Is it permissible to advertise number resources allocated by one RIR to a ISP in a region governed by a different RIR? Practical?

2011-02-09 Thread Crooks, Sam
Is it permissible, from a policy perspective, for a multi-homed end user
to announce the numbering resource allocation received from one RIR (for
discussion purposes, let's say ARIN) to upstream service providers in a
different region (for example, in the RIPE region)?

 

Is it feasible from a practical perspective?

 

I've looked through IANA and ARIN policy and can't find anything which
covers such a scenario.  I have seen some things about transferring
number resources from one RIR to another RIR, which is similar, but not
exactly the same.

 

Rationale:  

 

Suppose you are a large global enterprise, truly globalized in practice,
not in mere name, and performance concerns aside, you provide failover
for Internet access of enterprise users in one region by failing over to
internet access in a different region.  Since you probably are using
10/8 addressing within your network and you NAT the private IPv4
addresses to a public IPv4 address before sending the traffic on.., so
this works.   Given lack of NAT66, and the best practice IPv6 numbering
which is purported to use globally routable IPv6 addresses within your
enterprise network, the achievable way to accomplish the same use
possible today in IPv4 would seem to be to advertise the IPv6 addressing
from one RIR to a ISP in a region governed by a different RIR (or LIR). 



RE: CRS-3

2010-03-09 Thread Crooks, Sam
Spend the GDP of a small nation on a single box!



 -Original Message-
 From: Brian Feeny [mailto:bfe...@mac.com]
 Sent: Tuesday, March 09, 2010 1:51 PM
 To: nanog@nanog.org list
 Subject: CRS-3
 
 
 So who is going to be the first to deploy these?
 
 http://newsroom.cisco.com/dlls/2010/prod_030910.html
 
 
 - Download the entire Library of Congress in just over 1 second
 - Stream every motion picture ever created in less than four minutes
 
 If nothing else you gotta love the Cisco Marketing machine!
 
 
 
 Brian




RE: Locations with no good Internet (was ISP in Johannesburg)

2010-02-26 Thread Crooks, Sam
I had good luck getting my dad some form of broadband access in rural
Oregon using a 3g router (Cradlepoint), a Wilson Electronics signal amp
(model 811211), and an outdoor mount high gain antenna.  It's not great,
but considering the alternatives (33.6k dialup for $60/mo or satellite
broadband for $150-$200/mo) it wasn't a bad deal for my dad when you
consider that the dialup ISP + dedicated POTS line cost about as much as
the 5GB 3G data plan does.  

Speed is somewhere between  dialup and Uverse or FIOS.  I get the sense
that it is somewhere in the range of 256 - 512 kbps with high latency
(Dad's not one for much in the way of network performance testing).



 -Original Message-
 From: Michael Sokolov [mailto:msoko...@ivan.harhan.org]
 Sent: Friday, February 26, 2010 3:35 PM
 To: nanog@nanog.org
 Subject: Locations with no good Internet (was ISP in Johannesburg)
 
 Daniel Senie d...@senie.com wrote:
 
  Better than western Massachusetts, where there's just no
connectivity
 at =
  all. Even dialup fails to function over crappy lines.
 
 Hmm.  Although I've never been to Western MA and hence have no idea
 what
 the telecom situation is like over there, I'm certainly aware of quite
 a
 few places in first world USA where DSL is still a fantasy, let
alone
 fiber.
 
 As a local example, I have a friend in a rural area of Southern
 California who can't get any kind of high-speed Internet.  I've run
a
 prequal on her address and it tells me she is 31 kft from the CO.  The
 CO in question has a Covad DSLAM in it, but at 31 kft those rural
 residents' options are limited to either IDSL at 144 kbps (not much
 point in that) or a T1 starting at ~$700/month.  The latter figure is
 typically well out of range for the kind of people who live in such
 places.
 
 That got me thinking: ISDN/IDSL and T1 can be extended infinitely far
 into the boondocks because those signal formats support repeaters.
 What
 I'm wondering is how can we do the same thing with SDSL - and I mean
 politically rather than technically.  The technical part is easy: some
 COs already have CLECs in them that serve G.shdsl (I've been told that
 NEN does that) and for G.shdsl repeaters are part of the standard
 (searching around shows a few vendors making them); in the case of
 SDSL/2B1Q (Covad and DSL.net) there is no official support for
 repeaters
 and hence no major vendors making such, but I can build such a
repeater
 unofficially.
 
