- NANOG - lists.nanog.org

RE: Best Practices for Enterprise networks
by Fergie (Paul Ferguson) 30 Aug '04

30 Aug '04

Of course it can work. My point is that it is a fact of life, nothing more. Pointing out the obvious: Dependent upon who is/are your upstream provider(s), and how specific the prefix announcements are made to their peers (re: your reachability) determines just how symmetric your traffic patterns will be. - ferg -- "Michel Py" <michel(a)arneill-py.sacramento.ca.us> wrote: > Asymmetric paths are a fact of life in the Internet. Not for enterprise operators except the largest ones. Asymmetric traffic does happen in the core, where there are no firewalls or NATs; as far as the edge is concerned though I know several companies that multihome to two or more ISPs but only in one location, largely because they don't want to deal with NAT/firewall issues. Although it can work, it requires extra engineering and most of the time a fat pipe to replicate state information between the sites. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: Best Practices for Enterprise networks
by Fergie (Paul Ferguson) 30 Aug '04

30 Aug '04

Asymmetric paths are a fact of life in the Internet. - ferg -- Iljitsch van Beijnum <iljitsch(a)muada.com> wrote: On 30-aug-04, at 0:50, Tracy Smith wrote: > Hello. I am tyring to gauge what the Best Practices are for > Enterprise network connections to the Internet. Specifically, to NAT > or not to NAT? At what point should NAT-ting be performed ... > exclusively at the Egress point or at decentralized points? What > about firewalling - centralized/decentralized? Fortunately, I've never been in the position to make such decisions, but I can tell you one thing: if you have multiple connections to the internet, you had better make sure that your NATs and firewalls are equipped to handle the case where you send a packet out through connection A and the reply comes back through connection B. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

Best Practices for Enterprise networks
by Tracy Smith 29 Aug '04

29 Aug '04

Hello. I am tyring to gauge what the Best Practices are for Enterprise network connections to the Internet. Specifically, to NAT or not to NAT? At what point should NAT-ting be performed ... exclusively at the Egress point or at decentralized points? What about firewalling - centralized/decentralized? Thanks in advance for any feedback! Tracy Smith tsmith(a)illinois.net

2 1

10 GE WAN PHY status?
by Stefan Mink 29 Aug '04

29 Aug '04

Hi, I'm currently looking into how to best integrate 10G lambda lines into a network. The two obvious ways are via "native" SDH/SONET or via 10 GE WAN PHY, but the latter isn't available on any router platform so far. What I like with 10GE is that its possible to run a ring segment via L2-switches on each end and connect to them via multiple L3-devices. So you can basically run a 10G line with a redundant pair of routers on each line concurrently and without any static bandwith partitioning. Am I missing something? Sine none of the long distance providers I talked with so far can provide 10 GE LAN PHY as client side interface, I'm currently looking for L2-switches that can perform this conversion between LAN and WAN PHY, but I only found the Nortel Passport and the Force10 E-Series, both AFAIK quite pricy product lines. Last informations I got about WAN PHY XENPAKs was that most switch manufacturers can only provide them sometime in Q1/2005 (but I read the same in an article on this list about Q1/2004 :] ). Are there other products I missed? Are there XENPAKs already available which work with main stream switch manufacturers although they don't sell them themselves so far? Grateful for any pointers or experiences... tschuess Stefan -- Stefan Mink, Schlund+Partner AG (AS 8560) Primary key fingerprint: 389E 5DC9 751F A6EB B974 DC3F 7A1B CF62 F0D4 D2BA

4 7

Fwd: The Internet at 35: Still evolving
by Fergie (Paul Ferguson) 29 Aug '04

29 Aug '04

"Thirty-five years after computer scientists at UCLA linked two bulky computers using a 15-foot gray cable, testing a new way to exchange data over networks, what would ultimately become the Internet remains a work in progress." http://www.cnn.com/2004/TECH/internet/08/29/internet.birthday.ap/index.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: optics pricing (Re: Weird GigE Media Converter Behavior)
by Dickson, Brian 29 Aug '04

