Re: validating reachability via an ISP

2018-04-05 Thread Andy Davidson
On 29/03/2018, 00:22, Andy Litzinger wrote: > >> The root cause is that the our prefix is not being adequately >> re-distributed globally by the regional ISP. This is unexpected and we are >> working through this with them now. Hi, Andy — Are you failing to advertise it, or are they filter

Re: validating reachability via an ISP

2018-04-05 Thread Ben Bartsch
+1 for Route Explorer On Thu, Apr 5, 2018 at 2:49 AM, Andy Davidson wrote: > > > > > > On 29/03/2018, 00:22, Andy Litzinger > wrote: > > > >> The root cause is that the our prefix is not being adequately > >> re-distributed globally by the regional ISP. This is unexpected and we > are > >> wor

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread Merve Sahin
There is also Lenny : https://www.youtube.com/playlist?list=PLduL71_GKzHHk4hLga0nOGWrXlhl-i_3g And here is our paper on using chatbots against voice spam: https://www.usenix.org/conference/soups2017/technical-sessions/presentation/sahin It seems the future of voice spam will be the chatbots talki

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread Ca By
On Wed, Apr 4, 2018 at 4:19 PM Shawn L via NANOG wrote: > > Honestly, most carriers I've talked to are fed up as well, and just want > to find a way to make it stop. As some one said, it's exactly like BCP38 > --- the carriers that care keep their clients from spoofing caller id, > etc. The on

RE: Are any of you starting to get AI robocalls?

2018-04-05 Thread Naslund, Steve
If the scam caller is spoofing the numbers then I am not quite sure how T-Mobile can implement the block without blocking the legit owner of the number. The way to correct this as an industry is for them to inspect the caller-id coming in from their customer and if that customer does not own th

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread Dovid Bender
Steve, Any customer with a PBX has a valid reason to pass CLI that isn't theirs if they are passing through a call. Regards, Dovid   Original Message   From: snasl...@medline.com Sent: April 5, 2018 10:03 To: nanog@nanog.org Subject: RE: Are any of you starting to get AI robocalls? If the

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread William Herrin
On Thu, Apr 5, 2018 at 10:06 AM, Dovid Bender wrote: > Any customer with a PBX has a valid reason to pass CLI that isn't theirs if > they are passing through a call. Hi Dovid, For example, Vonage implementing Simultaneous Ring, you want to see the original caller id on your cell phone, not your

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread Brian Kantor
On Thu, Apr 05, 2018 at 10:20:29AM -0400, William Herrin wrote: > For example, Vonage implementing Simultaneous Ring, you want to see > the original caller id on your cell phone, not your vonage number even > though Vonage is bridging the call to your cell phone. > > More, the PBX may have trunks

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread Brian
On Thu, 2018-04-05 at 07:55 -0700, Brian Kantor wrote: > So the logical conclusion is that caller ID is useless as an > anti-vspam measure and the situation is hopeless, so the only > solution is to not personally answer the phone at all -- let voice > mail take a message. Pretty much. We've rece

Re: NG Firewalls & IPv6

2018-04-05 Thread Adam Kennedy via NANOG
We've been using DHCP-PD with Sophos SG/XG on a couple Comcast connections and it works fine. It will even go through all your firewall objects and automatically change the IPv6 prefix from the old to new if the prefix from PD changes. -- Adam Kennedy, Network & Systems Engineer adamkenn...@watc

Re: NG Firewalls & IPv6

2018-04-05 Thread Blake Hudson
I've used pfSense (BSD firewall) in a dual stack setup. Not all features are at parity with v4 (the captive portal doesn't support v6, for example), but the core features of stateful firewall, DHCPv6, etc seemed to work without any fuss. Joe Klein wrote on 4/2/2018 5:58 PM: > All, > > At security

Re: validating reachability via an ISP

2018-04-05 Thread Andy Litzinger
Hi Andy, The root cause was they regional ISP was failing to advertise my prefix due to a mistake in their export policy. While I'm glad we were able to figure out the issue I'm generally more interested in figuring out a way that I can programmatically monitor that my ISPs are providing me with

RE: Are any of you starting to get AI robocalls?

2018-04-05 Thread Naslund, Steve
There are plenty of ways to handle that. There are P-asserted identities that can be passed with the call in addition to the CLID. In SIP, there is also call history data that can give you all of the PBX hops identified. If a customer with a PBX wants to forward calls back into the PSTN then t

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread Dovid Bender
On Thu, Apr 5, 2018 at 11:12 AM, Brian wrote: > On Thu, 2018-04-05 at 07:55 -0700, Brian Kantor wrote: > > > So the logical conclusion is that caller ID is useless as an > > anti-vspam measure and the situation is hopeless, so the only > > solution is to not personally answer the phone at all --

RE: NG Firewalls & IPv6

2018-04-05 Thread Robert Webb
Really?? I was looking to install and use as a vm to test with and everything I was reading said it was not implemented and was not on the horizon. Only version I found from Sophos that was capable was the old Astaro version. I may have to take a second look. Do you have any links to the config

Re: NG Firewalls & IPv6

2018-04-05 Thread Keith Stokes
I’ve been using PfSense @ home dual-stack on Cox for a year or two. As far as I can tell any IPv6 problems are Cox issues. On Apr 5, 2018, at 12:12 PM, Blake Hudson mailto:bl...@ispn.net>> wrote: I've used pfSense (BSD firewall) in a dual stack setup. Not all features are at parity with v4 (th

Re: Are any of you starting to get AI robocalls?

