April 2004 - Test - lists.nanog.org

L2TPv3 encaps performance
by Joe Abley 28 Apr '04

28 Apr '04

Someone asked me the other day if I could recommend some L2TPv3 tunnel termination devices which might be capable of encaps/de-encaps of traffic which bursts near to 1Gbit/s (e.g. with GE uplinks to a core/transport network, and GE interfaces for hand-off towards the subscriber). Application is providing transparent/pseudowire wide-area ethernet transport service over a routed-IP but non-LDP-capable core. This didn't sound like a particularly hard question, but I couldn't find any performance numbers on L2TPv3 edge boxes anywhere. What boxes exist that can do this stuff at gig speeds? Replies off-list would be fine, I can summarise if there's interest.

1 0

Check Your Routing Table! 85-88/8 active
by Daniel Karrenberg 28 Apr '04

28 Apr '04

It is *now* high time to check whether you see the following pilot prefixes: 85.192/16, 85.255.248/21, 86.192/16, 86.255.248/21, 87.192/16, 87.255.248/21, 88.192/16, 88.255.248/21. If you do not see all of these prefixes it is extremely likely that you will have a connectivity problem shortly. We also suggest that you check any packet filters you may be responsible for. Regards Daniel Karrenberg RIPE NCC ------ Notes: This address space has been allocated by the IANA on April 4th 2003, almost a month ago. The fact has been widely announced then. Routing decisions are fully within the responsibility of the network operators. The IANA and the RIRs will only announce which parts of the address space are currently in use. They have no authority whatsoever over routing decisions taken by you and other network operators. More details about this pilot service of the RIPE NCC can be found at http://www.ripe.net/ripe/draft-documents/deboganising-draft.html . A visibility comparison of the pilot prefixes with some production prefixes can be found at http://www.ris.ripe.net/debogon/debogon.html . Those interested in history, see http://www.ris.ripe.net/debogon/ . Pingable targets exist in all pilot prefixes at t{85,86,87,88}-{16,21}.rrc03.ripe.net , i.e. the target within the /21 pilot prefix of 85/8 is t85-21.rrc03.ripe.net . For testing purposes it is possible to do ping and traceroute originating within the pilot prefixes via http://www.ris.ripe.net/cgi-bin/debogon.cgi . Please use this with prudence. More information on how to do Bogon filtering efficiently and reliably can be found at Team CYMRU: http://www.cymru.com/Bogons/index.html

1 0

Re: TCP/BGP vulnerability - easier than you think
by Iljitsch van Beijnum 28 Apr '04

28 Apr '04

On 23-apr-04, at 8:35, Florian Weimer wrote: >> So I believe filtering out all BGP RSTs on all >> edges is probably a good idea. (Edges and borders.) > The problem is that even if you filter the RST, the state transition > occurs at the side which receives the SYN and generates the RST. This > means that the connection has been desynchronized and will eventually > come down, no further data transfer is possible. Although it doesn't follow from earlier text, on page 71 RFC 793 states that an in-window SYN should reset an ESTABLISHED session. So you are right. This is very bad. BTW, anyone seen anything supporting Paul Watson's claim that all it takes to break a session is four packets? I assume he's talking about this vulnerability that was fixed in FreeBSD in 1998: http://ciac.llnl.gov/ciac/bulletins/j-008.shtml I certainly hope our collective favorite vendors didn't overlook this one.

6 7

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ?
by Alexander Hagen 28 Apr '04