29 Aug '04

Aha. It appears I was correct in framing my knowledge as out-of-date. :-) It looks like the technology *has* advanced, and that 10GE on MMF or SMF, single-channel, is what the current state of the art is, and at the $2k-3k unit price. In which case, yes, not offering this (and not building cards to use cheaper and/or more flexible component, ie XENPAK), is likely going to be a huge mistake Cisco. Unless they bite the bullet and do whatever it takes to make xenpak-based 10G cards, on at least some flavour of card on any 10G platform. (I don't really expect a xenpak-compatible version of soho routers to show up, although it *would* be nice as an option on most of their switch families.) So, I sit corrected. ;-) BTW, thanks for pointing this out; it's nice to see that things haven't completely stagnated in the last couple of years. Brian P.S. At that price level, I actually *do* expect another Swede will have, or already has, one or more of this class of box at home. In his WC, even. ;-) P.P.S. He's not crazy. But he *should* have a t-shirt that says "I'm with STUPI". ;-) -----Original Message----- From: Mikael Abrahamsson [mailto:swmike@swm.pp.se] Sent: Sunday, August 29, 2004 12:08 PM To: Dickson, Brian Cc: nanog(a)merit.edu Subject: Re: optics pricing (Re: Weird GigE Media Converter Behavior) Then why can I purchase 10km 10GE Xenpaks directly from the manufacturer for under $2000? > On the other hand, it'd be nice to see a copper 10GBIC, even if its > max cable length were a few metres. ;-) There is one. It's called CX4 and has a reach of 15 meters. Cisco sold it for $600 list price at first but it has now disappeared from the price list. I don't know why. http://www.cisco.com/en/US/products/hw/modules/ps4835/products_data_sheet091 86a008007cd00.html -- Mikael Abrahamsson email: swmike(a)swm.pp.se

1 0

RE: BGP Homing Question
by Michel Py 28 Aug '04

28 Aug '04

>>> Patrick W Gilmore wrote: >>> It is your netblock, you get to use it as needed. >> Michel Py wrote: >> This is not a good reason; it might be a good >> excuse, but not a good reason. > Really? So if I have a /20, you are saying I > cannot use it as I need to use it? No. It's yours you can use it any way you want. What I'm saying is that nor because it's yours neither because you can use it anyway you want make you a good netizen nor guarantees any results. > You do not need to tunnel at all if your two upstreams trade > downstream routes (e.g. "peer"), and the US upstream does not > filter small prefixes from their peers. Indeed, but how can you guarantee it? SNAFUs do happen, for a number of reasons you can't control. Tunneling provides some resiliency when things which are not supposed to happen do in fact pop up from time to time. > As I said in the first post, this is much more common than > the alternative, so chances are it will "just work". No argument here. Michel.

1 0

RE: BGP Homing Question
by Michel Py 28 Aug '04

28 Aug '04

> Patrick W Gilmore wrote: > There is zero "bad citizenry" in this, and don't > let anyone tell you differently. I agree, but not for the reason below: > It is your netblock, you get to use it as needed. This is not a good reason; it might be a good excuse, but not a good reason. > This is much better than getting another /20 for > an EU site that only needs a /24. However, what's above _is_ a good reason. In terms of the size of the routing table, it does not really matter which two prefixes you announce, as the simpl(istic) way to see it is that they take two prefixes anyway. In terms of conservation of the address space it does matter, as announcing a subnet of your ARIN block in Europe is actually being a good netizen because it does not waste an ARIN netblock. > Also, filtering will not be an issue, if you are careful. > Anyone who does not hear the /24 will hear the /20. Rick, you do need to tunnel the EU block from your US location back to your EU location, for people that are behind a filter that masks your /24. It does not happen often but it does happen. This leads to suboptimal asymmetric traffic, double whammy in terms of bandwidth (EU-bound traffic received by the US site from people that see the /20 and not the /24 that has to be re-sent back to EU over the tunnel) and interesting issues with stateful firewalls though. Bottom line is: what Rick is suggesting is actually The Right Thing (tm) to do; the bad netizen would embellish the truth and request a /20 from RIPE instead, as Patrick mentioned. Technically speaking, it is sad to say that the bad thing is more bullet-proof than the right thing though :-( no filtering issues. It's not nearly as bad as it was a few years ago though, as people have finally given up on trying to get a full BGP feed on a 3640 with 128 Megs of RAM. Michel.

2 1

RE: optics pricing (Re: Weird GigE Media Converter Behavior)
by Michel Py 28 Aug '04

28 Aug '04

> Deepak Jain wrote: > One could argue that this public & private chaffing is what > precipitates the competition that alleviates the condition. > If another vendor doesn't realize there is demand... Indeed; I'll even give an idea for free: 4 port OC192 IR $1030k 4 port OC192 VSR - $330k ------ = $700k Someone cares to manufacture a 4-port VSR <-> IR converter for less than $700k list? or a VSR <-> LR for less than $1M? Michel.

1 0

RE: optics pricing (Re: Weird GigE Media Converter Behavior)
by Michel Py 28 Aug '04

28 Aug '04

> Mikael Abrahamsson wrote: > 4 port OC192 IR $1030k > Is there anyone who can justify this pricing > with anything else than "because we can?" That's a heck of a good reason! Any for-profit business tries hard to position themselves where they could name their price. This pricing is consistent with the guesses/predictions that were floating at the time of the product announcement; there was some political will to have a million bucks line card (otherwise they would have priced it at $999,950 ;-). This is Rolls-Royce marketing: if it's so darn pricey it's because it's so darn good. Like Rolls-Royce cars, the ones that buy them are typically not the ones that drive them, so technical arguments tend to become irrelevant. Michel.

2 1