- NZNOG - lists.nznog.org

PS: RE: [nznog] Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

> Replies off-list, please. Or phone me or Rob on this number: > Phone 64 4 384 4153 Thanks in anticipation. Lesley

1 0

Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

I need some help with setting up a borrowed Network iQ 1000 series router. (Also labelled securicor 3net if that helps) I have got as far as connecting to the serial port, watching it boot up and produce the login prompt, then it doesn't seem to respond to input, and hangs my Hyperterm (sorry!) session. I'm told the config has been set back to factory defaults, but the person who loaned it to me is in the middle of a crisis and can't help me set it up. If anyone could spare a few minutes to point me in the right direction I would be very grateful. I have all the config info I need, I just can't talk to it. (This is a temporary replacement for a very dodgy router that's providing our internet connection, and quite urgent) Replies off-list, please. Lesley Walker Datamine Limited - turning numbers into people 103 Ghuznee Street PO Box 11-452 Wellington, New Zealand Phone 64 4 384 4153 http://www.datamine.co.nz

1 0

Re: Paradise MX , was: [nznog] Anyone awake at Ihug NOC/Security?
by Ewen McNeill 21 Jun '05

21 Jun '05

In message <Pine.LNX.4.56.0506221253110.2350(a)green.darkmere.gen.nz>, Simon Lyall writes: >Does anyone know why pop3.paradise.net.nz doesn't seem to listen on port >25? [1] I wouldn't normally mind but it is listed as the primamry MX for >the domain. > >[1] - Since Monday at least, might be a lot longer. It's been like that for a year.[0] The response I got when I reported it said "We have permanently blocked SMTP requests to pop3.paradise.net.nz.". After some discussion, and me suggesting some more sensible approaches to route their mail,[1] they eventually said: "Despite how our mail system may look to the outside world it is functioning in a manner that we require at this particular stage of development." >From where I sit it still looks fairly clueless to firewall your primary MX off from the world. But I concluded then that I would be best served by excluding the instances of "failed connection to pop3.paradise.net.nz" from my log reports and forgetting about it. If you're able to get hold of someone clueful at Paradise and get them to fix it, I'll be grateful too.[2] Ewen [0] I know this because I found the auto-response to my ticket reporting the problem, and it's dated 21 June 2004. [1] Eg, modern mailers mail forwarding from their preferred MX to pop3.paradise.net.nz when appropriate, split DNs, etc. [2] The wellylug mailing list I host has several @paradise.net.nz addresses subscribed to it, so I get instances of this in my log pretty much daily.

1 0

IANA IPv4 allocations and bogon updates: 74/8, 75/8, 76/8, 189/8, 190/8
by Rob Thomas 21 Jun '05

21 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- [ Apologies to those of you who receive this note in multiple forums. ] Hi, all. The numerous Team Cymru bogon projects have been updated as of 17 JUN 2005 to reflect the following IANA allocation made on 17 JUN 2005: 074/8 Jun 05 ARIN (whois.arin.net) 075/8 Jun 05 ARIN (whois.arin.net) 076/8 Jun 05 ARIN (whois.arin.net) 189/8 Jun 05 LACNIC (whois.lacnic.net) 190/8 Jun 05 LACNIC (whois.lacnic.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter- Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thank you for your continued support. Rob, for Team Cymru. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQrjLPlkX3QAo5sgJAQFHwAP/Z8KrLp9id6PD51KNEjAlveJCxRnvP4ev RofqRMex1SB5itogkB4O6JmrpSqIjqgM2GsnAUREZr5/r2ekdAZwejT85zHftl92 3ExvEec3P2PVDdfWF5v9TSVWfzwwbMW2HWwymzUYT7klWpjblcUUPdAWl+khD+FU /C8cCA2b8qk= =JvMq -----END PGP SIGNATURE-----

1 0

Thanks to TelstraClear for providing service during the major outage on Monday
by Adrian Smith 21 Jun '05

