- NZNOG - lists.nznog.org

CISCO Advise sought.
by Chris Hodgetts 25 Sep '08

25 Sep '08

Hello, We are having some issues with our very basic Cisco configuration, that we cant seem to track down. (Random disconnections to only one host) I am not sure if this is the right forum, so if you believe it's not please stop reading. If you notice something obviously wrong with the config snippet at the bottom, please advise, and a beer is on offer. If you need more information than what was is provided below, and you would be keen to give up some of your valuable time for beer, please contact me off list. If you are still reading then you clearly do think this might be an appropriate place for questions of this nature, here goes the config snippet. All comments off list. ----------------------------------------------------------------------- Currently we have the following: ip nat pool ST_NAT_POOL 192.168.202.74 192.168.202.74 prefix-length 24 ip nat inside source route-map ST_NAT_MAP pool ST_NAT_POOL overload access-list 164 remark Some Telco (NAT) access-list 164 permit ip 192.168.254.0 0.0.0.255 1.2.3.0 0.0.0.255 access-list 164 permit ip 123.12.123.0 0.0.0.224 1.2.3.0 0.0.0.255 route-map ST_NAT_MAP permit 100 match ip address 164 We do some NAT on packets heading to some telco that go out our default route, and our ISP does some magic.. more info if needed. We had the following line in and the problem was still there however Cisco said it was bad, so we removed it and replaced it with the above explicit hosts, but the problem still appears. access-list 164 permit ip any 1.2.3.0 0.0.255 Basically we get random disconnections, but only to this Some Telco we have other connections to other telco's that are OK, these are natted, but are talking direct to a public IP, or are VPN'ed. This configuration is on a replacement Cisco, the old Cisco, with a very similar config, works fine, but has other issues which is why we need to replace it. Thanks and any comments please off list.

2 2

NZRR Route Registry Update
by NZRR Database Notifications 25 Sep '08

25 Sep '08

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9889 descr: advertised to AS9560 by Maximum Internet Ltd - AS9889 members: 123.100.64.0/18^18-29, 124.198.128.0/18^18-29, 202.89.32.0/19^19-29, 203.89.160.0/19^19-29, 202.55.96.0/20^20-29, 119.47.112.0/21^21-29, 202.189.160.0/21^21-29, 210.55.100.0/22^22-29, 210.55.104.0/22^22-29, 117.53.150.0/23^23-29, 202.49.88.0/23^23-29, 210.54.142.0/23^23-29, 192.138.251.0/24^24-29, 202.6.5.0/24^24-29, 202.27.8.0/24^24-29, 202.27.204.0/24^24-29, 202.36.70.0/24^24-29, 202.36.227.0/24^24-29, 202.37.72.0/24^24-29, 202.37.162.0/24^24-29, 202.37.181.0/24^24-29, 202.37.232.0/24^24-29, 202.150.102.0/24^24-29, 203.12.15.0/24^24-29, 203.97.42.0/24^24-29, 205.233.243.0/24^24-29, 210.54.13.0/24^24-29, 210.55.169.0/24^24-29, 210.55.214.0/24^24-29, 210.55.230.0/24^24-29, 203.167.219.56/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)maxnet.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080415 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9889 descr: advertised to AS9560 by Maxiumum Internet Ltd - AS9889 members: 123.100.64.0/18^18-29, 124.198.128.0/18^18-29, 202.89.32.0/19^19-29, 203.89.160.0/19^19-29, 114.134.160.0/20^20-29, 202.55.96.0/20^20-29, 114.134.176.0/21^21-29, 119.47.112.0/21^21-29, 202.189.160.0/21^21-29, 210.55.100.0/22^22-29, 210.55.104.0/22^22-29, 117.53.150.0/23^23-29, 210.54.142.0/23^23-29, 192.138.251.0/24^24-29, 202.6.5.0/24^24-29, 202.27.8.0/24^24-29, 202.27.204.0/24^24-29, 202.36.70.0/24^24-29, 202.36.227.0/24^24-29, 202.37.72.0/24^24-29, 202.37.162.0/24^24-29, 202.37.181.0/24^24-29, 202.37.232.0/24^24-29, 202.150.102.0/24^24-29, 203.12.15.0/24^24-29, 203.97.42.0/24^24-29, 210.54.13.0/24^24-29, 210.55.169.0/24^24-29, 210.55.214.0/24^24-29, 210.55.230.0/24^24-29, 203.167.219.56/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)maxnet.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080926 source: NZRR ------------------------------------------------------------