28 Apr '04

What about a 7505 w/ RSP4/256 and 2 VIP 2-50/128s with 4 PA-FE-TXs. For additional port density a 3550 ? What is better about the 7206 VXR ? Alexander Hagen Etheric Networks Incorporated, A California Corporation 527 Sixth Street No 371261 Montara CA 94037 Main Line: (650)-728-3375 Direct Line: (650) 728-3086 Cell: (650) 740-0650 (Does not work at our office in Montara) Home: (Emgcy or weekends) 650-728-5820 fax: (650) 240-1750 http://www.etheric.net -----Original Message----- From: Charlie Khanna - NextWeb [mailto:charlie@nextweb.net] Sent: Sunday, April 25, 2004 11:14 PM To: 'Alexei Roudnev'; 'Alexander Hagen'; 'Mikael Abrahamsson' Cc: 'Robert E. Seastrom'; 'Tom (UnitedLayer)'; nanog(a)merit.edu Subject: RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ? Depending on the role of the device a 3550 'might' work out fine. For example, if you have a base station and you have route-reflection setup, a 3550 might work fine. However, you cannot put a 3550 at the PAIX (colo) and expect to run full BGP with upstream peers. I really think you should go with a 7206VXR-300 as a low end BGP solution. It will provide you the following that the 3550 will not: 1) Scalability and WAN connectivity. For example, if you need to terminate a DS3, you can do that with a 7206, but not a 3550. 2) You cannot run MPLS or IPv6 on a 3550 as it's not supported on this platform. 3) 7206-VXR chassis (hot-swap), with an NPE 300, can be upgraded to an NPE-400, and then to an NPE-1G (if you need it to). -Charlie -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Alexei Roudnev Sent: Sunday, April 25, 2004 10:31 PM To: Alexander Hagen; 'Mikael Abrahamsson' Cc: 'Robert E. Seastrom'; 'Tom (UnitedLayer)'; nanog(a)merit.edu Subject: Re: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ? Hmm; why do you want to keep BGP on a switch instead of installing separate router? Do you have a very wide uplink (uplinks)? // I do not object an idea. > > Yes. I've been looking at it and a 7505 with a 3550 behind it seems > the way to go for our type of operation. > > As a cost cutting alternative - has anyone played with the 2900 XL > series using sub interfaces to turn them into virtual router ports ? > or vlan groups ? > Is it better to just buy a 3550 ? > > Alexander Hagen > Etheric Networks Incorporated, A California Corporation > 527 Sixth Street No 371261 > Montara CA 94037 > Main Line: (650)-728-3375 > Direct Line: (650) 728-3086 > Cell: (650) 740-0650 (Does not work at our office in Montara) > Home: (Emgcy or weekends) 650-728-5820 > fax: (650) 240-1750 > http://www.etheric.net > > -----Original Message----- > From: Mikael Abrahamsson [mailto:swmike@swm.pp.se] > Sent: Sunday, April 25, 2004 5:09 AM > To: Alexander Hagen > Cc: 'Robert E. Seastrom'; 'Tom (UnitedLayer)'; nanog(a)merit.edu > Subject: RE: Cisco Router best for full BGP on a sub 5K bidget 7500 > 7200 or other vendor ? > > On Sun, 25 Apr 2004, Alexander Hagen wrote: > > > 1) Catalyst 6006 w/ CATALYST 6000 SUPERVISOR ENGINE 1-A, 2GE, PLUS > MSFC > > & PFC > > Yuck. Unless you have very few flows you do not want to use MSFC1/PFC1. > > This platform would be good for a file server with few but highspeed > flows. > > > This system costs somewhere around 1300.00 more than a: > > Cisco 7505 w RSP4 256 Plus (2) VIP 2-50/128 and 3 PA-FE-TX > > > > Obviously the Catalyst is a better unit. But will it be as "burned in" > > and robust as the venerable 7505 ? > > The 7505 will probably handle lots of flows massively better than the > SUP1A. > > -- > Mikael Abrahamsson email: swmike(a)swm.pp.se >

3 2

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 orother vendor ?
by sthaug＠nethelp.no 27 Apr '04

27 Apr '04

> Yes. I've been looking at it and a 7505 with a 3550 behind it seems the > way to go for our type of operation. > > As a cost cutting alternative - has anyone played with the 2900 XL > series using sub interfaces to turn them into virtual router ports ? or > vlan groups ? > Is it better to just buy a 3550 ? If you're only doing basic Ethernet-Ethernet routing, and don't need a full routing table, it's quite possible that the 3550 will perform better than either the 6000/Sup1A or the 7505. You might also consider a 3750, which handles a large number of SVIs better than the 3550. (Yes, I'm seriously suggesting using the 3550 or 3750 alone.) Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