 The difficulty is with the political part, and that's where I'm
seeking
 the wisdom of this list.  How would one go about sticking a mid-span
 repeater into an ILEC-owned 31 kft rural loop?  From what I understand
 (someone please correct me if I'm wrong!), when a CLEC orders a loop
 from an ILEC, if it's for a T1 or IDSL, the CLEC actually orders a T1
 or
 ISDN BRI transport from the ILEC rather than a dry pair, and any
 mid-span repeaters or HDSLx converters or the like become the
 responsibility of the ILEC rather than the CLEC, right?
 
 So how could one extend this model to provide, say, repeatered G.shdsl
 service to far-outlying rural subscribers?  Is there some political
 process (PUC/FCC/etc) by which an ILEC could be forced to allow a
third
 party to stick a repeater in the middle of their loop?  Or would it
 have
 to work by way of the ILEC providing a G.shdsl transport service to
 CLECs, with the ILEC being responsible for the selection, procurement
 and deployment of repeater hardware?  And what if the ILEC is not
 interested in providing such a service - any PUC/FCC/etc political
 process via which they could be forced to cooperate?
 
 Things get even more complicated in those locations where the CO has a
 Covad DSLAM in it serving out SDSL/2B1Q, but no other CLEC serving
 G.shdsl.  Even if the ILEC were to provide a G.shdsl transport service
 with repeaters, it wouldn't help with SDSL/2B1Q.  My idea involves
 building a gadget in the form factor of a standard mid-span repeater
 that would function as a converter from SDSL/2B1Q to G.shdsl: if the
 loop calls for one mid-span repeater, stick this gadget in as if it
 were that repeater; if the loop calls for 2 or more repeaters, use my
 gadget as the first repeater and then standard G.shdsl repeaters
 after it.  But of course this idea is totally dependent on the ability
 of a third party to stick these devices in the middle of long rural
 loops, perhaps in the place of loading coils which are likely present
 on such loops.
 
 Any ideas?
 
 MS




RE: WS-X6148A-GE-TX performance question

2009-09-10 Thread Crooks, Sam
the other difference between WS-X6148-GE-TX and WS-X6148A-GE-TX is the A
has better QoS queuing potential (more hardware queues available) and a
lower list price...

As I recall, there are 6 ethernet controllers with 8 ports on each...
(8:1 oversubscription among the adjacent ports in a port group which use
the same ethernet controller).

The card is a Classic card, so the whole card is limited to 32 Gbps to
the backplane, which given the oversubscription ratio, shouldn't be much
of an issue...



 -Original Message-
 From: Bill Blackford [mailto:bblackf...@gmail.com] 
 Sent: Thursday, September 10, 2009 4:40 PM
 To: Scott Spencer
 Cc: nanog@nanog.org
 Subject: Re: WS-X6148A-GE-TX performance question
 
 There was a good thread on Cisco-nsp regarding this exact 
 subject recently.
 My recollection is that both X6148 and X6148A have just 6 1GB ASICs.
 Therefore the over subscription rate is 8:1. The biggest 
 difference between these LC's is that X6148A will support 
 large MTU whereas X6148 will not.
 
 -b
 
 
 On Thu, Sep 10, 2009 at 2:17 PM, Scott Spencer 
 sc...@dwc-computer.comwrote:
 
   Are the X6148A cards dedicated 1 gb/s uplink for each port 
 ( shared 
  32 Gb/s bus , as long as each port is it's own 1 gb/s still to the 
  32gb/s bus and not shared with 7 other ports, so effectively just 
  125Mb/s per port then if all used at full/even capacity) ?
 
  I can't really find anything much on X6148A internal architecture 
  online, but it would seem that each port gets its own 1gb/s link to 
  the card/backplane, and that the bottleneck then is the 32gb/s 
  backplane (which is fine, as long as it's not 1 gb/s per 
 each set of 8 ports!).
 
 
  Best regards,
 
  Scott Spencer
  Data Center Asset Recovery/Remarketing Manager Duane Whitlow  Co. 
  Inc.
  Nationwide Toll Free: 800.977.7473.  Direct: 972.865.1395  Fax:
  972.931.3340
   mailto:sc...@dwc-computer.com sc...@dwc-computer.com 
  http://www.dwc-it.com/ www.dwc-it.com Sales of new and used 
  Cisco/Juniper/F5/Foundry/Brocade/Sun/IBM/Dell/Liebert
  and more ~
 
 
 
 
 --
 Bill Blackford
 Network Engineer
 



RE: NPE-G2 vs. Sup720-3BXL

2009-05-15 Thread Crooks, Sam
You may also take a look at the Cisco ASR1000 line... Supposedly a
middle step between 7200 and 7600 router sizing..