1 0

Joe Stewart is out of the office until 13 October 2008
by Joe.Stewart＠dia.govt.nz 24 Sep '08

24 Sep '08

I will be out of the office starting 25/09/2008 and will not return until 13/10/2008. Rob Hunter is acting for me whilst I am gone. His number is 04 494 0635. Alternatively, you could call Karmyn Lyons, Karmyn's number is 04 494 0628, she will assist you. Regards, joe I will be viewing my emails. Thanks Joe stewart ==== CAUTION: This email message and any attachments contain information that is CONFIDENTIAL and may be LEGALLY PRIVILEGED. If you are not the intended recipient, any use, disclosure or copying of this message or attachments is strictly prohibited. If you have received this email message in error please notify us immediately and erase all copies of the message and attachments. Thank you. ====

1 0

Cisco advisories 24 Sept 2008
by Nathan Ward 24 Sep '08

24 Sep '08

Sorry if you've seen this already. Big day over at Cisco, 12 advisories. http://www.cisco.com/warp/public/707/cisco-sa-20080924-bundle.shtml Of particular interest to operators I know about in NZ are: - L2TP bug that causes a specially crafted packet to trigger a reload - Bug on uBR7200 and 10000 that causes a reload with a special crafted packet - MPLS bug on newer boxes that causes a reload with a special packet - Bugs in the SIP stack that can cause a reload of the device remotel Check out the URL above for more juicy details. -- Nathan Ward

1 0

Solarix - Peering on APE
by Craig Spiers 23 Sep '08

23 Sep '08

Hi All, We are now peering on APE. Those wishing to peer with us directly, please contact me off list. I would strongly suggest it.. as it appears that most people seem to have an advertise all, accept none policy in regards to the route servers. Cheers Kind Regards, Craig Spiers - Network Manager Solarix Limited DDI: +64 9 974 4753 | FAX: +64 9 523 8057 MOB: +64 21 857 183 | <mailto:craig.spiers(a)solarix.co.nz?subject=From%20Signature> email: craig.spiers(a)solarix.co.nz The information contained in this email is privileged and confidential and intended for the addressee only. If you are not the intended recipient you are asked to respect that confidentiality and not disclose, copy or make use of its contents. If received in error you are asked to destroy this email and contact the sender immediately.

4 3

Re: [nznog] Solarix - Peering on APE
by Andy Linton 23 Sep '08

23 Sep '08

I sent this to Craig directly when I wanted you all to see it (:-) On Wed, Sep 24, 2008 at 8:43 AM, Andy Linton <asjl(a)lpnz.org> wrote: > On Tue, Sep 23, 2008 at 7:35 PM, Craig Spiers <craig(a)spiers.gen.nz> wrote: >> Hi All, >> >> >> >> We are now peering on APE. Those wishing to peer with us directly, please >> contact me off list. >> >> I would strongly suggest it.. as it appears that most people seem to have an >> advertise all, accept none policy in regards to the route servers. > > If that's the case then it's kind of disappointing. Arranging to have > assymetric routing would seem to rather defeat the object of peering > with the route servers. > > All the route servers operate a strong policy of only importing the > routes that peers have said they'll advertise and exporting the union > of those sets minus default and a list of bogons as defined on the > Team Cymru website. > > It's quite easy to look at what the route servers are importing and > exporting wrt a particular AS on the Looking Glass page at > http://nzix.net > > Of course that doesn't tell anyone if a particular peer is running an > "accept none" policy. You'd have to wonder if anyone who does this > will make a better fist of getting a bilateral peering set up any > better. >

