Re: Estonian IPv6 deployment report

2014-12-28 Thread Anders Löwinger
On 2014-12-27 17:27, Tarko Tikan wrote: > Split-horizon (switchport protected in Cisco world). Customers can't send > packets directly to each other, all communication has to go via BNG router. > Obviously we protect L2 as well like limiting number of MACs per customers, > make sure BNG MAC cannot

Re: Estonian IPv6 deployment report

2014-12-28 Thread Anders Löwinger
On 2014-12-27 17:37, Enno Rey wrote: > true, but some (most) of them only apply in networks where multicasting/ND is > fully supported which is not necessarily the case in the above type of > networks. Yes. I'm aware of the various types of solutions for security in IPv6 with shared VLANs. I was

Re: Estonian IPv6 deployment report

2014-12-28 Thread Tarko Tikan
hey, I assume you have a star-network below the BNG? Ie no rings or similar in the access network? Most of our network below BNG is MPLS, so no, it's not a star per say. But as PWs are point-to-point, you are technically correct. Below MPLS there is some ethernet too and this is all strictly

Re: merry xmas

2014-12-28 Thread Matthew Petach
On Wed, Dec 24, 2014 at 6:22 PM, Sadiq Saif wrote: > On 12/24/2014 20:52, Sadiq Saif wrote: > > > > Here is the IPv6 version: > > mtr xmas.asininetech.org > > > > Thanks to all the people who helped with the bit of python debugging. > > :) > > > > For those using traceroute6, try with the -I flag

Re: merry xmas

2014-12-28 Thread Sadiq Saif
On 12/28/2014 15:20, Matthew Petach wrote: > > What is this supposed -l flag? Linux traceroute6 > doesn't seem to have a -l flag: > It seems your version of traceroute6 is too old for the -I option. It is present in the version in Debian Wheezy. traceroute6 -V Modern traceroute for Linux, ve

Re: The state of TACACS+

2014-12-28 Thread Robert Drake
Picking back up where this left off last year, because I apparently only work on TACACS during the holidays :) On 12/30/2013 7:28 PM, Jimmy Hess wrote: Even 5 seconds extra for each command may hinder operators, to the extent it would be intolerable; shell commands should run almost instan

Re: The state of TACACS+

2014-12-28 Thread Christopher Morrow
On Sun, Dec 28, 2014 at 6:02 PM, Robert Drake wrote: > Picking back up where this left off last year, because I apparently only > work on TACACS during the holidays :) avoiding relatives? :) > > > On 12/30/2013 7:28 PM, Jimmy Hess wrote: >> >> Even 5 seconds extra for each command may hinder ope

Twitter contact

2014-12-28 Thread Chaim Rieger
Seems that your devices are set one year ahead. That is all

Re: Twitter contact

2014-12-28 Thread Marshall Eubanks
Twitter being twitter, there is no shortage of reports of this. http://www.neowin.net/news/twitter-bug-makes-tweets-look-old-wont-let-some-users-sign-in On Sun, Dec 28, 2014 at 10:26 PM, Chaim Rieger wrote: > Seems that your devices are set one year ahead. > > That is all >

Charter ARP Leak

2014-12-28 Thread Stephen R. Carter
Hello, I recently swapped out a home router for a SRX at home. Any charter techs able to take a look at the following? It looks like I am seeing some arp broadcast leaks towards my home router. Here is a small excerpt I am seeing. 06:04:04.760869 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethe

Re: The state of TACACS+

2014-12-28 Thread Jimmy Hess
On Sun, Dec 28, 2014 at 9:21 PM, Christopher Morrow wrote: > On Sun, Dec 28, 2014 at 6:02 PM, Robert Drake wrote: [snip] > Juniper, at least, does the authorization cache on the device trick... That seems nice... > and I wonder what percentage of 'users' a vendor has actually USE tac+ > (or even

Re: The state of TACACS+

2014-12-28 Thread Randy Bush
> Rfc6613: TLS or IPsec transport is shown as mandatory for RADIUS over TCP. sweet. can you ref conforming implementations? randy