21 Jun '05

The National Library of New Zealand would like to thank TelstraClear New Zealand for providing a quick alternate National and International Internet service to us by setting up a BGP routing/Peering connection over our existing CityLink Network connections to bypass the major Telecom network outage on Monday. Our organisation was back up on the Internet several hours before the Telecom Network failure was restored. Due to the nature of Mondays Telecom Network failure we lost both our primary and backup Internet connections at 10:49am, leaving only our CityLink connection working, and peering with the CityLink WIX route servers, which still provided some 300 routes to us. After an hour of not being able to get any news on the cause and duration of the Telecom outage we approached one of TelstraClear's Internet BGP routing wizards and asked how can we route past this problem, he advised us to talk to their wholesale people. After explaining the situation to wholesale, authorisation was given to one of their Internet BGP routing wizard's to make it happen. Within a short time BGP Peering was set-up and implemented over the phone, and our full National and International Internet service was fully restored over CityLink to TelstraClear. We do not have any sort of contract with TelstraClear. The point here is that although TelstraClear stopped peering at WIX :( they are still connected to the CityLink Network :) and still connect to customers over it. We would not have had this option open to us if we were not already connected and using the CityLink Network and CityLink's Neutral Peering Exchange. http://www.citylink.co.nz/community/peering.html So Thanks to TelstraClear for providing a temporary Internet pipe with no notice; and Thanks also to the CityLink team /NGI/MORST Advanced Network for running some Internet BGP routing courses last week. The information was put into action on our router to bypass Monday's problem. http://www.ngi.org.nz/ http://www.morst.govt.nz/?CHANNEL=IT+INFRASTRUCTURE&PAGE=IT+Infrastructure The recently released Government Digital Strategy http://www.digitalstrategy.govt.nz/ encourages co-operation and collaboration in as many ways possible between all New Zealand people, and organisations both Government and private sector. When the many technical people on this NZNOG list receive this email, please take it to your leaders and explain the many benefits of Internet Peering at Neutral Internet Peering Exchanges to create a fully meshed, distributed Internet for New Zealand. Digital Strategy Launch http://www.r2.co.nz/20050516/ recording from Parliament. When the big one hits New Zealand and we have a full-scale major civil defence emergency it will be far too late for the very capable technical people in each of the organisations to implement Internet peering. They will not be able to use the phone networks due to outages and overloading, and the current New Zealand Internet will fail because peering was not put in place and working. It is in the interest of every single New Zealander that every New Zealand Telco, ISP and organisation connects their networks to the nearest Neutral Internet Peering Exchange and starts peering; and helps to create a real New Zealand Internet. The original Internet was designed for this very reason for the US Defence Department to prevent a total failure of communications during major infrastructure outages and emergencies. There would also be benefits for the Telco's and ISP's if this peering was already in place before the Telecom outage on Monday. It may have been a non-event, when both fibres were cut, the Telecom network could have re-routed traffic around the damage over TelstraClear's equally capable backbone network. Even if Telecom had to pay TelstraClear for the temporary transit traffic, it would have probably been a far less cost to pay both financially and politically. And the major disruptions caused to a lot of people waiting at airports, unable to use EFTPOS networks etc. may have been avoided, and Telecom customers would still have trust in them to provide Internetworking services. This would also work in reverse should such an event hit TelstraClear's network. So come on New Zealanders, please get the important message and do something about this situation today. Without realising it, you may save lives in the future because the NZ Internet does not break, just because a couple of fibre optic cables get cut by accident or equally by a natural disaster event. To all journalists on this list, please feel free to put this full message in as many papers, magazines and web sites as possible. With a further message to encourage every New Zealander who reads it, to email their ISP and request that their ISP set-up Internet Peering at a Neutral Internet Peering Exchange to create a robust New Zealand Internet. Come on Kiwi's, lets just do it. Adrian Smith, Network Specialist, National Library of New Zealand >>> Michael Newbery <Michael.Newbery(a)team.telstraclear.co.nz> 20/06/2005 17:26:36 >>> At 5:01 PM +1200 20/6/05, Andy Linton wrote: >So is this a good time to ask about the design of a network that concentrates >so much of its core service in Auckland? Is TelstraClear's network design any >better? I'd like to think so. :) For a start, it takes more than two fibre cuts in the North Island to disrupt us (that's new since you fled Andy :) Currently the core network is distributed and I prefer to follow that mantra whenever possible, though sometimes resources are naturally 'clumpy' (is that a word?) -- Michael Newbery IP Architect TelstraClear Limited Tel: +64-4-920 3102 Mobile: +64-29-920 3102 Fax: +64-4-920 3361 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Outage update from Telecom
by Juha Saarinen 20 Jun '05

