February 2002 - USR-TC - mailman.xmission.com

Re: [USR-TC] CERT Advisory CA-2002-03: SNMPv1 Vulnerabilities
by Thomas_Goodman＠3com.com 13 Feb '02

13 Feb '02

New NMC code has been posted on http://totalservice.commworks.com . The following NMC codes provide protection from possible Denial Of Service (DoS) attacks via SNMP. These concerns were raised by a CERT advisory issued today (see http://www.kb.cert.org/vuls/id/854306) To find the NMC code do the following: 1)Go to the Software Library Link located under the Software section of the totalservice web page 2) Choose the Enhanced Data Services (RAS) icon 3) Then Click on the drop down arrow and choose Network Management Cards 4) The NMC code is posted as follows: HM080296: HiPerNMC v8.2.96. This code is based on version 8.2.97 and includes fixes to prevent NMC reboots that might be caused by certain SNMP requests. HH080396: NMC-333 v8.3.96. This code is based on version 8.3.97 and includes fixes to prevent NMC reboots that might be caused by certain SNMP requests. The NMC code is also posted under the TCS 4.3 software suite located under the same drop down arrow as the Network Management Cards. Please note: This issue has been fixed on the TCS 4.5 Beta load. Steve Johnson <linuxnut(a)sonic.net>@mailman.xmission.com on 02/13/2002 01:39:01 PM Sent by: usr-tc-admin(a)mailman.xmission.com To: Carl Litt <carl(a)execulink.com>, usr-tc(a)lists.xmission.com cc: Subject: Re: [USR-TC] CERT Advisory CA-2002-03: SNMPv1 Vulnerabilities Yeah if anyone knows please post is on this list.. I sure hope they are not vulnerable... -Steve On Wednesday 13 February 2002 11:29 am, Carl Litt wrote: > CERT has just released an advisory concerning vulnerabilities in SNMPv1 > which exist in many vendor implementations, including 3Com. > > 3Com has acknowledged that several switches are are vulnerable, but there > has been no news about the Total Control series. Does anyone know if the > SNMP implementation on the ARC/NMC cards is safe? > > For reference: > > http://www.kb.cert.org/vuls/id/854306 > http://www.kb.cert.org/vuls/id/107186 > > Carl Litt > Network Administrator > Execulink Internet > > > > _______________________________________________ > USR-TC mailing list > USR-TC(a)mailman.xmission.com > http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc _______________________________________________ USR-TC mailing list USR-TC(a)mailman.xmission.com http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc

2 1

CERT Advisory CA-2002-03: SNMPv1 Vulnerabilities
by Carl Litt 13 Feb '02

13 Feb '02

CERT has just released an advisory concerning vulnerabilities in SNMPv1 which exist in many vendor implementations, including 3Com. 3Com has acknowledged that several switches are are vulnerable, but there has been no news about the Total Control series. Does anyone know if the SNMP implementation on the ARC/NMC cards is safe? For reference: http://www.kb.cert.org/vuls/id/854306 http://www.kb.cert.org/vuls/id/107186 Carl Litt Network Administrator Execulink Internet

3 2

Memory for HiperArc
by Kevin Hemsley 13 Feb '02

13 Feb '02

Does anyone have the specs for Hiperarc memory? I thought I had it somewhere, but I can't find it. Thanks, Kevin. ------------------------------------------------------ Kevin Hemsley Systems Engineer Microserv Computer Technologies, Inc. kev(a)ida.net KB7TYA

1 0

DSP Down
by Kirk Mitchell 13 Feb '02

13 Feb '02

I have a DSP card with a constant D alarm/Loopback indication. Verizon says there's nothing wrong with the line, but they can't loop the CSU. Yeah, I know they're liars and frauds that cheat on their grandmothers, but I'm stuck eliminating everything else before going back to them. DSP is 0.49.0 hardware running 2.0.81, ARC running 4.2.32. I've gone over all the settings with a fine tooth comb, nothing is amiss. The only test I haven't run yet is to swap the PRI into another card, I haven't had an empty card to swap to yet. Anything I might be missing? Thanks, -- Kirk Mitchell-General Manager mitch(a)keyconn.net Keystone Connect Unlock Your World Altoona, PA 814-941-5000 http://www.keyconn.net

2 1

TC1000 for E1
by Nauman Malik 12 Feb '02

12 Feb '02

Hi, I have several Total Control 1000 boxes which I am using for PRIs (E1). Now I want to use it for E1 with R2 Signalling. Any idea what changes I need to do in configuration of Dual PRI, Modem cards or Netserver PRI card. Nauman.