2 1

Sell me your unused outbound capacity.
by Nathan Ward 22 Sep '08

22 Sep '08

Sorry for this post, but it's a request that few sales droids understand, this seems to be the only way to get it to all the people in-country who do understand this without having to call you all up individually. My current colocation provider have consistently demonstrated their inability to provide service to the CIR that I pay for, so I'm looking around at alternative options. If you are a provider with lots of megabits of traffic that is predominantly inbound (ie. you have lots of customers on ADSL tails or whatever), you have lots of outbound capacity that you're paying for but not selling. Sell it to me, cheaper than your sales droids would normally sell a symmetric circuit for, because I'm the opposite of you - I push significantly more traffic than I than pull - and I don't want to buy bits I don't use either. I'm interested in both international and domestic capacity, for web hosting and media streaming (no, not for P2P or anything like that). IPv6 is a bonus. Also, anyone else who has a similar need for outbound capacity for this sort of thing give me a yell, it might be worthwhile hooking up. All responses off-list please, including flames. Um, beer for anyone who hooks me up with someone I eventually buy from. Phew. Beer flowing in the same direction as the money, *and* a preference for IPv6 service? You saw it here first. -- Nathan Ward

1 0

23 September
by Richard Naylor 22 Sep '08

22 Sep '08

Tomorrow is 23 September and TVNZ 7 and InternetNZ have their ICT Debate scheduled to start at around 9pm, after the news. While you wait for this exciting event to start, you can watch the Tawa Schools Music Festival, live from the Michael Fowler Center in Wellington. http://www.r2.co.nz/20080923 starting at 7:30pm and running for around 2 hours. On 4 Oct 1994, our first public webcast, was the Tawa Schools Music Festival, so the webcast tomorrow is for us a trip down memory lane. Its also a fun event. You can see the 1994 event at http://www.r2.co.nz/19941004 In 1994, the MFC was connected to the Internet by fiber via WCC, which was connected to VUW by 2Mbps microwave. The concert webcast had 16 viewers in 12 countries. It impressed then Mayor Fran Wilde so much that she wrote about it in her weekly column in the Evening Post. So maybe a question for the politicians in the debate is - why after 14 years are people still debating whether we need fiber ? Why is it all taking so long ? But maybe its just better to drink beer and enjoy the concert. Cheers - Richard

8 7

MTUs on internet transit and peering
by Alastair Johnson 21 Sep '08

21 Sep '08

Hi, I was wondering if anyone has seen a general trend to supporting >1500B MTUs on Internet transit and peering sessions? I recall from years ago that AGC/ANC/PacNet supported interface-default MTUs, meaning that ATM connected customers had 4470B MTU. Obviously these days with most people running GE or XE in their networks with MPLS and 802.1Q you are looking at networks capable internally of jumbograms, but is anyone running this across network boundaries? Are there any plans for the NZ IXs to be jumbo-capable? I'd be interested in hearing from anyone who is jumbo-enabled on their transit connections, and particularly interested in hearing if they are seeing any significant number of packets that are >1500B on the Internet. aj

6 7

Auckland IPv6 Internet Exchange
by Andy Linton 21 Sep '08

21 Sep '08

We've been working on changes to the IPv6 exchange so that we have a process for IPv6 that is similar to that for IPv4. There's a new web page at http://v6ix.nzix.net/ape6/ with more info. For those who are current peers (http://v6ix.nzix.net/ape6/peers.html) you'll be able to request changes in the same way as you can for IPv4 using this page http://v6ix.nzix.net/cgi-bin/ape6/ChangeRoutes.cgi You'll also be able to see what's going on at the Looking Glass at http://nzix.net/cgi-bin/lg.cgi?router=rs1-v6.ape.net.nz and http://nzix.net/cgi-bin/lg.cgi?router=rs2-v6.ape.net.nz We'll be adding a second IPv6 route server rs2-v6.ape.net.nz very shortly. Changes to IPv6 route announcements will come to the nznog list as they currently do for IPv4. If you're not already peering with IPv6 see the link to the application form at http://v6ix.nzix.net/ape6/

1 0