Re:Internet access using VRF aware NAT

[Shivlu Jain <shivlu.jain () gmail com>]

Hi Devang

We are using the vrf nat where the customer demands the firewall services.
For implementing this we are advertising a default route and vrf nat is used
per VPN basics.This is the rate services in case of whole sale.
Actual implementation; we are creating a INTERNET VRF which is having a
default route; In customer vrf the RT of internet route is imported and vrf
is able to get the default route. For reverse traffic a ipv4 route is added
at the PE towards customer interface.

regards
shivlu jain

On Fri, Feb 27, 2009 at 10:17 AM, <nanog-request () nanog org> wrote:

> Send NANOG mailing list submissions to
>        nanog () nanog org
>
> To subscribe or unsubscribe via the World Wide Web, visit
>        http://mailman.nanog.org/mailman/listinfo/nanog
> or, via email, send a message with subject or body 'help' to
>        nanog-request () nanog org
>
> You can reach the person managing the list at
>        nanog-owner () nanog org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of NANOG digest..."
>
>
> Today's Topics:
>
>   1. RE: Documentation of switch maps (Gregory Boehnlein)
>   2. Re: Yahoo and their mail filters.. (Marshall Eubanks)
>   3. Re: Documentation of switch maps (Adam Armstrong)
>   4. Internet access using VRF aware NAT (devang patel)
>   5. Re: Yahoo and their mail filters.. (J.D. Falk)
>   6. Re: Yahoo and their mail filters.. (Carl Ford)
>   7. Re: Yahoo and their mail filters.. (J.D. Falk)
>   8. Re: Yahoo and their mail filters.. (Suresh Ramasubramanian)
>   9. Re: Yahoo and their mail filters.. (Brian Keefer)
>  10. Re: Yahoo and their mail filters.. (Jo Rhett)
>  11. Road Runner DNS servers (Ricardo Oliveira)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 26 Feb 2009 14:20:07 -0500
> From: "Gregory Boehnlein" <damin () nacs net>
> Subject: RE: Documentation of switch maps
> To: "'Bielawa, Daniel W. \(NS\)'" <dwbielawa () liberty edu>,
>        <nanog () nanog org>
> Message-ID: <02bd01c99847$3c48e540$b4daafc0$@net>
> Content-Type: text/plain;       charset="us-ascii"
>
> Man.. I'd love to have this for Netgear switches! :)
>
> > -----Original Message-----
> > From: Bielawa, Daniel W. (NS) [mailto:dwbielawa () liberty edu]
> > Sent: Thursday, February 26, 2009 2:07 PM
> > To: nanog () nanog org
> > Subject: RE: Documentation of switch maps
> >
> > Hello,
> >
> >         We use switchmap here for tracking port utilization, days
> > inactive, and devices connected. It uses SNMP to determine the
> > information.
> >
> > http://switchmap.sourceforge.net/
> >
> > Thank You
> >
> > Daniel Bielawa
> > Network Engineer
> > Liberty University Information Services
> >
> > -----Original Message-----
> > From: Blake Pfankuch [mailto:bpfankuch () cpgreeley com]
> > Sent: Thursday, February 26, 2009 2:01 PM
> > To: nanog () nanog org
> > Subject: Documentation of switch maps
> >
> > Howdy.
> >
> > Had a customer come to me this morning who wanted to create a document
> > for their switching infrastructure and thought I would bounce it off
> > the rest of the world on how you usually do this.  Typically I use a
> > spreadsheet with outlines to define the "switch" and then outlines for
> > the ports and color coding for vlan's as well as a description of the
> > port.  Curious what other people are doing, as this would be a huge
> > undertaking for a customer who is using an entire /19 of rfc 1918 ip
> > addresses and has well over 150 switches and 40 active vlans.  The want
> > to be able to look at this document and pull up any switch and look at
> > the port and be able to see what vlan the port is on, as well as what
> > device it is connected to as well as port channel membership, trunks
> > and other fun things like that.  Needless to say their documentation is
> > lacking on the physical connectivity however their cisco infrastructure
> > does have labels on every port that goes to a named device outside of
> > the DHCP pools.  Thoughts?
> >
> > Thanks,
> > Blake Pfankuch
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by N2Net Mailshield, and is
> > believed to be clean.
>
>
>
>
>
> ------------------------------
>
> Message: 2
> Date: Thu, 26 Feb 2009 17:06:41 -0500
> From: Marshall Eubanks <tme () multicasttech com>
> Subject: Re: Yahoo and their mail filters..
> To: John R. Levine <johnl () iecc com>
> Cc: nanog () nanog org
> Message-ID: <A3D823EF-4892-4D36-BDCB-B724D1EC0318 () multicasttech com>
> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
>
>
> On Feb 26, 2009, at 2:00 PM, John R. Levine wrote:
>
> > > You're that confident people know the difference between a real
> > > communication from a party they conversed with before and a phish
