Re: External BGP Controller for L3 Switch BGP routing

2017-01-17 Thread Phil Bedard
Cisco and Arista are both able to squeeze a current full Internet table into the base space on their Jericho boxes, using the right space partitioning. Cisco added this in 6.1.2 without anything in the release notes, but you’ll notice they bumped the datasheet spec on the base 5502 to 1M FIB

Re: Questions on IPv6 deployment

2017-01-17 Thread William Herrin
On Mon, Jan 16, 2017 at 10:11 AM, Matthew Crocker wrote: > I’m looking for some direction/reading list of how to properly configure > IPv6. I’ve read to use a /64 for PtP interfaces and I’ve read use a /128 > instead.Assign all loopbacks from the same /64, use a different /64 for > each lo

Re: BGP Route Reflector - Route Server, Router, etc

2017-01-17 Thread Phil Bedard
Cisco and Juniper both have working ORR implementations, although config on the Juniper one is a bit clunky right now. One interesting thing is they also allow feeding topology data via BGP-LS, so BGP is the only protocol you need to run to/from it. Phil -Original Message- From: NA

Re: Questions on IPv6 deployment

2017-01-17 Thread Sander Steffann
Hi, > Suggest /128's for loopbacks and /124's for point to points, all from > the same /64. This way you don't burn space needlessly, don't open > yourself to neighbor discovery issues on point to points I usually reserve one /64 for loopbacks, reserve a /64 per point-to-point connection and con

Re: Questions on IPv6 deployment

2017-01-17 Thread Michael Still
Hi, a few years back some in the community got together to write this: On Mon, Jan 16, 2017 at 10:11 AM, Matthew Crocker wrote: > > Hello, > > I’m AS7849 and I have an IP problem. > > I’m running IPv4 ( /16 legacy + /20) and have enough space to last me for > a while, multi-homed, BGP4 full tab

Re: Questions on IPv6 deployment

2017-01-17 Thread Michael Still
Oops: http://nabcop.org/index.php/IPv6_Subnetting On Tue, Jan 17, 2017 at 12:48 PM, Michael Still wrote: > Hi, a few years back some in the community got together to write this: > > On Mon, Jan 16, 2017 at 10:11 AM, Matthew Crocker < > matt...@corp.crocker.com> wrote: > >> >> Hello, >> >> I’m A

Re: Questions on IPv6 deployment

2017-01-17 Thread William Herrin
On Tue, Jan 17, 2017 at 12:48 PM, Michael Still wrote: > http://nabcop.org/index.php/IPv6_Subnetting That's overall good advice. I quibble with a couple of points: 1. If you plan to use a /126 on a point to point and can't imagine how you would use a /64 on that point to point, don't allocate a

RE: Questions on IPv6 deployment

2017-01-17 Thread Matthew Huff
The reason for allocating a /64 for a point to point link is due to various denial of service attack vectors. Just do it. The numbers in IPv6 are staggering. The generally accepted best practice is to allocate a /64 and use a /128 within that /64 for point to point links. Matthew Huff 

Re: Questions on IPv6 deployment

2017-01-17 Thread Owen DeLong
I think you mean /127 since a /128 would not support 2 points on the point to point. Owen > On Jan 17, 2017, at 13:07 , Matthew Huff wrote: > > The reason for allocating a /64 for a point to point link is due to various > denial of service attack vectors. Just do it. The numbers in IPv6 are

Re: Questions on IPv6 deployment

2017-01-17 Thread William Herrin
On Tue, Jan 17, 2017 at 4:07 PM, Matthew Huff wrote: > The reason for allocating a /64 for a point to point link is due to various > denial of service attack vectors. Hi Matthew, I'm always interested in learning something new. Please explain the DOS vectors you're referring to and how they're

Re: Questions on IPv6 deployment

2017-01-17 Thread joel jaeggli
On 1/17/17 1:55 PM, William Herrin wrote: > On Tue, Jan 17, 2017 at 4:07 PM, Matthew Huff wrote: >> The reason for allocating a /64 for a point to point link is due to various >> denial of service attack vectors. if you mean allocating a /127, then... sure. Neighbor discovery on point to point

RE: Questions on IPv6 deployment

2017-01-17 Thread Matthew Huff
Please check the nanog archives. There were some arguments that I and I assume others felt compelling why allocating a /64 per point to point link was a good idea. Your network, your rules. I was just responding to the argument that a /64 is wasteful and serves little purpose. Matthew Huf