 

 -Original Message-
 From: Arie Vayner [mailto:arievay...@gmail.com] 
 Sent: Friday, May 15, 2009 1:34 PM
 To: David Storandt
 Cc: NANOG list
 Subject: Re: NPE-G2 vs. Sup720-3BXL
 
 David,
 
 My 1st advice would be to look also at the other 
 features/capabilities you require, and not just at feeds and speeds.
 
 Some examples for functionality could be:
 - QOS
 - NetFlow
 - DDoS resistance
 
 In general the 6500 and the 12000 are hardware based 
 platforms, with the 12000 being more distributed in nature, 
 using linecard resources for data plane (6500 does it too if 
 you have DFC installed). 7200 is a CPU/software based 
 platform, so the same processor does packet forwarding and 
 control plane processing.
 
 The 6500 (depends on specific module selection) is more 
 restricted with QOS and NetFlow functionality as it is 
 designed to do very fast forwarding at a relativly cheaper price.
 The 12000 has everything implemented in hardware, and depends 
 on the engine types (don't use anything other than Eng 3 or 
 5) has all the support you may dream of for things like QOS 
 and other features.
 The 7200 is a software based router, which means that it 
 support any feature you may ever dream of, but the 
 scalability decreases as you turn them on.
 
 Another option you should consider seriously should be the 
 ASR1000 router, which is a newer platform and has a new 
 architecture. All its features are based on hardware support, 
 and it could actually prove the best choice for what you need.
 The ASR1002 comes with 4 integrated 1GE ports, which could be 
 all that you would ever need (but it has quite a few 
 extension slots left).
 
 Arie
 
 On Fri, May 15, 2009 at 6:07 PM, David Storandt 
 dstora...@teljet.comwrote:
 
  We're stuck in an engineering pickle, so some experience from this 
  crew would be useful in tie-breaking...
 
  We operate a business-grade FTTx ISP with ~75 customers and 
 800Mbps of 
  Internet traffic, currently using 6509/Sup2s for core 
 routing and port 
  aggregation. The MSFC2s are under stress from 3x full route feeds, 
  pared down to 85% to fit the TCAM tables. One system has a FlexWAN 
  with an OC3 card and it's crushing the CPU on the MSFC2. 
 System tuning 
  (stable IOS and esp. disabling SPD) helped a lot but still doesn't 
  have the power to pull through. Hardware upgrades are needed...
 
  We need true full routes and more CPU horsepower for crunching BGP
  (+12 smaller peers + ISIS). OC3 interfaces are going to be 
 mandatory, 
  one each at two locations. Oh yeah, we're still a larger startup 
  without endless pockets. Power, rack space, and SmartNet are not 
  concerns at any location (on-site cold spares). We may need an 
  upstream OC12 in the future but that's a ways out and not a concern 
  here.
 
  Our engineering team has settled on three $20k/node options:
  - Sup720-3BXLs with PS and fan upgrades
  - Sup2s as switches + ISIS + statics and no BGP, push BGP 
 edge routing 
  off to NPE-G2s across a 2-3Gbps port-channel
  - Sup2s as switches + ISIS + statics and no BGP, push BGP 
 edge routing 
  off to a 12008 with E3 engines across a 2-3Gbps port-channel.
 
  Ideas and constructive opinions welcome, especially software and 
  stability-related.
 
  Many thanks,
  -Dave
 
 
 



RE: delays to google

2009-05-14 Thread Crooks, Sam

Also seeing this in Dallas, TX area, from ATT and Verizon

 -Original Message-
 From: Mario Fernandez [mailto:ma...@fernandez.ca] 
 Sent: Thursday, May 14, 2009 10:53 AM
 To: Athanasios Douitsis
 Cc: na...@merit.edu
 Subject: Re: delays to google
 
 Seeing the same thing from NY using NTT, we routed via Cogent 
 which does not seem to be having the problem.
 