> > > designed to look like the same thing?
>
> What I worry about is when software is used to scrape lists such as
> this and used to create
> phishing based on actual emails, so you get phishes apparently from
> people you know using their actual words.
> When the botnets start doing that things could get nasty fast.
>
> Regards
> Marshall
>
>
> > If it's a bank, probably not.  If it's a random online store,
> > there's about a 99.9% chance it's actual junk mail and .01% that
> > it's anything else.
> >
> > R's,
> > John
>
>
>
>
> ------------------------------
>
> Message: 3
> Date: Thu, 26 Feb 2009 23:55:38 +0000
> From: Adam Armstrong <lists () memetic org>
> Subject: Re: Documentation of switch maps
> To: Blake Pfankuch <bpfankuch () cpgreeley com>
> Cc: "nanog () nanog org" <nanog () nanog org>
> Message-ID: <49A72BFA.1070706 () memetic org>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Blake Pfankuch wrote:
> > Howdy.
> >
> > Had a customer come to me this morning who wanted to create a document
> for their switching infrastructure and thought I would bounce it off the
> rest of the world on how you usually do this.  Typically I use a spreadsheet
> with outlines to define the "switch" and then outlines for the ports and
> color coding for vlan's as well as a description of the port.  Curious what
> other people are doing, as this would be a huge undertaking for a customer
> who is using an entire /19 of rfc 1918 ip addresses and has well over 150
> switches and 40 active vlans.  The want to be able to look at this document
> and pull up any switch and look at the port and be able to see what vlan the
> port is on, as well as what device it is connected to as well as port
> channel membership, trunks and other fun things like that.  Needless to say
> their documentation is lacking on the physical connectivity however their
> cisco infrastructure does have labels on every port that goes to a named
> device outside of the DHCP pools.  Thoughts?
> >
> If they're cisco or similar switches, make sure your port descriptions
> are correct, and keep configuration archives. Collect the port
> configuration/status with snmp and populate it into a database, that way
> you can generate whatever information you want in whatever format and
> it's accurate, which it won't be if you're expecting someone to update a
> spreadsheet.
>
> adam.
>
>
>
>
> ------------------------------
>
> Message: 4
> Date: Thu, 26 Feb 2009 17:38:18 -0700
> From: devang patel <devangnp () gmail com>
> Subject: Internet access using VRF aware NAT
> To: nanog () nanog org
> Message-ID:
>        <d0fea3580902261638v857ca36ja7442ebc7c54456b () mail gmail com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Hello,
>
> Have one question about VRF aware NAT for internet access! If we will
> enable
> the VRF aware NAT on local PE to have an internet access via central
> Internet PE then we will not have connectivity to any other VPN site as all
> local CE prefixes will be translated to the loopback IP address of the
> local
> PE.
>
> We can have route map which will match the ACL for specific CE source to
> specific VPN destination with deny key word and it will prevent the NAT
> when
> CE will try to communicate with other CE of same VPN or different VPN. That
> looks longer configuration in real world right! so is that the only way I
> have when I will have only one option to configure the locap PE with VRF
> aware NAT to gain internet access?
> I need to know what is the implement in real world? How service provider
> networks are providing internet access with MPLS VPN option? I know about
> customer is getting VPN connectivity on one router and service provider
> will
> give other internet connectivity link which might be terminating on same
> router or other router.  I just want to know which is mostly used option as
> far as the internet access service with MPLS VPN services!
>
> thanks,
> Devang Patel
>
>
> ------------------------------
>
> Message: 5
> Date: Thu, 26 Feb 2009 18:08:27 -0700
> From: "J.D. Falk" <jdfalk-lists () cybernothing org>
> Subject: Re: Yahoo and their mail filters..
> To: nanog () nanog org
> Message-ID: <49A73D0B.2010706 () cybernothing org>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Brian Keefer wrote:
>
> > The other options is to stuff all the spam messages in a folder and
> > expose them to the user, taking up a huge amount of storage space for
> > something the vast majority of users are never going to look at any way.
>
> Which is, in fact, what Yahoo! does by default.  Users have the option to
> have that stuff deleted immediately, should they desire.
>
> > Blocking an entire site just because one John Doe user clicked a button
> > they don't even understand just does not make sense.
