<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">W dniu 2014-03-12 09:25, Michael J.
Gage pisze:<br>
</div>
<blockquote
cite="mid:D20A3427057B584DB4193D27EAD39D51016C6B130F@exch-2010.localtel.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I have had several colleges recently ask me
for things I have done in my own network and if it could
benefit theirs.<o:p></o:p></p>
<p class="MsoNormal">With the rise of problems on the internet
and so many networks lacking security, I wanted to get some
community opinions about security measures that you have found
beneficial for your Redback routers.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please share your experiences and advice
but remember not to divulge information about your networks
that could be used maliciously.
<o:p></o:p></p>
<p class="MsoNormal">I am trying to get some feedback as well as
share information across the community to help make all of our
networks safer and more reliable.<o:p></o:p></p>
<p class="MsoNormal">If you would like information on
administrative ACLs, I can help you privately.<o:p></o:p></p>
<p class="MsoNormal">To be clear, my focus is on customer data
flow and not local security policies.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I understand that traffic policies and
network security is something that most administrators are
reluctant to share.<o:p></o:p></p>
<p class="MsoNormal">I would be happy to post information back
to the community on behalf of individuals who would like to
remain anonymous.<o:p></o:p></p>
<p class="MsoNormal">My goal is to help the administrators
within the community who have needs or may not know that they
have needs.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Michael<o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
redback-nsp mailing list
<a class="moz-txt-link-abbreviated" href="mailto:redback-nsp@puck.nether.net">redback-nsp@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/redback-nsp">https://puck.nether.net/mailman/listinfo/redback-nsp</a>
</pre>
</blockquote>
Hello Michael,<br>
<br>
We were talking with Ozga Rafal and Marcin Kuczera about security
problems last time.<br>
<br>
We have problem with strange floods on broadcast addresses of IP
subnet that is active on RB.<br>
<br>
As Rafal advice we did a test today - by sending 1Gb/s flood to
random broadcast address on RB.<br>
<br>
We lost connection to RB, lost snmp connection and radius
connections, and bgp sessions<br>
<br>
<br>
Mar 12 08:35:32: %LM-3-ERR: Receiving interface for Ping/Traceroute
request not located<br>
Mar 12 08:35:35: %SYSLOG-6-INFO: aaad: Radius Auth srv
192.168.89.8/1812 (1812) no response in 259 sec. (user
00:13:49:6a:ee:a5).Marked dead<br>
<br>
Mar 12 08:43:25: [0002]: %BGP-6-INFO: x.x.x.x DOWN - Notification
sent<br>
Mar 12 08:43:25: [0002]: %BGP-6-INFO: x.x.x.x send NOTIFICATION: 4/0
(hold time expired) with 0 byte data. mxReadMs=61097<br>
<br>
<br>
That makes RB isolate from network and unusable <br>
<br>
This problem appears on 6.2.1.9 SEOS and 12.x SEOS.<br>
<br>
Rafal has found solution and I think it would share it to community.
<br>
<br>
There is no solution or we don't know the solution like - one
command.<br>
<br>
Best regards<br>
<br>
Dariusz Siedlecki<br>
<br>
<br>
</body>
</html>