 On Thu, May 14, 2009 at 11:51 AM, Athanasios Douitsis 
 aduit...@gmail.comwrote:
 
  On Thu, May 14, 2009 at 6:48 PM, Steve Williams 
  willi...@csr.utexas.edu
  wrote:
 
   am seeing significant delays in getting to google.  anyone else 
   seeing this?
  
   $ traceroute www.google.com
   traceroute: Warning: www.google.com has multiple addresses; using
   74.125.53.147
   traceroute to www.l.google.com (74.125.53.147), 30 hops 
 max, 40 byte 
   packets
   1  cisco-190 (129.116.190.250)  0.430 ms  0.350 ms  0.353 ms
   2  ser10-v758.gw.utexas.edu (128.83.10.29)  1.138 ms  1.099 ms  
   1.057 ms
   3  ser2-gi1-9.gw.utexas.edu (128.83.10.2)  10.475 ms  1.174 ms  
   1.584 ms
   4  aust-utnoc-core-ge-6-0-0-0.tx-bb.net (192.12.10.1)  1.215 ms  
   1.209
  ms
1.134 ms
   5  te2-1--570.tr01-lsanca01.transitrail.net (137.164.131.221)  
   40.649 ms
40.699 ms  40.678 ms
   6  * * *
   7  * * *
   8  * * *
   9  * * *
   10  * * *
   11  72.14.232.10 (72.14.232.10)  261.262 ms * *
   12  * * pw-in-f147.google.com (74.125.53.147)  251.867 ms
  
   --
  
  
  '''
 (O O)
   ,-- oOO-(_)-OOo -,
   |Stephen Williams|
   |  Manager of Computer Services  |
   |   Center for Space Research|
   | University of Texas at Austin  |
   | 3925 W. Braker Ln., Suite 200  |
   |  Austin, TX 78759-5321 |
   |512.471.7235  512.471.3570 (fax)|
   |   willi...@csr.utexas.edu  |
   | Oooo __|
 oooO   (   )
(   )) /
 \ ((_/
  \_)
  
   seeing this too.
 
 
 
 
 -- 
 
 Sent from Boston, Massachusetts, United States Yogi Berra 
 http://www.brainyquote.com/quotes/authors/y/yogi_berra.html 
  - If you ask me anything I don't know, I'm not going to answer.
 



RE: Managing your network devices via console

2009-05-14 Thread Crooks, Sam
Cisco makes a 16 port Async card for ISR routers, they even bundle it
with a 2811 router for fairly inexpensive $$$...  Cisco2811-16TS is the
partnum I think
You can scale up very high or down very low for your console needs with
cisco routers, and inexpensive used or obsolete routers are available
for not much money.
The octal cables are available with rj45's already on them, which is
nice Email if you want a sample term server config for a 2800
router.

If Cisco is not what you want... Consult the Zonker's Greater Scroll of
Console Knowledge:  http://www.conserver.com/consoles/ ... You may find
what you are looking for there.

 
 

 -Original Message-
 From: Tomas L. Byrnes [mailto:t...@byrneit.net] 
 Sent: Thursday, May 14, 2009 10:00 PM
 To: Mehmet Akcin; nanog@nanog.org
 Subject: RE: Managing your network devices via console
 
 I've found Avocents to be a nightmare, and the company to be 
 horrible to deal with.
 
 They work fine as a local console switch, but they are 
 absurdly expensive for that use. The rest of their features 
 are byzantine in implementation and usage, and their support 
 and licensing policies exorbitant.
 
 Old school terminal servers and IPMI/DRAC cards work very well.
 
 
 -Original Message-
 From: Mehmet Akcin [mailto:meh...@akcin.net]
 Sent: Thursday, May 14, 2009 7:30 PM
 To: nanog@nanog.org
 Subject: Managing your network devices via console
 
 Hello,
 
 It's always cool to have console access to routers/switches and 
 nowadays they are going from RS-232 to RJ-45 as a standart. 
 I have got 
 Avocent DSR 2035 which is a KVM+Serial console (all in 
 one).. but while 
 I was able to have it work against servers via KVM or/and Serial , I 
 was unable to make it work properly against any network device. I am 
 wondering if anyone had experience on DSR or similar boxes 
 to configure 
 them against network devices console ports.
 
 Making suggestions for alternative ways of centralizing 
 network device 
 console management is also more than welcome, I guess the 
 old fashioned 
 server attached usb-serial console is one of the most preferred way, 
 but feel free to provide if  you have good ideas
 
 cheers
 
 --
 Mehmet
 
 
 



RE: one shot remote root for linux?