20 Jun '05

This is what they're telling us at the moment: ---------------------------------------------------------------------- Telecom technicians have identified the two locations where the North Island Telecom network has today been damaged and are working to repair them. It is anticipated that a patch will be in place by late this afternoon, enabling the restoration of services. A large number of mobile, Internet and other data services have been affected. In addition, many voice calls on fixed lines are congested. The outage has been affecting customers since late this morning. Telecom is working to repair the outage as soon as possible. Telecom regrets the inconvenience to customers and will provide more information throughout the day. The outage, which occurred at 10.48am today, was caused by physical damage to the network on both the east and west coast sections of the network. Technicians are currently working on repairing both the eastern fibre break which is in the Rimutaka area, and the western break in south Taranaki. The outage is affecting calls to Telecom’s own call centres, causing overloading. Telecom is asking customers to be patient. We will provide more information as soon as possible. For more information, please contact: Sarah Berry Media Relations Executive 04 498 9481 027 470 7900 Phil Love Senior Media Relations Executive 04 498 9155 027 277 8496 Melanie Marshall 04 498 9272 027 452 6231 John Goulter Public Affairs & Government Relations Manager 04 498 9369

15 24

Anyone awake at Ihug NOC/Security?
by Mark Foster 20 Jun '05

20 Jun '05

Repeat emails over the last week or two to abuse@ and noc@ havn't had any sort of response or acknowledgement - can someone from Ihug NOC or security please contact me offlist. Thanks Mark.

2 1

Re: [nznog] Outage update from Telecom
by Ewen McNeill 20 Jun '05

20 Jun '05

In message <Pine.LNX.4.56.0506201840470.8951(a)blue.darkmere.gen.nz>, Lin Nah writes: >http://y3m.net/files/audio/telecom.fault.interview-2005-06-20.mp3 >http://y3m.net/files/audio/telecom.fault.weldon-2005-06-20.mp3 Thanks for recording these and making them available. The spin of both appears to be that this was an unforseeable event, which is difficult to accept. Unlikely, perhaps, but not unforseeable (imagine one break, then look for single points of failure that are exposed by that break). The stock exchange in particular appears not to have done a particularly thorough single-points-of-failure analysis, or deliberately chosen not to attempt to eliminate some of them. For instance it appears that they have a single transit provider, a single firewall, etc -- the failure of any of which will take them "off the air". The same appears to be true of many other systems, some of which can probably not afford to eliminate all the single points of failure (eg, EFTPOS in a small business, even small business DSL), and some of which probably should (eg, aircraft control). It's also a reminder that as much as a provider may claim n-9s reliability for their network, at some level using a single provider for all traffic still represents a single point of failure for your own infrastructure, however unlikely it might seem. Another completely independent provider at least gives you a statistically less correlated set of risk; although ensuring it's completely independent can be non-trivial. Still, given a 99.999% guarentee, and 4.5 hours of downtime (10:48 through 16:18), that means it'll be 4.5 hours / (1/100000) / 24 / 365.25 = 51.3 years until the next outage.... >Let's not forget that TelstraClear and many other ISPs in NZ resell >Telecom (either wholesale or UBS). TCL has patches of their own network >(eg Chch and wgtn are two examples). However the last mile home for >majority of NZers is still Telecom. The "last mile" isn't so much of a problem providing that the single-provider portion really is issolated to the "last mile". If the handoff of each of those "last mile" connections is fairly local to the users, and there's redundant, independent, backhaul from there to the other infrastructure, then a "core network" failure in one provider need not necessarily take out all those users. If there's only a single handoff between the provider and the reseller then obviously it's much more vulnerable as now much larger portions of the providers network must remain operational for those end users to stay working. Hopefully a single-point-of-failure analysis will guide a design which allows as much of the network to remain functional as possible even in the face of several failures. Andy's points of multiple network exchanges, in multiple locations, is of course one good mitigating strategy. Finally it's a reminder that sometimes having the "redundant" part of your network down requires high priority attention; your systems might still be working, but if you're now only one failure away from a total failure it's not a situation you want to be in for long. (From what I heard the first break in Telecom's situation occured yesterday, and was still being worked on today. Not fatal in itself, but without that failure still being present the hungry backhoe wouldn't have caused as much chaos.) Ewen