Re: Questions on IPv6 deployment

2017-01-17 Thread Sander Steffann
Hi Bill, > Op 17 jan. 2017, om 22:55 heeft William Herrin het volgende > geschreven: > > I'm always interested in learning something new. Please explain the > DOS vectors you're referring to and how they're mitigated by > allocating a /64 to the point to point link. One thing that comes to min

Re: Safe IPv4 Was: Re: premiumcolo.net IP address rental

2017-01-17 Thread Martin Hannigan
On Mon, Jan 9, 2017 at 2:34 PM, Robert Story wrote: > On Mon, 9 Jan 2017 13:40:23 -0500 Martin wrote: > MH> 2. Apply for and receive a last /22 from RIPE. EVERYONE can do this. > > Not quite everyone. You have to be a RIPE NCC member, which not everyone > can do. > > "Who can become a Local Inter

Re: Questions on IPv6 deployment

2017-01-17 Thread William Herrin
On Tue, Jan 17, 2017 at 6:06 PM, Sander Steffann wrote: > One thing that comes to mind is that it seems that some routers only have > limited space in their routing tables for prefixes longer than a /64. If you > would configure a /127 on the link but push the /64 to the routing table then > yo

Re: Questions on IPv6 deployment

2017-01-17 Thread William Herrin
On Tue, Jan 17, 2017 at 5:13 PM, Matthew Huff wrote: > Please check the nanog archives. > I was just responding to the argument that a /64 is wasteful and serves > little purpose. Then respond. With explanation, reasoning and evidence. Telling me to search a massive archive for nebulous discussi

DNS CAA records...

2017-01-17 Thread Eric Tykwinski
So I’ve come across this on Qualys and just wondering if there’s any practical examples out there in the wild. I know some BIND guys are on here, so I’m sure I’m missing something from the RFCs. Just wanted to test this out on my play domains before putting it out in the wild... Sincerely, Eri

Level3 Internet service, out of order packets causing issues

2017-01-17 Thread Mark Wicker
Hi, I have 1G Level3 ethernet dedicated internet service as one of my ISP's at my company based in the Los Angeles (Inland Empire) area. After seeing strange application behavior while using this circuit, I failed it out of service and have been troubleshooting it with a directly connected mach

Common Reliable Out Of Band Management Options at Carrier Hotels

2017-01-17 Thread Darin Herteen
Greetings list, We are exploring standardizing our Out Of Band options across our network and various off-net locations and the question was brought up "What about carrier hotels? What constraints might present themselves at those locations?" Assuming each hotel we are located in can provide

Anyone from Frontier? Reachability Issues to AS5650

2017-01-17 Thread Matt Peterman
Hello all! I have been unable to find a good contact for Frontier’s NOC, so I am hoping to have success here. I have reached out to the listed contacts in AS5650’s ARIN record to no avail. I am having issues reaching seemingly all IPs announced from AS5650. I am an AT&T customer with IP block

Re: DNS CAA records...

2017-01-17 Thread Nolan Berry
So a quick look into this I see one potential real world example: ;; ANSWER SECTION: google.com.129INA216.58.218.142 google.com.74411INNSns4.google.com. google.com.74411INNSns1.google.com. google.com.74411INNSns2.goog

Re: DNS CAA records...

2017-01-17 Thread Royce Williams
On Tue, Jan 17, 2017 at 3:04 PM, Eric Tykwinski wrote: > So I’ve come across this on Qualys and just wondering if there’s any > practical examples out there in the wild. > I know some BIND guys are on here, so I’m sure I’m missing something from the > RFCs. > Just wanted to test this out on my p

Re: Level3 Internet service, out of order packets causing issues

2017-01-17 Thread Jason Rokeach
Hi Mark, I'm going to throw out a guess here. By any chance, is the first octet of your router's MAC address a 4 or a 6? In general, modern routers do not load balance per-packet, which is what caused out-of-order issues in days gone. Load balancing is usually done based on a hash of the source a

Re: Level3 Internet service, out of order packets causing issues

2017-01-17 Thread Jason Rokeach
Hi Mark, I'm going to throw out a guess here. By any chance, is the first octet of your router's MAC address a 4 or a 6? In general, modern routers do not load balance per-packet, which is what caused out-of-order issues in days gone. Load balancing is usually done based on a hash of the source a

Re: DNS CAA records...

2017-01-17 Thread Mark Andrews
Or use up-to-date code. CAA support was added in BIND 9.8.8 (already end of lifed), BIND 9.9.6, BIND 9.10.1 and BIND 9.11.0. [rock:~/git/bind9] marka% dig caa google.com ;; BADCOOKIE, retrying. ; <<>> DiG 9.12.0-pre-alpha+hotspot+add-prefetch+marka <<>> caa google.com ;; global options: +cmd ;;