2009-04-28 Thread Crooks, Sam


 

 -Original Message-
 From: Christopher Morrow [mailto:morrowc.li...@gmail.com] 
 Sent: Tuesday, April 28, 2009 8:33 PM
 To: nanog@nanog.org
 Subject: Re: one shot remote root for linux?
 
 
 That said there are a few 'network devices' which are linux 
 based (not just Vyatta! :) )
 
 o Cisco Guards
 o Arbor Peakflow (at least the X version) o 
 some-route-optmization systems o dns/mail/ntp/blah widgets



Cisco ASA's appear to be linux under the hood based on watching versions
of ASA804-3/12/19/23/31 boot on the console 



RE: Config Backup / Inventory

2009-04-24 Thread Crooks, Sam
CheckoutAlterpoint Network Authority Inventory.

The Inventory tool is free asn was developed as the Ziptie opensource
project.  Inventory is the basis for how Alterpoint does the paid
offerings for configurtion audit and compliance and the higher level
analytics based on the configuration and inventory repository that NA
Inventory provides.

The Inventory component is free but be prepared for sticker shock for
the whole Alterpoint suite of tools.

There is also ManageEngine DeviceExpert (not free, but inexpensive) and
Solarwinds Orion NCM (fromerly Cirrus configuration management, also
inexpensive)



Sam Crooks
GTS Network Architecture
 
701 Experian Pkwy
B5302
Allen, TX 75013
972-390-3186
sam.cro...@experian.com


-Original Message-
From: Joe Provo [mailto:nanog-p...@rsuc.gweep.net] 
Sent: Friday, April 24, 2009 8:11 AM
To: nanog@nanog.org
Subject: Re: Config Backup / Inventory

On Fri, Apr 24, 2009 at 09:25:05AM +0100, Joshua Eyres wrote:
[snip]
 I am looking for a bit of advice around configuration backup / 
 inventory. We currently have a large multi-vendor network which is 
 currently managed through two separate tools (rancid - 
 http://www.shrubbery.net/rancid and ns4
 - http://www.noodles.org.uk/ns4.html). Both tools do the job very 
 well, but management have asked that we look for commercial 
 alternatives that have a proper support organisation looking after
them.

Since rtrmon waned and rancid waxed (97ish?), I've been a proponent and
seen no support issues.  Lots of commercial offerings (mostly vendor-
specific) have changed or were from companies which folded between then
and now.  A non-trivial track record speaks volumes.

[snip]
 things about it. We are looking for a tool which is flexible that 
 allows configuration backup to textual form for easy restoration as 
 well as the ability to deploy scripted changes to the network quickly.

Sounds like rancid  par to me. :-)

Cheers,

Joe

-- 
 RSUC / GweepNet / Spunk / FnB / Usenix / SAGE




RE: The real issue

2009-04-21 Thread Crooks, Sam
 
And exactly how are you determining it is 'unused'?  Not announced to
the internet? (which means virtually nothing as far as 'use' status of
an IP block)

For pete sake, the time has come to resolve the issues that prevent
widespread adoption of IPv6:

 - resolve RIR IPv6 allocation hassles for requesting end-user orgs
 - insist on IPv6-capable hardware/services/engineering staff when
getting new hardware/services/staff
 - work toward retirement of IPv6-incapable hardware/software
 - train staff
 - start PoCs for IPv6 services (ip transit, DNS, etc)
 - start requiring IPv6 capability from ISPs which are slow to move
(Vendor A, V, S, etc) 

Many large organizations use public IP space internally and do not
announce it to the Internet.
Some SPs use public IP space on private MPLS VPN networks to address
links to customers to ensure non-conflicting addresses are used.
Some companies run large extranets to connect to customers and partners.
Many of these use public IP space to ensure services exposed to
customers over these extranets never conflict with IP space used by
customers.


MOVE ON.  Playing net cop does not solve the issue, merely forestalls
it.


-Original Message-
From: Shane Ronan [mailto:sro...@fattoc.com] 
Sent: Tuesday, April 21, 2009 10:27 PM
To: Christopher Morrow
Cc: nanog list
Subject: Re: The real issue

Very simple, just do it.

