Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-07 Thread Mark Tinka
On Wednesday 04 February 2009 10:10:02 am Steve Bertrand wrote: > I'm not ready for MPLS (but I am interested in the theory > of it's purpose), so when I'm done what I'm doing now, > I'll look at it. Well, having a v6 core will prevent from you running MPLS, as a v6 control plane for MPLS is no

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-07 Thread Mark Tinka
On Wednesday 04 February 2009 09:51:16 am Nathan Ward wrote: > You get the same with OSPF - you run OSPFv2 and OSPFv3 in > parallel. Suffice it to say that some vendors are already implementing 'draft-ietf-ospf-af-alt-06.txt', which allows OSPFv3 to handle multiple address families, including I

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-06 Thread Nathan Ward
On 7/02/2009, at 5:20 AM, Brad Fleming wrote: On Feb 4, 2009, at 2:52 AM, Steve Bertrand wrote: http://tools.ietf.org/html/draft-kumari-blackhole-urpf-02 If I understand this correctly, there will be a route entered on each edge router for all sources that are participating in a DDoS

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-06 Thread Brad Fleming
On Feb 4, 2009, at 2:52 AM, Steve Bertrand wrote: http://tools.ietf.org/html/draft-kumari-blackhole-urpf-02 If I understand this correctly, there will be a route entered on each edge router for all sources that are participating in a DDoS attack. Is anyone worried about TCAM usage if on

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-05 Thread Michael Butler
Steve Bertrand wrote: > This entire discussion went off topic, in regards to bcp and filtering. > > Off-list, I had someone point out: > > http://tools.ietf.org/html/draft-kumari-blackhole-urpf-02 > > ...which is EXACTLY in line with what my end goal was originally, and by > reading it, I feel a

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-05 Thread Steve Bertrand
> On 4/02/2009, at 2:43 PM, Steve Bertrand wrote: > >> Nathan Ward wrote: >>> On 4/02/2009, at 2:33 PM, Steve Bertrand wrote: >>> - Currently, (as I write), I'm migrating my entire core from IPv4 to IPv6. I've got the space, and I love to learn, so I'm just lab-ing it up now to

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-04 Thread Bill Stewart
On Tue, Feb 3, 2009 at 5:43 PM, Steve Bertrand wrote: > What I was hoping for (even though I'm testing something that I know > won't work) is that I can break something so I could push v4 traffic > over a v6-only core. > > Is there _any_ way to do this (other than NAT/tunnel etc)? If you can push

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-03 Thread Steve Bertrand
Skeeve Stevens wrote: > Agreed. Keeping it separate works very well. Can be the same interface > sure... but do it as a separate session. Yeah, that's what I thought, and that is exactly what I've been doing thus far. I was hoping to have a v6-only core, but in order to get the current project

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-03 Thread Nathan Ward
On 4/02/2009, at 2:43 PM, Steve Bertrand wrote: Nathan Ward wrote: On 4/02/2009, at 2:33 PM, Steve Bertrand wrote: - Currently, (as I write), I'm migrating my entire core from IPv4 to IPv6. I've got the space, and I love to learn, so I'm just lab-ing it up now to see how things will flow w

RE: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-03 Thread Skeeve Stevens
Agreed. Keeping it separate works very well. Can be the same interface sure... but do it as a separate session. ...Skeeve -Original Message- From: Nathan Ward [mailto:na...@daork.net] Sent: Wednesday, 4 February 2009 12:40 PM To: nanog list Subject: Re: [Update] Re: New ISP to market

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-03 Thread Steve Bertrand
Nathan Ward wrote: > On 4/02/2009, at 2:33 PM, Steve Bertrand wrote: > >> - Currently, (as I write), I'm migrating my entire core from IPv4 to >> IPv6. I've got the space, and I love to learn, so I'm just lab-ing it up >> now to see how things will flow with all iBGP v4 routes being >> advertised/

Re: [Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-03 Thread Nathan Ward
On 4/02/2009, at 2:33 PM, Steve Bertrand wrote: - Currently, (as I write), I'm migrating my entire core from IPv4 to IPv6. I've got the space, and I love to learn, so I'm just lab-ing it up now to see how things will flow with all iBGP v4 routes being advertised/routed over v6. Don't adver

[Update] Re: New ISP to market, BCP 38, and new tactics

2009-02-03 Thread Steve Bertrand
For all the kind folk who have been asking how my project is going, I'll summarize here. - I've enabled strict uRPF filtering on all interfaces that I am certain what the source will be. - I've implemented a mix of loose uRPF combined with ACL's on interfaces that I know have multi-homed clients

Re: New ISP to market, BCP 38, and new tactics

2009-01-29 Thread Steve Bertrand
Raoul Bhatia [IPAX] wrote: > hello steve, > > Steve Bertrand wrote: >> I've done much research on RPSL, BCP 38, and other basic filter methods >> (and from a systems standpoint, I always follow an >> allow,allow,default-deny approach) , and I am willing to follow all >> standards and recommended