- NANOG - lists.nanog.org

Firewall in Routers??
by Tim Crowell 04 Mar '97

04 Mar '97

With all of the recent attacks against ISP services, has anybody considered implementing Checkpoint Firewalls into the CISCO 7513s to front end all traffic from the Internet? Although in theory this sounds feasible from a security standpoint I'm not sure I am comfortable with the processing power that would be required and having anything looking at every packet. It seems that this would introduce a significant latency into the routing of the traffic (which is the function of a router or at least it used to be). I prefer to let my routers route. Interested in any and all ideas on the subject. -- Tim Crowell - GTE Intelligent Network Services tcrowell(a)gte.net Voice: 214.751.3881

8 8

Re: The Big Squeeze
by Sean Donelan 04 Mar '97

04 Mar '97

>To back Paul up here.. >Tests we have run would indicate that this is not _generally_ the case. >I guess it depends on your point of viewing but we certainly see an >inordinate amount of oscillation in the longer prefix ranges. >(It also depends on the parameters you associate with certain prefixes of >course ;-) >(Sorry - no facts and figures to back that up) It also depends on how you mentally group things. I agree, there are a few prefixes that have an inordinate amount of oscillation. But what group membership would I assign them? I've noticed more recently assigned network numbers seem to flap more than older network numbers. Perhaps more importantly, networks in more recently assigned AS numbers seem to flap more. Again, this is just raw observations, no real numbers to back up my feelings. Don't let the way "show ip bgp flap" happens to group networks by prefix control your mental schema. I would much rather see the decision based on how any individual route behaves rather than the 'neighborhood' the network happens to be located in. We might be willing to give a network that has been stable for a long time a few extra flaps. While brand new networks that flap would be better off being 'covered' by a shorter, more stable prefix. Is the goal to encourage stable routes? or encourage short prefixes? >For instance, take this snapshot and note the /24 from within the 153.96 >network. The flap column is the interesting one compared with other class Bs. >This is not representative but gives a flavour of what we have been seeing. > >They are all from the same originator and it would not take a great amount >of effort to apply a null0 tie down ! Or even aggregate them. But you bring up an important point. Often all the routes from the same originator flap together, irregardless of their prefix length. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Firewall in Routers??
by sob＠academ.com 04 Mar '97

04 Mar '97

Glynn writes: > Firewall-1 does address 'hiding' making it look to the external world > like all connects come from a single IP. This should go to the "firewalls" list, I think. Anyway, Firewall-1 version 2.1 and later can do single ip to another ip address translation as well as "hiding" many addresses on one side to make the all look like one on the other. I have done this for my customers who have needed it and wanted to use that product. -- Stan | Academ Consulting Services |internet: sob(a)academ.com Olan | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

1 0

RE: The Big Squeeze
by Jim Fleming 04 Mar '97

04 Mar '97

On Sunday, March 02, 1997 11:28 PM, Paul Ferguson[SMTP:pferguso@cisco.com] wrote: @ At 04:03 PM 3/2/97 -0600, Scott Huddle wrote: @ @ > @ >I'll assert that if the costs of accepting a route announcement are @ >non-zero that this can only happen if there is a market for @ >announcements and a system of settlements between providers. @ > @ >If the costs are zero, then why have the filters? @ > @ @ I'd suggest that costs are non-zero, and they cannot be quantified @ by dollars, at least today. Since the majority of instability in @ the global Internet is originated by prefixes longer than /19's, @ the amount of resources consumed is an exercise left for the reader. @ Would you support charging $$$ for circuits that go in and out of service beyond some reasonable amount ? Car insurance companies charge people more that have more accidents...:-) -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

2 1

Re: The Big Squeeze
by Paul Ferguson 04 Mar '97

04 Mar '97

At 10:30 PM 3/3/97 -0600, Sean Donelan wrote: >From a single data point on my router, /24's currently account for 64% of >the routing table entries and for 65% of the flapping prefixes. /16's >account for 12% of the routing table entries, and 10% of the flapping >prefixes. It doesn't appear to me there is a significant difference >between flap behaivor of long prefixes and short prefixes. There are >more long prefixes than short prefixes. But as a group they both tend >to flap the same proportion of 2% of the routes within the group. Sorry, I'm not convinced this is the case. There is not enough empirical evidence. - paul