>
> You're right -- but Yahoo! has a sufficiently large userbase that they can
> count multiple complaints before blocking anything.  Same story with AOL,
> and Hotmail, and Cloudmark, and many others who've used this technique for
> years.
>
> In all of those cases, they have safeguards to prevent gaming, to prevent
> bouncing, and pretty much everything else anyone's suggested thus far in
> this thread.
>
> > Last, anywhere that I've seen extensive use of forwards has had a maze
> > of difficult to untangle abuse problems related to forwarded spam. Any
> > site allowing forwarding should apply very robust filtering of outbound
> > mail.
>
> Very true.  MAAWG published a document last year which includes some
> additional recommendations:
>
> http://www.maawg.org/about/publishedDocuments/MAAWG_Email_Forwarding_BP.pdf
>
> --
> J.D. Falk
> Return Path Inc
> http://www.returnpath.net/
>
>
>
> ------------------------------
>
> Message: 6
> Date: Thu, 26 Feb 2009 20:35:57 -0500
> From: Carl Ford <carl.ford () gmail com>
> Subject: Re: Yahoo and their mail filters..
> To: Micheal Patterson <micheal () spmedicalgroup com>
> Cc: nanog () nanog org
> Message-ID:
>        <f79c56820902261735q3d958f3ey24c36aeb4ee294e3 () mail gmail com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> very old news.
>
> their filter restrictions have some very absurd rules
>
> On Tue, Feb 24, 2009 at 9:27 PM, Micheal Patterson <
> micheal () spmedicalgroup com> wrote:
>
> > This may be old news, but I've not been in the list for quite some time.
> At
> > any rate, is anyone else having issues with Yahoo blocking / deferring
> > legitimate emails?
> >
> > My situation is that I host our corporate mx'ers on my network, one of
> the
> > companies that we recently purchased has Yahoo hosting their domains
> mail.
> > Mail traffic to them is getting temporarily deferred with the "421 4.7.0
> > [TS01] Messages from xxx.xxx.xxx.xxx temporarily deferred due to user
> > complaints - 4.16.55.1;
> > see http://postmaster.yahoo.com/421-ts01.html";
> >
> > The admin of the facility has contacted Yahoo about this but their
> response
> > was for "more information" when they were told that traffic from my mx to
> > their domain was to being deferred.  I may end up just having them
> migrate
> > to my systems just to maintain company communications if we can't clear
> this
> > up in a timely manner.
> >
> > --
> > Micheal Patterson
>
>
> ------------------------------
>
> Message: 7
> Date: Thu, 26 Feb 2009 18:15:08 -0700
> From: "J.D. Falk" <jdfalk-lists () cybernothing org>
> Subject: Re: Yahoo and their mail filters..
> To: nanog () nanog org
> Message-ID: <49A73E9C.1060604 () cybernothing org>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Barry Shein wrote:
>
> > I suggested that probably 99% of the false positives I see could be
> > avoided by just waiting until there are two or more complaints from
> > the same source before firing it back as spam.
>
> I've developed systems for ISPs to handle inbound complaints from AOL &
> such, and that's exactly what we did: multiple complaints were acted upon,
> single complaints only fed into the aggregate stats.  On the INBOUND side.
> We didn't ask AOL to do that work for us.
>
> Many recipients of complaint feedback actually /want/ to receive every
> complaint, because -- like John Levine -- they treat those complaints as
> unsubscribe requests.
>
> Yours is not the common use case.
>
> --
> J.D. Falk
> Return Path Inc
> http://www.returnpath.net/
>
>
>
> ------------------------------
>
> Message: 8
> Date: Fri, 27 Feb 2009 07:34:46 +0530
> From: Suresh Ramasubramanian <ops.lists () gmail com>
> Subject: Re: Yahoo and their mail filters..
> To: "J.D. Falk" <jdfalk-lists () cybernothing org>
> Cc: nanog () nanog org
> Message-ID:
>        <bb0e440a0902261804m77b0ca56nf3c61facf708bfec () mail gmail com>
> Content-Type: text/plain; charset=UTF-8
>
> On Fri, Feb 27, 2009 at 6:45 AM, J.D. Falk
> <jdfalk-lists () cybernothing org> wrote:
> > Many recipients of complaint feedback actually /want/ to receive every
> > complaint, because -- like John Levine -- they treat those complaints as
> > unsubscribe requests.
>
> That's ONE use case.  But we are not senders, and we do use a feedback
> loop because we are an ISP (like barry) but we dont have the luxury of
> a purely geek (so largely clean e&oe pwned systems) userbase like
> Barry has.
>
> In other words - we do get spammer customers. And the feedback loops
> provide us near real time notification of these, allowing us to
> terminate.
>
> > Yours is not the common use case.
>
> His IS the common use case.  Just that he doesnt have the sort of
> userbase that will generate usable FBLs (aka no significant number of