2 1

[Fwd: Re: [nznog] Outage update from Telecom]
by Mark Foster 19 Jun '05

19 Jun '05

[meant to send to all of list, sorry... redirected:] > So is this a good time to ask about the design of a network that concentrates > so much of its core service in Auckland? Is TelstraClear's network design any > better? > > How many regional providers were unable to talk to others in the same region > because everything (?) is hauled back to Auckland? > Before you follow this train of thought too far - reverse it. For arguements sake: I'm in Auckland, able to talk to the rest of the world - but nowhere south of Palmy. So what about things hauled back to Wellington? ;-) So the bigger picture question should be 'how many providers have sufficient redundancy to provide services in both locations independent of eachother for any given period?' Obviously theres some outages you just can't protect yourself from - but backup plans and DR plans should incorporate other means of getting info from A to B. Corporates etc with multiple offices can't just be dependant on their PON or DSL. They need to be prepared to make a point-to-point dialup, or an ISP dialup at both ends, in order to be able to communicate critical data at least. (How many companies build their SME LAN's behind a DSL link but business grinds to a halt when they can't get their email because the local exchange had a DSL whoopsie? How hard is it to keep a pay-per-hour dialup plan with an alternate ISP?) Ok, upscale slightly. Corporates and PON with big VPN/WAN environments get more complex. But there are ways. GPRS, Mobile Jetstream? Dialup again, with a VPN client? How many businesses retain 'manual' procedures? Fax machines? Fax-over-Cellular? With ISPs its obviously a different can of worms, but the easiest thing to do is to have what essentially translates into two datacentres - or options on two physically diverse routes to your main datacentre from the other. I don't know if theres enough diversity of choice in the market to let the end usr dictate much of this? The other consideration is that for some businesses - and some scales of bandwidth requirement - its not economical, nor feasible, to have a fully disaster-tolerant network. But its interesting to see how we function when the manure hits the turbine, and to see how many people have actually thought it through that far. Mark.

1 0

RE: [nznog] Outage update from Telecom
by Gavin Legge 19 Jun '05

19 Jun '05

likewise. wgtn-acld frame ckt up and running. -----Original Message----- From: Craig Humphrey [mailto:Craig.Humphrey.Work(a)paradise.net.nz] Sent: Monday, 20 June 2005 3:50 p.m. To: 'NZNOG List' Subject: RE: [nznog] Outage update from Telecom We're back too. _____ From: Drew.Collins(a)apn.co.nz [mailto:Drew.Collins(a)apn.co.nz] Sent: Monday, June 20, 2005 3:24 PM To: Juha Saarinen Cc: NZNOG List Subject: Re: [nznog] Outage update from Telecom We have some of our links coming back up at the moment. So hopefully TNZ has fixed some of the problems. -- This message has been scanned for viruses and dangerous content by <http://www.mailscanner.info/> MailScanner, and is believed to be clean. MailScanner thanks transtec <http://www.transtec.co.uk/> Computers for their support. Supplied by ITS-HelpDesk. ext 4001 helpdesk(a)irl.cri.nz

5 4