6 13

Anyone else having resend/timout issues with Yahoo mail accounts?
by Nicole 27 Apr '04

27 Apr '04

Lately I have been having lots of problems with yahoo timing out with mail from our mailing list server. (as shown below) Is anyone else having an issue like this with them? People are getting 5-8 messages before it stops. It seems to only be with mail sent from our mailing list server. So I assume its quantity based. Apr 27 14:27:24 lists postfix/smtp[19610]: 9B8925C405: to=<userxxxx(a)yahoo.com>, relay=mx2.mail.yahoo.com[67.28.114.34], delay=12410, status=deferred (conversation with mx2.mail.yahoo.com[67.28.114.34] timed out while sending end of data -- message may be sent more than once) Apr 27 14:27:24 lists postfix/smtp[19610]: 9B8925C405: to=<xxxx(a)yahoo.com>, relay=mx2.mail.yahoo.com[67.28.114.34], delay=12410, status=deferred (conversation with mx2.mail.yahoo.com[67.28.114.34] timed out while sending end of data -- message may be sent more than once) Any help or advice appreciatted! Thanks! Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com

1 0

hotmail issues
by Mark Jeftovic 27 Apr '04

27 Apr '04

We're having a lot of deferrals with connection timeouts for mail destined to hotmail.com, some of the IP's in question are accessable breifly from other locations before they start timing out as well. This is resulting in a lot of hotmail.com bound email backfilling in our queues. Is this some new tarpitting or throttling mechanism, anyone else experiencing it? Can a hotmail admin contact me off-list? -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

4 4

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ?
by Alexander Hagen 27 Apr '04