> genuine spam issues on his network).  For which he has to count
> himself lucky.
>
>
>
> ------------------------------
>
> Message: 9
> Date: Thu, 26 Feb 2009 20:17:37 -0800
> From: Brian Keefer <chort () smtps net>
> Subject: Re: Yahoo and their mail filters..
> To: "J.D. Falk" <jdfalk-lists () cybernothing org>
> Cc: nanog () nanog org
> Message-ID: <257F71E4-40FF-4587-9EAD-F8988465B119 () smtps net>
> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
>
>
> On Feb 26, 2009, at 5:08 PM, J.D. Falk wrote:
> > > Blocking an entire site just because one John Doe user clicked a
> > > button
> > > they don't even understand just does not make sense.
> >
> > You're right -- but Yahoo! has a sufficiently large userbase that
> > they can count multiple complaints before blocking anything.  Same
> > story with AOL, and Hotmail, and Cloudmark, and many others who've
> > used this technique for years.
>
> This does not appear to be the case from external observation.  It may
> be in some cases that multiple reports are necessary, but it certainly
> seems there are hair-triggers in others.  For instance, see the
> message from Eric Esslinger.
>
> As for not black-holing anything, I haven't personally verified with
> Yahoo!, but others have reported that they do.  It's pretty common
> from what I've seen to simply make very high-scored messages disappear
> and only send the mid-range stuff to the spam folder.  Hotmail, as
> mentioned, does this.  One of the very large hosted filtering services
> does as well.  I'm not saying it's bad (it makes sense if you can
> trust your scoring algorithm), but it does happen.  Just because you
> get _some_ stuff in your spam folder doesn't mean that's all the spam
> that was blocked.
>
> --
> bk
>
>
>
>
>
>
> ------------------------------
>
> Message: 10
> Date: Thu, 26 Feb 2009 20:26:12 -0800
> From: Jo Rhett <jrhett () netconsonance com>
> Subject: Re: Yahoo and their mail filters..
> To: Ray Corbin <rcorbin () traffiq com>
> Cc: "nanog () nanog org" <nanog () nanog org>
> Message-ID: <A7F2327C-EA78-480E-812C-D6FDD7008978 () netconsonance com>
> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
>
> On Feb 25, 2009, at 8:14 AM, Ray Corbin wrote:
> > It depends on your environment. I've seen where it is helpful and
> > where it is overwhelming. If you are a smaller company and want to
> > know why you keep getting blocked then those should help. If you are
> > a larger company and get a several hundred a day, but you send 100k
> > emails to AOL then it is not as big of a deal. If you are a shared
> > hosting provider and you get a lot of them you should look into what
> > is being sent to AOL, such as forwarded spam from customers 'auto
> > forwards' (isolate the auto forwards to a separate IP address and
> > simply don't sign up for the FBL for it).... If you have a good
> > setup where only customer-originated email is being sent through the
> > IP's you have a FBL on, then it is useful and you shouldn't get as
> > many complaints.
>
>
> Ray, you don't get it.   What comes from AOL is literally every step
> in a mother-daughter conversion.  You get to read the entire thread.
> Loving chat, mother and daughter back and forth.  But one of them is
> hitting SPAM on the e-mail *AFTER* replying to it and writing a nice
> letter back.
>
> This is abuse of the abuse department.  This isn't spam.  Reading
> through ~3k of these not-spams every day doesn't help us solve any
> actual abuse problems.
>
> Feedback loops will not be useful until the providers of the feedback
> loops accept reports about use of the spam reporting tools, and are
> willing to go fix their user behavior.
>
> --
> Jo Rhett
> Net Consonance : consonant endings by net philanthropy, open source
> and other randomness
>
>
>
>
>
> ------------------------------
>
> Message: 11
> Date: Thu, 26 Feb 2009 20:47:35 -0800
> From: Ricardo Oliveira <rveloso () cs ucla edu>
> Subject: Road Runner DNS servers
> To: nanog () nanog org
> Message-ID: <9F40AFA3-DABB-4DDC-8CE5-09393FF4E73A () cs ucla edu>
> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
>
> Is there anyone clueful in this list from Road Runner(Time Warner
> Cable) that can explain what's going on with their DNS servers - just
> contacted their tech support and heard their DNS servers have been
> under attack over the last 3 days..
> thanks,
>
> --Ricardo
>
>
>
> ------------------------------
>
> _______________________________________________
> NANOG mailing list
> NANOG () nanog org
> http://mailman.nanog.org/mailman/listinfo/nanog
>
> End of NANOG Digest, Vol 13, Issue 145
> **************************************



-- 
Thanks & Regards
shivlu jain
http://shivlu.blogspot.com/
09312010137