Re: [j-nsp] SSD in RE-S-2000-4096

2018-12-25 Thread Andrew Thrift
Hi Alex, Yes I had great success doing this on around 12x RE2000's I used Intel S3700 200GB SSD's. It lowered the boot time significantly. Regards, Andrew On Mon, Dec 24, 2018 at 4:40 AM Alex Martino via juniper-nsp < juniper-nsp@puck.nether.net> wrote: > Hi, > > Anybody got any success

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-25 Thread Gert Doering
Hi, On Tue, Dec 25, 2018 at 11:22:09AM +0100, Job Snijders wrote: > Already today Junos ships with an OpenSSH client (and server). Yes, and it's an annoyance if you swap a device, replace the backuped config, which does not contain the SSH host keys (so your SSH sessions break with "KEY

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-25 Thread Job Snijders
On Tue, Dec 25, 2018 at 09:08:32AM +0100, Gert Doering wrote: > On Tue, Dec 25, 2018 at 02:46:57PM +0800, Pyxis LX wrote: > > I think SSHv2 or IPSec with good CLI integration would be nice. > > (ex: CLI to manage SSHv2 private keys, OSPFv3-like IPSec > > integration...etc.) TLS might be good but

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-25 Thread Gert Doering
Hi, On Tue, Dec 25, 2018 at 09:45:06AM +0100, Lukas Tribus wrote: > On Tue, 25 Dec 2018 at 09:09, Gert Doering wrote: > > If someone can interfere with TCP packets *inside your network* without > > you noticing, RPKI-RTR is likely the least of your worries. > > I'm not sure I follow ... > >

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-25 Thread Lukas Tribus
Hello Gert, On Tue, 25 Dec 2018 at 09:09, Gert Doering wrote: > If someone can interfere with TCP packets *inside your network* without > you noticing, RPKI-RTR is likely the least of your worries. I'm not sure I follow ... other than using a lower layer encryption like macsec or L1 DWDM

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-25 Thread Gert Doering
Hi, On Tue, Dec 25, 2018 at 02:46:57PM +0800, Pyxis LX wrote: > I think SSHv2 or IPSec with good CLI integration would be nice. > (ex: CLI to manage SSHv2 private keys, OSPFv3-like IPSec integration...etc.) > TLS might be good but as Jared said, certificate revocation might not be > that