swinog

swinog@lists.swinog.ch

1 participants
2934 discussions

Securing Cisco Routers in a ISP network (management-plane?)
by Marco Fretz 31 Jul '08

31 Jul '08

Hi everyone, I'm preparing my routers for IPv6. Along with v6 support comes the requirement to secure router management / services for v6. Currently I've inbound access-lists on all inbound interfaces blocking management traffic (ssh, telnet, ftp, http, etc.) and things like SIP, etc. to all router v4 addresses. You can imagine that this a lot of maintenance work. So my idea was to use the new management-plane (control-plane) protection in IOS 12.4 T. http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htsecmpp.html Is there anyone using this already in ISP networks? What are the experience? You can define a loopback interface as management-interface and propagate the loopback addresses with IGP inside the management network. After that, all other interfaces are no longer accepting management traffic to the control-plane, right? Setting an inbound access-list on the loopback interface to filter management traffic may be a good idea, right? Is there any impact to BGP sessions? I sill need access-lists dropping BGP traffic to my router addresses and explicit allowing my bgp peers, right? Any suggestions / ideas welcome. Thanks and best regards Marco

1 0

SwiNOG-BE64 - Beer Event 64 - 4th of August 2008 @ Juan Costa / Huerlimannplatz / ZH
by Steven.Glogger＠swisscom.com 30 Jul '08

30 Jul '08

hi everybody well... new beer event, new location. please register asap ,-) the facts for the next event: ----------------------------- Date: 4th of August 2008 Time: starting around 18.30 o'clock Location: @ the "Juan Costa" beside HuerlimannPlatz / Google www.juancosta.ch -> HuerlimannPlatz Registration deadline: 02.08.2008 18:00:00 Registration: ------------- Please register here: http://swinog.mrmouse.ch/ since we have to make reservations, i need to know who's coming and who not. If you cannot attend and you're registered please inform me asap. if you cannot find us: call me on my mobile: +41 79 277 92 35. greetings -steven

1 0

Juniper & VPN to a dyndns site
by Josh Geisser 25 Jul '08

25 Jul '08

Hi Swinog I've noticed that quite a few Firewalls don't support VPN to a DNS name as peer, so you'll have to enter the remote IP , and better having a fixed IP on the remote site :) Does anyone know whether it's possible to enter a dyndns record as remote side on a Juniper Firewall? Cheers Josh

3 4

2008 Infrastructure Security Survey
by Danny McPherson 25 Jul '08

25 Jul '08

Folks, The 2008 Infrastructure Security Survey is up and available for input. You can register to complete the survey at this URL: <https://www.tcb.net/survey/index.php?sid=19672&lang=en> I've added many questions this time from past participants of the survey, this should be evidenced throughout. Thanks to all those that reviewed and provided questions explicitly for this edition. The survey response window will be ~2 weeks. We hope to make the results available by the end of September at the latest. Also, please recall that NO personally (or organizationally) identifiable information will be shared in any manner. The 2007 edition of the survey is available here: <http://www.tcb.net/wisp07.pdf> Or on the Arbor web site (reg required): <http://www.arbornetworks.com/report> Thanks in advance for your participation! -danny

1 0

This is what Linus Torvalds calls OpenBSD crowd ...
by Marco Fretz 23 Jul '08

23 Jul '08

... a bunch of masturbating monkeys Hi SwiNOGers, For all of you interested in OpenBSD (or Linux) have a look at this funny story i found at the openbsd-misc list. Its about bug / security fixing in Linux vs OpenBSD :-) http://article.gmane.org/gmane.linux.kernel/706950 and the spunky shirts / cups: http://www.cafepress.com/spankymm Read the full story here: http://www.mail-archive.com/misc@openbsd.org/msg64301.html Greets Marco

3 3

Anthony Drozdek is out of the office
by Anthony Drozdek 18 Jul '08

18 Jul '08

I will be out of the office starting 18.07.2008 and will not return until 12.08.2008. I will reply to your message when I return. If you need immediate assistance please email Abdel Houdaf - abdel.houdaf(a)tele2.com

1 0

Firewall recommendation for a rack of webservers?
by Olivier Mueller 18 Jul '08

18 Jul '08

Hello, Now that the office firewall is running fine (uptime: 34 days, not a single problem since last month, cf. the "VDSL/Zyxel P2802 HWL not "strong" enough for a small company LAN?" thread), I'm now back, looking for a new kind of firewall :) For a specific project with it's own rack @datacenter, I would need a device to "protect" about 10 web-servers: - deny everything, and then - allow web traffic (80/443) from everywhere -> servers - allow administrative (sftp/ssh) traffic from specific IP's - ability to detect http-based "attacks/ddos" (like bad configured spidering) : if there are too many http requests from specific hosts -> throttle/deny access for some time. I guess it's something which should be implemented on application level, but who knows... ? - bandwidth: average: 5Mbit/s, peaks: 10-15Mbit/s - stable, reasonable price... (max 1-3kChf?) - rackmount Under digitec.ch ( http://www.digitec.ch/ProdukteAuswahl2.aspx?knr=490 ) as a start there are 9 "Rackmount" FW's. But most of them are VPN-oriented, with IpSec-Tunnels, SSL-Tunnels, etc: mostly stuff which is expensive and that I really don't need. Is there anything you can recommend in this case? It if was only me, I would take something there: http://pfsense.org/index.php?option=com_content&task=view&id=44&Itemid=50 and start with that. But the customer would also like to see some "non open-source"-based solutions... :> Regards, Olivier

12 17

netflow capable switches
by julien mabillard 18 Jul '08

18 Jul '08

Hi, this might be a naive question but still needs a good answer ;-) Are there ethernet switches else as cisco that can provide netflow traffic informations? Or do they use snmp for the same informations instead? thank you. --

4 3

bittorent on bluewin ADSL trigger 30% large frame drop
by Zorg 421 17 Jul '08

17 Jul '08

Hello the list, I have a strange occurance of a bluewin ADSL connection on which, if you start a bittorent doing some p2p activity, the second node in bluewin network start to drop large (1000-1400B) frames at a rate of 30-35% ! Amazed what the heck can trigger that ! (the bittorent is shaped at 120kB down / 20 kB up, it's not congesting the link) Anyone already something like this? -- zorglub421 http://helvetic-park.blogspot.com

3 3

name-server slowdown?
by Per Jessen 16 Jul '08

16 Jul '08

Starting Monday this week, we've seen a significant delays and timeouts on our upstream name-servers. We saw something similar on our Hetzner servers, but it seems to have gone away now. Has anyone else seen/experienced name-server issues in the last 2-3 days? I know about the BIND patch from last week, could that somehow be involved? /Per Jessen, Herrliberg

5 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog