNS delegation
by Jonathan Spence 01 Sep '13

01 Sep '13

Hi everyone, Google have just started enforcing PTR records for IPv6 addresses delivering to Gmail. Our IPv6 works great with Orcon but having serious issues getting delegation back to our nameservers setup. I have been told a few times that everything is setup on their end but I don't think it is. Our IP space: 2400:4800:4017::/48 is meant to be sent to ns1.power-business.co.nz and ns2.power-business.co.nz. However it doesn't seem to. For example our website is:2400:4800:4017:200:250:56ff:fe90:82f If I query ns1.power-business.co.nz from my home computer is works fine: -----command----- C:\Users\Jonathan Spence>nslookup 2400:4800:4017:0200:0250:56ff:fe90:082f 60.234.77.213 Server: UnKnown Address: 60.234.77.213 Name: midas.power-business.co.nz Address: 2400:4800:4017:200:250:56ff:fe90:82f ------ end command ----- However other hosts don't resolve this. When using this tool it doesn't work failing when reaching Orcon's nameserver: http://www.simpledns.com/lookup-dg.aspx Can anyone comment? Thanks, Jonathan ------- output ------- Received referral response - DNS servers for "0.4.2.ip6.arpa": -> ns4.apnic.net (no IP address) -> apnic1.dnsnode.net (no IP address) -> ns3.apnic.net (no IP address) -> tinnie.arin.net (no IP address) -> ns2.lacnic.net (no IP address) -> sec1.authdns.ripe.net (no IP address) -> ns1.apnic.net (no IP address) ---------------------------------------- Attempting to resolve DNS server name "apnic1.dnsnode.net" (details not logged) ---------------------------------------- Resolved DNS server name "apnic1.dnsnode.net" to IP address 194.146.106.106 ---------------------------------------- Sending request to "apnic1.dnsnode.net" (194.146.106.106) ---------------------------------------- Received referral response - DNS servers for "0.0.8.4.0.0.4.2.ip6.arpa": -> ns1.orcon.net.nz (no IP address) -> ns2.orcon.net.nz (no IP address) ---------------------------------------- Attempting to resolve DNS server name "ns2.orcon.net.nz" (details not logged) ---------------------------------------- Resolved DNS server name "ns2.orcon.net.nz" to IP address 210.55.12.2 ---------------------------------------- Sending request to "ns2.orcon.net.nz" (210.55.12.2) ---------------------------------------- Received authoritative (AA) response: -> Header: Non-Existent Domain ----- end output ----- Jonathan Spence Chief Information Officer Mobile: +64-21-1055634 Work: +64-9-9503306 Web: power-business.co.nz The information contained in this message is privileged and intended only for the recipient names. If the reader is not a representative of the intended recipient, any review, dissemination or copying of this message or the information it contains is prohibited. Views expressed in this message may notnecessarily be those of Power Business Services Limited. If you have received this message in error, please immediately notify the sender, and delete the original message and attachments.

3 3

DNS hijacking of a few domains
by Blair Harrison 27 Aug '13

27 Aug '13

Hi Folks, Seems like there has been a bit of DNS hijacking happening today - NYTimes.com as one of the targets - you may wish to look at flushing your recursive nameserver caches.. See this dns-oarc post for more details. https://lists.dns-oarc.net/pipermail/dns-operations/2013-August/010617.html Cheers, Blair

1 0