27 Apr '04

Well this has been quite a stimulating discussion! It appears the sweet spot would be as follows: 7507 Dual A/C Power.....~ 750 Dual RSP4 with 256 MEM .~900 VIP2-50 with 128 MB RAM.~400 Now this can all be obtained for about 2000.00 perhaps... The problem is the Fast Ethernet Interfaces CX-FEIP-2TX ( 400?) PA-FE-TX (250) The PA-2FE-TX is about 1600.00- better to get a second PA-FE-TX with second VIP2-50 Now why is the CX-FEIP-2TX so much cheaper than the PA-2FE-TX ????? Alexander Hagen Etheric Networks Incorporated, A California Corporation 527 Sixth Street No 371261 Montara CA 94037 Main Line: (650)-728-3375 Direct Line: (650) 728-3086 Cell: (650) 740-0650 (Does not work at our office in Montara) Home: (Emgcy or weekends) 650-728-5820 fax: (650) 240-1750 http://www.etheric.net -----Original Message----- From: Roldan, Brad [mailto:BRoldan@covad.com] Sent: Sunday, February 08, 2004 12:40 PM To: Alexander Hagen Subject: RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ? Alex, I used the RS3000 extensively in a previous life for a Metro E provider. These are great Layer 2 switches. When it comes to Layer 3 services, Riverstone has been lacking. The last firmware revision I looked at was in the 9.x series. At that time, routing protocols, such as BGP, were still evolving in terms of basic support. For instance, at the time BGP communities were not supported. I don't know hoe Riverstone's support for Layer 3 routing has evolved since 9.x. Hope this helps. Brad -- Covad Communications 2510 Zanker Road San Jose, CA 95131 +1-408-434-2048 broldan(a)covad.com -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Alexander Hagen Sent: Saturday, February 07, 2004 5:49 AM To: nanog(a)merit.edu Subject: RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ? Montara is between Pacifica and Half Moon Bay. Everyone has a different perspective - but all valid. However I would say if you are going to go Cisco - and you have no other BGP gear under Smartnet - you might look at the 3725 maxed out. It is new and you will get support and available for 5,000.00 online, equipped with two onboard Fast Ethernet ports. You are likely to buy only single FE modules at 350.00 rather than 2FE's which are hard to find for cheap, and upgrading memory to 256 Megs DRAM is only an addl 150.00. With that said.... I found a rather stupid article that gave the Riverstone high marks. http://www.nwfusion.com/reviews/2003/0714rev.html?page=1 http://research.mwjournal.com/data/jspdetail?id=1025118725_252&type=PROD &src=mwave&x=841473789 The RS 3000 has 20 gbps non blocking. I am likely to go with the Riverstone. I think I can get it for under 2K with 24 10/100 ports, 256 MB of memory, and 20 gbps non blocking switching fabric. Although I will likely place a Cisco box behind it (eventually) for IPSec and the like. Platform Features Feature-rich Wire-speed Services * IP routing, unicast, and multicast * Routing in hardware on each line card * LSR and LER MPLS support in hardware * RSVP-TE and LDP label distribution and signaling * MPLS traffic engineering support * Security (ACLs, L2 filters) * Layer 4 application-flow switching and QoS * Network Address Translation (NAT) * Hardware-based Rate Limiting * Jumbo Frame support * VLANs based on port or protocol * Server Load Balancing (LSNAT) Highly Fault Tolerant * Redundant power supplies (RS 3000) * Hot-swappable media modules * Standards-based VRRP * Layer 2 and 3 redundant protocol support Extensive Management * Wire-speed full RMON/RMON2 * SNMP manageable * SSH * RADIUS * TACACS+ * RS-232 (out-of-band management) * Command Line Interface (CLI) Interfaces 10/100 Base-TX 100 Base-FX 1000 Base-SX 1000 Base-LX 1000 Base-TX 1000 Base-LH (70Km) T1/E1 T3/E3 ATM-OC-3c Up to 4,096 VLANs Up to 256,000 routes Up to 20,000 security/access control filters Up to 512,000 Layer 4 application flows Up to 256,000 Layer 2 MAC addresses RS 1000: 12 Gbps non-blocking switching fabric RS 1000: 4.6 million packets per second routing throughput RS 3000: 20 Gbps