2 1

Re: The Big Squeeze
by Eric Kozowski 04 Mar '97

04 Mar '97

>>From a single data point on my router, /24's currently account for 64% of >>the routing table entries and for 65% of the flapping prefixes. /16's >>account for 12% of the routing table entries, and 10% of the flapping >>prefixes. It doesn't appear to me there is a significant difference >>between flap behaivor of long prefixes and short prefixes. There are >>more long prefixes than short prefixes. But as a group they both tend >>to flap the same proportion of 2% of the routes within the group. > >Sorry, I'm not convinced this is the case. There is not enough >empirical evidence. Is there any empirical evidence to show otherwise? Id' be interested in seeing it. -- Eric Kozowski Senior Network Engineer eric(a)structured.net Structured Network Systems, Inc. (503)525-9375 FAX http://www.structured.net/ (800)881-0962 Voice PGP Key fingerprint = 2E 5F 3E 6D AA 61 AA 14 D8 FB A4 15 CE 2C D8 8C 'They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.' -- Benjamin Franklin 1759

1 0

Re: The Big Squeeze
by Sean Donelan 04 Mar '97

04 Mar '97

>Computational power required for a route flap is not the issue here. > >Many people have stated that, statistically longer prefixes flap >more. Unfortunately, they have then said that because of this shorter >prefixes should have looser dampening parameters put on them, when >what they really meant was that the longer prefixes should have more >strict dampening parameters put on them. Yes it is exactly the same >thing, but it is an important semantic distinction. If a group of >prefixes categorized by a its length tends to flap more than the >average, then said group should have more strict dampening parameters >placed on it. Statistics are soo much fun. >From a single data point on my router, /24's currently account for 64% of the routing table entries and for 65% of the flapping prefixes. /16's account for 12% of the routing table entries, and 10% of the flapping prefixes. It doesn't appear to me there is a significant difference between flap behaivor of long prefixes and short prefixes. There are more long prefixes than short prefixes. But as a group they both tend to flap the same proportion of 2% of the routes within the group. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Caveat Emptor....
by Tony Li 03 Mar '97

03 Mar '97

This is somewhat off topic, but there's no better place... It has come to my attention that a certain significant router vendor's representatives have told some of their prospects that I've worked on their system. Just to set the matter straight, my total employment for the past 6 years has been either at Juniper Networks or at Cisco Systems (or at cisco Systems ;-). If you've heard otherwise, I would very much appreciate hearing from you as I'm contemplating legal action... So far, I have no reason to believe that this is the policy of the aforementioned vendor. In fact, I suspect that it's an overzealous salesdroid. Caveat Emptor. Thank you for your attention. We now return you to your regularly scheduled drivel. ;-) Tony

1 0

Re: "routing table slots" and the real problem
by Justin W. Newton 03 Mar '97

03 Mar '97

At 06:16 PM 3/3/97 -0500, Nathan Stratton wrote: >On Mon, 3 Mar 1997, Gary Zimmerman wrote: > >> Has anyone looked at Ascend's (NetStar Gigarouter). We have and like the >> direction. If they continue to deliver, I think they are going in the >> right direction. Still some parts missing, I hope we can hold on until >> they get here, but the direction is right. I think the open idea is the >> only way to go on this issue. > >We have been using them for about 5 months now, and I like them a lot. We >have worked with Ascend to fix a large numbers of problems. They are very >stable now, and have a lot of people working to make them better. Out of curiosity, where in your network are you using them? What kind of traffic loads are they seeing, etc etc? Justin Newton Network Architect Erol's Internet Services ISP/C Director at Large