1 0

RE: [USR-TC] redirection
by Kancha . 11 Feb '02

11 Feb '02

Yes I could you wccp, but the problem is the Cisco router that i'm currently using doesn't support wccp. I had used ip policy and route map but this created problem. The router was slowed down. That's why instead of redirecting http traffic from router i was thinking of redirecting from RAS itself. Any way i can achieve that in TC. (something similar to wccp or ip policy in cisco). --- Randy Cosby <dcosby(a)infowest.com> wrote: > You're best off doing it at your cisco router using > WCCP (assuming you're > using a cisco). That's a bit off topic for this > list, but I'd be glad to > share some techniques we've used successfully. > > Randy > > > > -----Original Message----- > > From: usr-tc-admin(a)mailman.xmission.com > > [mailto:usr-tc-admin@mailman.xmission.com]On > Behalf Of Kancha . > > Sent: Saturday, February 09, 2002 8:40 PM > > To: usr-tc(a)lists.xmission.com > > Subject: [USR-TC] redirection > > > > > > Hello all > > > > I need to redirect all web traffic comming from TC > to > > my squid proxy server. How can this be done ?? > > > > > > help > > > > __________________________________________________ > > Do You Yahoo!? > > Send FREE Valentine eCards with Yahoo! Greetings! > > http://greetings.yahoo.com > > > > _______________________________________________ > > USR-TC mailing list > > USR-TC(a)mailman.xmission.com > > > http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc > > > __________________________________________________ Do You Yahoo!? Send FREE Valentine eCards with Yahoo! Greetings! http://greetings.yahoo.com

1 0

Re: [USR-TC] UST TC1000 and 'Level 3 alarm'
by Steve Johnson 10 Feb '02

10 Feb '02

(I meant to send this to the list last week and accidently sent it to just 1 person) Yeah the PRIs look clean. As we are investigating this more, it looks like the ARCs are not accepting the calls. What will happen is the arc will dump all calls on the box, then the first channel of the first PRI will take a call and then drop it, and continue to do this, while this 1 call is in progress any calls after that get the all circuits are busy message. So I'm wondering if this is something weird with the ARCs. Now I have 4 Boxes for 1 POP 2 boxes for another, on Monday all 4 boxes at this POP had this problem, almost in sequential order, it may just seem like it was in order because of the hunting. So now I'm wondering if there is a DoS for hyper arcs that no one is aware of yet, and that I am being hit by them. It is real strang that 5 our 8 boxes have had this problem, all running the same firm ware on the ARCs, NMCs and DSPs... Also I considered the possibility that someone got ahold of my SNMP strings and is monkeying around with the boxes, so today I changed all the communities. I'm still at a loss tho, and the CEO is getting upset with the issue. -Steve On Tuesday 05 February 2002 12:56 pm, you wrote: > Steve Johnson wrote: > > I've blamed the CO and they tell me its us.. I also found that reseting > > the D chanels or reset the card (which resets the d in the process) > > clears the problem > > You forget the first three rules of telecom school. Blame the CPE, blame > the CPE, blame the CPE. > > I went through a problem with WorldCom were my Total Control was showing > bi-polar errors. Get the WorldCom techs on the phone, sir there's > nothing wrong with that T1, nothing wrong with our switch, nothing wrong > with our network, blah blah blah blah. > > Moved the circuits to another provider and bingo, bi-polar errors went > away. > > Have you checked the lines for errors? Sometimes a switch will take down > the D channel if the line is not clean. > > -Ron

2 2

redirection
by Kancha . 09 Feb '02

09 Feb '02

Hello all I need to redirect all web traffic comming from TC to my squid proxy server. How can this be done ?? help __________________________________________________ Do You Yahoo!? Send FREE Valentine eCards with Yahoo! Greetings! http://greetings.yahoo.com

1 0

Platypus, IAS 4.0, Multi-link and double billing
by USRobotics TC Mailing List 08 Feb '02

08 Feb '02

I'm currently running a HiperArc with Microsoft IAS 4.0 Radius for authentication. We're about to move to Boardtown's Platypus billing product. We are trying to bill double-time for multi-link connections, but Platypus is dropping sessions for the following reason. According to the RFC (the Protocol Standard), if a user makes a multi-link connection (ie ISDN), the user should have different Acct-Session-ID's. Apparently the AcctSessionID is assigned by the hardware and NOT the radius server. This means that the HiperArc is not complying with the Radius standard. Anyone know of a fix? thx.

2 1

ARC OSPF adjacency problem with Backup DR
by Antonio Querubin 08 Feb '02

08 Feb '02

In a single TCS chassis I have 2 HiPerARC router cards. The TCS is attached to a network of Cisco and Juniper routers configured in OSPF area 1. Two of the Cisco routers are configured with a higher OSPF priority than the other routers and so are the designated router and backup designated routers. Previously only 1 ARC (call it ARC1) had been configured to run OSPF and it had been working well. When I enabled OSPF on the second ARC (let's call it ARC2), neither ARC1 nor ARC2 could establish an adjacency anymore with the backup designated router. Both ARCs establish OSPF adjacency only with the designated router (Full/DR). However their state with the backup DR continuously cycles between Init, ExStart, and Exchange states. Furthermore, although their state with the primary DR is 'Full/DR', the DR never sees the routes announced from either ARC1 or ARC2. At first I thought this might be a problem unique to Cisco but if I clear the OSPF process on the backup DR, which forces one of the Juniper M5 routers to be elected as a backup DR, the Juniper M5 exhibits the same symptoms. Ie. the M5 never establishes OSPF adjacency with either ARC. However, the Cisco which was previously the backup DR and could not establish a stable adjacency state with the ARCs now goes into a normal OSPF 'TwoWay' state with both ARCs. At this point I'm beginning to suspect that something special needs to be configured on the ARCs if both are to be running OSPF at the same time. Has anyone encountered such a problem and what's the general solution?

1 0