On Apr 21, 2009, at 7:59 PM, Christopher Morrow wrote:

 On Tue, Apr 21, 2009 at 10:46 PM, Shane Ronan sro...@fattoc.com
 wrote:
 It's means one of two things:


 sure, but 'how' exactly?

 1) Recoup the unused space for paid reallocation or

 arin never (nor do any RIR) guarantee routability, nor do they even a 
 method to affect routability of a network.

 2) Have the current owner pay the market rate for the IP space


 ... that's somewhat hard since the current policies don't support 
 that, and there is no real legal stance for legacy-allocations... For 
 allocated post-legacy-times ARIN can start court proceedings, but ...
 that's a lengthy process and expensive.

 -Chris


 On Apr 21, 2009, at 7:37 PM, Christopher Morrow wrote:

 On Tue, Apr 21, 2009 at 10:21 PM, Shane Ronan sro...@fattoc.com
 wrote:

 Is ARIN, who won't even take back large blocks of space from people

 who have long ago stopped using it and aren't paying anything for 
 it, prepared to start filing civil suits against people who were 
 assigned /24's (and paid for them) due to inaccurate declaration?

 out of curiousity.. 'take back' means what in this context?



 divbr/div





Looking for ATT / Verizon / Sprint WWAN service impressions - on or off-list replies welcome

2009-04-14 Thread Crooks, Sam
I'm considering use of ATT / Verizon / Sprint WWAN services and the
Cisco 3G router interface cards/integrated module in C880 routers for
primary or backup WAN network connectivity for routers.

I'm looking for information from users of these services on the
following: 

- addressing - Do these WWAN services use dynamic, PPPoE or static IP
assignment typically? Any of the 3? All?
   - is static IP assignment available?

- do these service providers use NAT within their network?

- How is the service reliability?  In most cases, is the service
available for use when you need to use it?
- How is the service coverage area?  Do you have problems getting
sufficient coverage in the deplouyment location to support desired
speeds (say 512kbps up/down as a minimum)?
- is ESP / IKE / IPsec permitted through un-rate-limited and un-molested
by the providers?
- If you build a IPsec/GRE tunnel over these services, do you have
frequent issues with the tunnel dropping, or a dynamic routing protocol
running through the tunnel going down frequently?

Also interested in similar information on impressions of similar EMEA
WWAN service providers, particularly Vodaphone and T-Mobile, if anyone
has experiences with these.


Replies on-list or off-list are welcome Your choice.

Cisco 3G interface and provider information:

http://www.cisco.com/en/US/products/ps7272/index.html

http://www.cisco.com/en/US/prod/routers/networking_solutions_products_ge
nericcontent0900aecd80601f7e.html#~north-america



Regards,

Sam Crooks


 



RE: ACLs vs. full firewalls

2009-04-07 Thread Crooks, Sam

Beware off using ACL filtering on 6500s with many vlans (100+) and long
acls (hundred+ lines)...

You'll soon find out more than you ever wanted to know about TCAM,
different TCAM types used in various sup's and what the limitations
imposed by TCAM on processing ACLs in hardware... 

Sam Crooks


-Original Message-
From: Michael Helmeste [mailto:mhelm...@uvic.ca] 
Sent: Tuesday, April 07, 2009 3:06 PM
To: nanog@nanog.org
Subject: ACLs vs. full firewalls

Hi all,
  One of the duties of my current place of employ is reorganizing the
network. We have a few Catalyst 6500 series L3 switches, but currently
do all packet filtering (and some routing) using a software based
firewall. Don't ask me, I didn't design it :)

  Current security requirements are only based on TCP and non-stateful
UDP src/dst net/port filtering, and so my suggestion was to use ACLs
applied on the routed interface of each VLAN. There was some talk of
using another software based firewall or a Cisco FWSM card to filter
traffic at the border, mostly for management concerns. We expect full 1
gig traffic levels today, and 10 gig traffic levels in the future.

  I view ACLs as being a cheap, easy to administrate solution that
scales with upgrades to new interface line speeds, where a full stateful
firewall isn't necessary. However, I wanted to get other opinions of
what packet filtering solutions people use in the border and in the
core, and why.

  What's out there, and why do you guys use it? How do you feel about
the scalability, performance, security, and manageability of your
solution? What kind of traffic levels do you put through it?




RE: Cisco ASR100x

2009-04-01 Thread Crooks, Sam
Michael Morris of Network World wrote an article about ASR1000s and IOS
XE a few months ago, if I recall correctly.

