[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Connectivity to Brazil

Very simply. :) We chose to stop accepting prefixes from and announcing
prefixes to them. You could attempt this in more elaborate and less
forceful ways if you're in the right position, but we encounter issues
like this too much and it affects critical clients that cannot afford
any downtime, and we have plenty of other transit connections. We are in
a position where we have direct connectivity with them (which based on
our track record won't be much longer), so it might be much easier for
us. Otherwise you'd have to hope your upstream is the one connected to
them and has communities available to tinker with to withdraw your
tagged prefixes from being announced to them, and just change the local
preference or however you prefer to do it on the inbound routes from
your upstream, or better yet filter on as-path.


On 2/2/2011 8:08 AM, Steve Danelli wrote:
> Thanks Vinny - how did you route around?   There seems to be one path from the US to Brazil via GBLX and CTBC.    Are you leveraging leased connectivity?   Thanks for the info!!
> SD
> Sent from my iPhone
> On Feb 2, 2011, at 1:21 AM, Vinny Abello <vinny at abellohome.net> wrote:
>> We saw similar issues with IKE through Global Crossing (as odd as that sounds) out of the NYC market at the same time. We routed around them and problem solved. Still scratching our heads on that one... In my experiences, GLBX has numerous odd issues to the point where it's become a bad joke anytime something breaks with connectivity... we blame them. It's kind of not funny though because it's almost always true. Taking them out of the equation usually fixes the problem. One of our customers who is frequently affected by GBLX problems jumps to the (often correct) conclusion that they are causing problems. :-/
>> -Vinny
>> On Feb 1, 2011, at 3:57 PM, Steve Danelli wrote:
>>> Thanks for the response.  
>>> Ike had worked great up until Monday.  The provider did a local test and our box saw the Ike packets so it appears to lie somewhere upstream.  (GLBX may be a good guess)
>>> Also - the paths are stable and we are sourcing from the same ip - very strange behaivor.    Hope someone from GLBX or CTBC (or someone who had experienced an issue like this) can assist
>>> Thanks to all for their feedback so far.   
>>> SD
>>> On Feb 1, 2011, at 3:19 PM, Valdis.Kletnieks at vt.edu wrote:
>>>> On Tue, 01 Feb 2011 08:54:47 EST, Steve Danelli said:
>>>>> Some carrier, somewhere between us and the service provider is selectively
>>>>> dropping the IKE packets originating from our VPN gateway and destined for
>>>>> our Brazil gateway. Other traffic is able to pass, as are the IKE packets coming
>>>>> back from Brazil to us. This is effectively preventing us from establishing
>>>>> the IPSEC tunnel between our gateways.
>>>> Has IKE been known to work to that location before? Or is this something new?
>>>> My first guess is some chucklehead banana-eater at the service provider either
>>>> fat-fingered the firewall config, or semi-intentionally blocked it because it
>>>> was "traffic on a protocol/port number they didn't understand so it must be
>>>> evil".
>>>>> Also something else is awry, for two given hosts on the same subnet (x.y.z.52
>>>>> and x.y.z.53), they take two wildly divergent paths:
>>>>> Anyone have any insight on to what may be occurring?
>>>> The paths appear to diverge at  I wonder if that's gear trying
>>>> to do some load-balancing across 2 paths, and it's using the source IP as a
>>>> major part of the selector function ("route to round-robin interface source-IP
>>>> mod N" or similar?).
>>>> The other possibility is your two traceroutes happened to catch a routing flap in
>>>> progress (obviously not the case if the two routes are remaining stable).
>>>> Sorry I can't be more helpful than that...