non-blocking switching fabric RS 3000: 9.5 million packets per second routing throughput MTBF (predicted) > 200,000 hours Physical Dimensions: 3.25" H x 17" W x 18.5" D (8.25 cm x 43.2 cm x 47 cm) Weight: 20 lbs. (9.1 kg) Environmental Specifications Operating Temp: +0º to +40ºC (32º to 104ºF) Non-operating Temp: -40º to +70ºC (-40º to 158ºF) Operating Relative 10% to 90% (non-condensing) Humidity: Non-operating 5% to 95% maximum Relative Humidity: (non-condensing) Altitude, Operating 10,000 ft (3,000 m) maximum and Non-operating: Shock and Vibration:GR63 Power Requirements AC Input current: 3.0 A - 1.5 A AC Input voltage: 100 to 240 VAC AC Frequency: 50 to 60 Hz DC Input current: 8.0 A DC Input voltage: -48 to -60 VAC Agency Standards and Specifications Safety: Certified UL1950, CSA C22.2 No. 950, EN60950, IEC950, and 72/73/EEC Electromagnetic Compliant with the requirements of compatibility: FCC Part 15, CSA C108.8, EN55022, VCCI, EN50082-1, and 89/336/EEC Standards Supported IETF Standards Support RFC No. Title RFC 768 UDP RFC 783 TFTPv2 RFC 791 IP RFC 792 ICMP RFC 793 TCP RFC 826 ARP RFC 854 Telnet RFC 951 BootP RFC 1058 RIP v1 RFC 1075 DVMRP RFC 1112 Host Extensions for IP Multicasting RFC 1157 SNMPv1 RFC 1195 Use of OSI IS-IS for Routing in TCP/IP and Dual Environments RFC 1245 OSPF Protocol Analysis RFC 1246 Experience with the OSPF Protocol RFC 1256 ICMP Router Discover Message RFC 1265 BGP Protocol Analysis RFC 1266 Experience with the BGP Protocol RFC 1267 BGP-3 RFC 1269 Definitions of Managed Objects for BGP-3 RFC 1332 PPP IPCP RFC 1349 Type of Service in the Internet Protocol Suite RFC 1397 Default Route Advertisement in BGP-2 and BGP-3 RFC 1403 BGP OSPF Interaction RFC 1519 CIDR: an Address Assignment and Aggregation Strategy RFC 1542 Clarifications and Extensions for the Bootstrap Protocol RFC 1552 PPP IPXCP RFC 1570 PPP LCP Extensions RFC 1586 Guidelines for Running OSPF Over Frame Relay Networks RFC 1587 OSPF NSSA Option RFC 1631 IP NAT RFC 1638 PPP BCP RFC 1657 Definitions of Managed Objects for BGP-4 using SMIv2 RFC 1661 PPP RFC 1662 PPP in HDLC-like Framing RFC 1745 BGP-4/IDRP for IP and OSPF Interaction RFC 1765 OSPF Database Overflow RFC 1771 BGP-4 RFC 1772 Application of BGP in the Internet RFC 1773 Experience with the BGP-4 Protocol RFC 1774 BGP-4 Protocol Analysis RFC 1793 Extending OSPF to Support Demand Circuits RFC 1812 Router Requirements RFC 1918 Address Allocation for Private Internet Space RFC 1923 RIPv1 Applicability Statement for Historic Status RFC 1930 Guidelines for creation, selection, and registration of an AS RFC 1966 BGP Route Reflection Alternative to full mesh IBGP RFC 1990 PPP MLP RFC 1997 BGP Communities Attribute RFC 1998 BGP Community Attribute in Multi-home Routing RFC 2082 RIP-2 MD5 Authentication RFC 2131 DHCP RFC 2225 Classical IP and ARP over ATM RFC 2236 Internet Group Management Protocol, Version 2 RFC 2270 Using a Dedicated AS for Sites Homed to a Single Provider RFC 2328 OSPFv2 RFC 2329 OSPF Standardization Report RFC 2236 IGMP-2 RFC 2338 VRRP RFC 2362 PIM-SM RFC 2370 OSPF Opaque LSA Option RFC 2385 Protection of BGP Sessions via the TCP MD5 Signature Option RFC 2390 Inverse Address Resolution Protocol RFC 2391 LSNAT Load Sharing using IP Network Address Translation RFC 2427 Multi-protocol Interconnect over Frame Relay RFC 2439 BGP Flap Damping RFC 2547 BGP/MPLS VPNs RFC 2453 RIPv2 RFC 2519 A Framework for Inter-Domain Route Aggregation RFC 2570 Introduction to Version 3 of the Internet-standard Network Management Framework RFC 2571 An Architecture for Describing SNMP Management Frameworks RFC 2572 Message Processing and Dispatching for the Simple Network Management Protocol (SNMP) RFC 2573 SNMP Applications RFC 2574 User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) RFC 2575 View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP) RFC 2576 Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework RFC 2578 Structure of Management Information Version 2 (SMIv2) RFC 2579 Textual Conventions for SMIv2 RFC 2580 