 


Sam Crooks
GTS Network Architecture
 
601 Experian Pkwy
A2035
Allen, TX 75013
972-390-3186
sam.cro...@experian.com
aim: expsamcrooks

-Original Message-
From: Bill Blackford [mailto:bblackf...@nwresd.k12.or.us] 
Sent: Wednesday, April 01, 2009 1:47 PM
To: nanog@nanog.org
Subject: Cisco ASR100x

Anyone on the list have any experience with ASR1000 series and IOS XE?
From what I've read, Cisco is attempting to move to a more modular
software as JUNOS has been doing for some time.

I am curious about the reliability and stability of the platform. I am
also interested in the differences in the IOS XE vs. IOS.

Thanks

-b

--
Bill Blackford





RE: Redundant Array of Inexpensive ISP's?

2009-03-12 Thread Crooks, Sam
 

In answer to a question below about experience with similar products...
Cisco IOS has the dynamic routing injection feature as part of recent
IOS versions. 

The feature is now called Performance Routing (PfR) formerly known as
OER (Optimized Edge Routing) and as of 12.4(24)T, it can optimize
routing protocols other than BGP or static routes (called PIRO  Protocol
Independent Route Optimization), including IS-IS, OSPF and EIGRP.  RIP
folks should learn about routing protocols :-D



PfR does not do compressions/tokenization of the data, so it has no
Caching/compression/WAN Acceleration features, BUT it does do dynamic
path re-routing based on your policy or observed metrics like latency,
packet loss, jitter etc and can also do it based on observed Netflow
data and automatic instatiation of IP SLA active probes to see what
happens for a RTP data stream marked with dscp 46  or video stream
marked with dscp 34 and so on.   As of recent IOS versions (12,4(9)T + I
think), it can control both inbound and outbound directions, and can do
things like send your traffic to ISP X up to bandwidth Bx and then shift
traffic over to ISP Y up to bandwidth By  to do dynamic load sharing of
traffic to IP transit commit levels Not a bad feature for free.
Larger scale deployments should probably use a dedicated controller box
making the re-routing decisions, but any WAN egress point to an Internet
or private WAN provider is your border device used by the master to
get information, setup probes and learn netflow data to make decisions.


I've used it for testing purposes on enterprise WAN deployment and it
works pretty well.  We are planning on deploying on a production DMVPN
solution when the MGRE bug below is resolved.  My main beef is a bug
related to use of PfR on mGRE tunnel interfaces and the memory-hog
nature of the feature... It will detect your brown-out issues like
increased packet loss for traffic through provider X that cause
customers to call you about broken applications and will re-route the
traffic so you may never even know there was an issue!!  The solution is
particularly good for enterprises with only a few WAN or Internet exits
from a location and for dynamically load sharing traffic to paid-for
commit levels to reduce recurring cost and get the most out of existing
connectivity without paying burst charges.  We've done testing on use
for our internet border routing in the advice mode, where is just says
what changes it would maek, without actually making the changes.
Production deployment soon as part of the ever popular cost-reduction
efforts currently in vogue in enterprises right now given the current
economy.


http://www.cisco.com/go/pfr


There's some similar solutions out there.. RouteScience was mentioned,
but I didn't see anyone mention InterNAP FCP, which is part of the basis
for InterNAP's PNAP business model... They also sell it to others
enterprises and ISPs. 



-Original Message-
From: Ken A [mailto:k...@pacific.net] 
Sent: Thursday, March 12, 2009 9:18 AM
To: nanog@nanog.org
Subject: Re: Redundant Array of Inexpensive ISP's?

Tim Utschig wrote:
 [Please reply off-list.  I'll summarize back to the list if there is 
 more than a little interest in me doing so.]
 

Please do. There are many rural ISPs and WISPs that might benefit from a
decent look at these products, or any open source clones that might be
available to test  refine these tricks.

Pricing for even a fractional DS3 in the rural US is still very high. 
Being able to shift bandwidth from a colo facility in a large city to a
remote site served by 3 or 4 consumer grade broadband links could be a
helpful development, if the bottom line works out.

Thanks,
Ken

 I'm curious if anyone has experience with products from Talari 
 Networks, or anything similar, and would like to share.  Did they live

 up to your expectations?  Caveats?
 

--
Ken Anderson
Pacific Internet - http://www.pacific.net