September 2017 - NLNOG - mailman3.nlnog.net

piratebay blocking for Ziggo and XS4ALL
by Job Snijders 22 Sep '17

22 Sep '17

Hi team, Seems like a (hopefully temporary?) set back :( https://blog.xs4all.nl/rechter-website-opnieuw-blokkeren/ https://tweakers.net/nieuws/129925/ziggo-en-xs4all-moeten-the-pirate-bay-we… Kind regards, Job

1 0

Fwd: Sideloading RFC 8212 on Junos
by Job Snijders 20 Sep '17

20 Sep '17

Beste mensen, Als je Juniper routers voor EBGP sessies raad ik je aan om dit SLAX script te laden om te beschermen tegen oepsies! Wat dit script doet is automatisch een "deny-any" policy op EBGP sessies zetten waar geen import of export policy gezet is. Dus mocht je om wat voor reden dan ook per-ongeluk geen policies definieren dan zal dit script er voor zorgen dat je niet een full table leaked of accept. Groeten, Job ---------- Forwarded message ---------- From: Job Snijders <job(a)ntt.net> Date: Tue, Sep 19, 2017 at 11:14 PM Subject: Sideloading RFC 8212 on Junos To: "nanog(a)nanog.org" <nanog(a)nanog.org> Dear all, Adam Chappell created an interesting shim to improve the default behaviour related to EBGP Internet routing on Juniper Junos. https://twitter.com/ packetsource/status/910219911150080007 SLAX script here: https://github.com/packetsource/rfc8212-junos Props to both Adam for creating the script and to Juniper for allowing such permissionless patching! This is cool. Kind regards, Job

1 0

[matt.larson@icann.org: Operational message: DNS root zone KSK rollover to occur on October 11, 2017 at 1600 UTC]
by Job Snijders 17 Sep '17

17 Sep '17

NLNOG community - FYI ----- Forwarded message from Matt Larson <matt.larson(a)icann.org> ----- Date: Fri, 15 Sep 2017 15:54:02 +0000 From: Matt Larson <matt.larson(a)icann.org> To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: Operational message: DNS root zone KSK rollover to occur on October 11, 2017 at 1600 UTC The root zone management partners, ICANN and Verisign, are working together to change the DNS root zone's key-signing key (KSK). This process is referred to as "rolling" the root zone KSK. The root zone's apex DNSKEY RRset has been signed with the same KSK, known as KSK-2010, since the root zone was first signed in July, 2010. On October 11, 2017, at approximately 1600 UTC, the root zone will be published with the apex DNSKEY RRset signed for the first time with a new KSK, known as KSK-2017. The root zone apex DNSKEY RRset will be signed with only KSK-2017 going forward. While the specific date of the KSK rollover, October 11, 2017, had been announced previously, the time of 1600 UTC on that day has not been announced until now, which is the primary purpose of this message. The public portion of the root zone KSK is configured as a trust anchor in software performing DNSSEC validation. The configuration of any software performing DNSSEC validation will need to be updated to reference KSK-2017 on or before October 11, 2017, or all DNS responses received by that software will fail DNSSEC validation, resulting ultimately in error messages to end users. In many cases, software performing DNSSEC validation supports "Automated Updates of DNS Security", the protocol defined in RFC 5011 that can automatically update a DNSSEC validator's trust anchor configuration. If the software does not support this protocol, or it is incorrectly implemented or not configured correctly, the trust anchor will need to be updated manually. Anyone operating software performing DNSSEC validation with the root zone KSK configured as a trust anchor must take action on or before October 11, 2017, to confirm that their software is configured with KSK-2017 as a trust anchor and, if not, take the necessary steps to update the configuration. Further information about the root KSK rollover, including information about how to check and update the trust anchor configuration of popular recursive resolver implementations that support DNSSEC validation, is available at https://icann.org/kskroll. For the root zone management partners, Matt Larson VP of Research, ICANN Duane Wessels Distinguished Engineer, Verisign ----- End forwarded message -----

1 0

NLNOG day 2017 videos
by Job Snijders 11 Sep '17

11 Sep '17

Good news everyone! The NLNOG day 2017 videos have been cut & sliced and are available on youtube! All slidedeck material and video links can be found on the NLNOG day 2017 page: https://nlnog.net/nlnog-day-2017/ Enjoy! :-) Kind regards, Job

1 0

Vragen graceful shutdown
by Cybertinus 09 Sep '17

09 Sep '17

Hallo allen, Gisteren bij het praatje van Job over Graceful Shutdown zei hij dat je de preference zo laag mogelijk moet zetten om aan te geven dat de route weg gaat. Waarom pas je de sessie dan niet aan dat er geen routes meer geexporteerd en geimporteerd worden erheen? Dan geef je aan dat er geen routes meer te vinden zijn op die session, ipv dat er wel routes te vinden zijn maar dat ze niet gebruikt moeten worden. Is dit niet een net iets effectievere manier om het verkeer weg te krijgen? Verder: Hij zei dat je enkele minuten moet wachten tussen het zetten van de community en het daadwerkelijk shutten van de sessie. Is het niet beter om te wachten totdat het verkeer daadwerkelijk weg is van de link? Dus dat je naar mbps over de link kijkt ipv naar minuten. Dat lijkt mij een betrouwbaardere methode om te weten of het verkeer weg is dan tijd :). Er werd 300 secs (5 minuten) voorgesteld als acceptabele wachttijd, maar de MX5 bij Coloclue deed er soms al 20 minuten over om dergelijke updates te verwerken. Dan heb je dus nog steeds packetloss. Met vriendelijke groet, Cybertinus

2 1

NLNOG day 2017 livestream
by Job Snijders 08 Sep '17

08 Sep '17

Hi everyone, For those that can't attend in person today, the NLNOG livestream is available here: https://www.youtube.com/watch?v=l5xQPir3yec Shoutout to Triple (wearetriple.com) for organizing the livestream! Kind regards, Job

1 0