2018-04-05 Thread HAL
I've worked at a telco for 15 years and I can say this problem is not going away anytime soon. The issue is the SS7 network that carriers use inherently trusts calls from long distance trunks without verification... I've analyzed incoming spoofed calls from our STP and they all come from foreign p

Re: Why doesn't "Cloudflare 1.1.1.1" compress root answers?

2018-04-05 Thread Anurag Bhatia
Hi Bjørn Never realised of such compression on answered. Is this is something well documented? Curious. Thanks for sharing. On Wed, Apr 4, 2018 at 1:30 AM, Bjørn Mork wrote: > At first I thought they had disabled compression: > > bjorn@miraculix:~$ dig . ns @1.1.1.1|grep SIZE > ;; MSG SIZ

Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Joseph Jenkins
I have cases open with both Cisco and Juniper on this, but wanted to see if anyone else had seen an issue like this because support has no idea. I have a Juniper QFX 5100 Core running in Virtual Chassis mode with 4 switches. I have 4 separate stacks of Cisco 3750 switches with 2x1GB uplinks bound

RE: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Robert Webb
I don't see any issue with the snippet of the config you provided for the "Firewall Port". Is there a chance that the port ge-0/0/67 is referenced somewhere else in the Juniper config that when applying your trunk setup is causing issues? Just throw that out off the top of my head and not reall

Re: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Hunter Fuller
On Thu, Apr 5, 2018 at 3:58 PM Joseph Jenkins wrote: > Mar 14 07:11:33: %PM-4-ERR_DISABLE: channel-misconfig (STP) error detected > on Po17, putting Po17 in err-disable state > We have to do this on all of our Cisco Port-channels that lead to Brocade ICX switches: no spanning-tree etherchannel g

Re: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Joseph Jenkins
No there isn't, but from what I am getting responses both onlist and off list is to just run this on the Cisco switches: no spanning-tree etherchannel guard misconfig and that should resolve the issue. Thanks Everyone. On Thu, Apr 5, 2018 at 2:10 PM, Robert Webb wrote: > I don't see any issue

RE: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Naslund, Steve
I am kind of confused by your configuration. If the Cisco side is configured as LACP trunk, then the Juniper side also needs to be configured as LACP trunks. Spanning-tree would be getting confused because the Cisco is treating the LACP trunk as a single interface for purposes of spanning-tree

RE: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Naslund, Steve
It really does not resolve anything it just allows a bad configuration to work. The guard is there so that if one side is configured as a channel and the other side is not, the channel gets shut down. Allowing it to remain up can cause a BPDU loop. Your spanning tree is trying to tell you som

Re: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Joseph Jenkins
Steve let me clarify the config I am applying has nothing to do with an LACP trunk or any of my existing LACP trunks. It is a completely different configuration on a completely different interface, the only similarity is that I am trying to configure a trunk interface on the Juniper side for multip

Re: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Joseph Jenkins
This are also no new vlans being used at all. They are all already existing on the switches involved and nothing is being added. In fact what makes this even weirder is that I already have that exact same port configuration running on port 1/0/67 of the Juniper and it doesn't cause me any issues no

RE: Juniper Config Commit causes Cisco Etherchannels to go into err-disable state

2018-04-05 Thread Naslund, Steve
Got it. Do any of those trunks add a new VLAN to the switch that was not active before? If so, that would cause a BPDU over all trunks that allow that VLAN. Even if the port is not up yet, by adding the VLAN to ANY trunk you are implying that it should be active on ALL trunks that are not VLA

Re: Why doesn't "Cloudflare 1.1.1.1" compress root answers?

2018-04-05 Thread Jared Mauch
Yes.. Check 4.1.4 of https://www.ietf.org/rfc/rfc1035.txt > On Apr 5, 2018, at 4:22 PM, Anurag Bhatia wrote: > > Hi Bjørn > > > Never realised of such compression on answered. Is this is something well > documented? Curious. > >

Re: Why doesn't "Cloudflare 1.1.1.1" compress root answers?

2018-04-05 Thread Bjørn Mork
Anurag Bhatia writes: > Never realised of such compression on answered. Is this is something well > documented? Curious. https://tools.ietf.org/html/rfc1035#section-4.1.4 Bjørn