1 0

Re: "routing table slots" and the real problem
by garyz＠savvis.com 03 Mar '97

03 Mar '97

Has anyone looked at Ascend's (NetStar Gigarouter). We have and like the direction. If they continue to deliver, I think they are going in the right direction. Still some parts missing, I hope we can hold on until they get here, but the direction is right. I think the open idea is the only way to go on this issue. Gary Zimmerman Savvis Communications http://www.savvis.com email: garyz(a)savvis.com "The only limits are those of vision." ---------- > From: Joseph T. Klein <jtk(a)titania.net> > To: nanog(a)merit.edu; Paul Ferguson <pferguso(a)cisco.com> > Subject: Re: "routing table slots" and the real problem > Date: Sunday, March 02, 1997 5:25 AM > > Warning -- I feel a diatribe emerging. ;-) > > Afordability is primarily a question of how large your existing > base of legacy routers is and your cash flow. > > You can build a box using a free versionof Unix (FreeBSD, NetBSD, > Linux, or whatever your religion of the day), off the shelf > hardware, and gated to route a full backbone routing table > (memory and CPU are cheap) for less than $3K. This is less > than the cost of a single interface card for a Cisco 7xxx! > > Kids; do not try this at your gateway without adult supervision. > :-) > > We are re-designing the Internet to make up for the fact the > largest manufacturers of routers has been slow to develop and > deploy systems that can keep up with the growth curve. A lot of > this comes down to size of the memory bus on low cost systems. > > If port density was not so poor on general purpose hardware, we > would have been far better off deploying "open systems" for routers > rather than what exists today. > > I have always liked my Ciscos, but I truly love routing with my Unix > systems running gated. ... now If I could find some cheap channelized > DS-3 cards for a DEC AlphaStation 500. ;-) > > I may be talking out of my hat here, but I suspect a DEC AlphaStation > 500 with 256M of RAM ranks pretty well against a 75xx. > > Somebody, dig up the stats for me ... > > If router manufacturers worked on hardware and all used an open > software standard ... such as gated ... we would all be better off. > Open standards allow all of us to benefit from the work of others. > The old Unix Guru's mantra is 'build on the works of others.' > > Let us not make the mistakes of the 1890s and associate domination > of the market by oligopolies as good capitalism. Big corporations, > like big government, tend to move slowly. > > Open markets NOT dominated by a single large player is GOOD > capitalism. It increases the pace of innovation and prevents > price fixing. It makes for a healthy, dynamic, marketplace. > > This holds true for routers, backbone providers, toasters > and operating systems (sorry Bill) > > open standards = open markets > > Open standards prevent the failures of a single market > player from inhibiting the growth of the industry. > > Open standards lower the cost to upgrade large installed > systems. > > Reductions in the federal budget are squeezing R&D expenditures in > the US to an all time low. Large corporate downsizing and corporate > mergers have done the same for most large corporations. The bulk > of innovation in the US will come from small companies and > development consortiums. > > It is from these that the next generations of routers will > come. Open standards make the rapid utilization of new > technologies possible and fuel the growth of small companies. > > The Internet is a great place for consorting on standards. > This is what is cool about the IETF! > > Standards do not keep the big boys from playing ... > Cisco and Bay could easily join in an open standard > for router software. It would not be hard to have interoperability > between the IP portions of IOS and gated. > > IOS is the PL-1 of routers. Bay's management reminds me of CICS. ;-) > > Back to the subject ... > > You CAN also use the RA (where available) to reduce your routing > overhead, save memory and reduce CPU usage. (The RA runs a hacked > version of gated that calculates large routing tables quite well.) > > Hmm ... > > router $100,000 amortized over 3 years = 2,800/month > going DS-3 price at a NAP with line = 7,000/month > engineer $70,000 per year min. = 5,900/month > overhead for a small company = 20,000/month > > $50+/month/mile for OC-3 lines ... don't even talk about > local loop costs! > > Routers connect customers. > customers = cash flow. > > The highest cost of running a national network is not buying routers, > it is bandwidth, staff, and administrative overhead. > > Router cost is primarily a factor for smaller networks with limited > cash flow. > > I contend ... > > It is the ISPs who try to be dual homed with 'routing tricks' rather > than using edge routers that can process a core routing table, who > contribute most to routing instability. > > Boardwatch stated that 14% of ISPs are dual homed. I would bet > that 70% of those do not use routers capable of processing a core > routing table. > > Anybody have any stats? > > We need cheap routers that run BGP4 and can eat a core routing table. > 2501s just don't hack it in dual homed configurations ... and most > small guys just don't wish to blow $50,000 on putting 7505s at the > edges of their networks. > > > --- On Sun, 02 Mar 1997 13:48:46 -0500 Paul Ferguson <pferguso(a)cisco.com> wrote: > > At 01:39 PM 3/2/97 -0500, Perry E. Metzger wrote: > > > > > > > >True enough. Of course, this doesn't mean that we can't have routing > > >table growth, as we will have processor capacity growth, but it does > > >mean that the growth of the routing tables must be kept in line with > > >what the router processors can do. > > > > > > > True enough. However, it might also be novel to keep the cost > > down to a level that people can actually afford. > > > > - paul > > > > ---------------End of Original Message----------------- > > -- > From: Joseph T. Klein, Titania Corporation http://www.titania.net > E-mail: jtk(a)titania.net Sent: 13:25:09 CST/CDT 03/02/97 > > "They that can give up essential liberty to obtain a little temporary > safety deserve neither liberty nor safety." > -- Benjamin Franklin, 1759

2 1