Conformance Statements for SMIv2 RFC 2615 PPP over SONET/SDH RFC 2684 Multi-protocol Encapsulation over ATM Adaptation Layer 5 RFC 2702 Requirements for Traffic Engineering over MPLS RFC 2763 Dynamic Hostname Exchange Mechanism for IS-IS RFC 2796 BGP Route Reflection Alternative to full mesh IBGP RFC 2842 Capabilities Advertisement with BGP-4 RFC 2858 Multi-protocol Extensions for BGP-4 RFC 2865 Remote Authentication Dial In User Service (RADIUS) RFC 2866 RADIUS Accounting RFC 2918 Route Refresh Capability for BGP-4 RFC 2925 Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations RFC 2963 Dynamic Hostname Exchange Mechanism for IS-IS RFC 2966 Domain-wide Prefix Distribution with Two-Level IS-IS RFC 2973 IS-IS Mesh Groups RFC 3031 Multi-protocol Label Switching Architecture RFC 3032 MPLS Label Stack Encoding RFC 3036 LDP Specification RFC 3065 Autonomous System Confederations for BGP RFC 3137 OSPF Stub Router Advertisement RFC 3209 RSVP-TE Extensions to RSVP for LSP Tunnels RFC 3210 Applicability Statement for Extensions to RSVP for LSP Tunnels IETF Standards MIB Support RFC No. Title RFC 1471 PPP-LCP-MIB RFC 1472 PPP-Sec-MIB RFC 1473 PPP-IP-NCP-MIB RFC 1474 PPP-Bridge-NCP-MIB RFC 1493 Bridge-MIB RFC 1657 BGP4 using SMIv2-MIB RFC 1595 SONET/SDH Interface Type-MIB RFC 1695 ATM-MIB RFC 1757 RMON-MIB RFC 1724 RIPv2-MIB RFC 1850 OSPFv2-MIB RFC 1907 SNMPv2-MIB RFC 2011 IP-MIB RFC 2012 UDP-MIB RFC 2013 TCP-MIB RFC 2021 RMON2 using SMIv2-MIB RFC 2096 IP-Forward-MIB RFC 2115 Frame-Relay-MIB RFC 2233 IF using SMIv2-MIB RFC 2358 EtherLike-MIB RFC 2495 DS1, E1, DS2, E2 Interface Types-MIB RFC 2496 DS3/E3-MIB RFC 2618 Radius-Auth-Client-MIB RFC 2668 IEEE 802.3 Medium Attachment Units (MAUs)-MIB RFC 2674 P-Bridge-MIB, Q-Bridge-MIB RFC 2787 VRRP-MIB Standards and Protocols IP routing: RIPv1/v2, OSPF, BGP-4, IS-IS Multicast support: IGMP, DVMRP, PIM-DM, PIM-SM QoS: Application level, RSVP IEEE 802.1D IEEE 802.1p IEEE 802.1Q IEEE 802.1x IEEE 802.3 IEEE 802.3ad IEEE 802.3u IEEE 802.3x IEEE 802.3z Alexander Hagen Etheric Networks Incorporated, A California Corporation 527 Sixth Street No 371261 Montara CA 94037 Main Line: (650)-728-3375 Direct Line: (650) 728-3086 Cell: (650) 740-0650 (Does not work at our office in Montara) Home: (Emgcy or weekends) 650-728-5820 fax: (650) 240-1750 http://www.etheric.net -----Original Message----- From: william(a)elan.net [mailto:william@elan.net] Sent: Saturday, February 07, 2004 5:19 AM To: Alexander Hagen Subject: Re: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ? 7500 is your best option indeed, I'm using several of these and have close to 300Mb passing through at max, primarily ethernet, but also have serial and ATM interfaces; multiple BGP feeds with full table and quite complex access lists - and its all WORKING! One thing to remember is that while 7500 line was started long ago, there have been new router cards and VIP cards released. So if you have 7500 with RSP4 or RSP8 and use VIP2-50 with newear PA modules, you're really not in 1995 any more... For VOIP you'll need different routers but I don't think you were talking about using your core router to provide voip handoffs. Traffic accounting is working fine with 7500 and external unix system that actually does it though SNMP. P.S. Where is Montara located? I see familar 650 area code and I though I knew all the cities nearby, but definetly never been to Montara... On Sat, 7 Feb 2004, Alexander Hagen wrote: > > I have been looking for a sub 5K router on the used market to support > around 30-50 megs peak traffic. > > I have found the 7507/7513 but these things appear to have been > manufactured in 1995 ! > > Then there is the 7206 and the 7206 VXR - I guess the 7206 itself is > just as old as the 7507 and 7513 and the same price at the least - > perhaps because of its form factor. > > The 7206 VXR makes me feel a little better - as it was manufactured in > 1999? > > We are looking at a pure Ethernet environment - but with the desire to > support a lot of value added services - such as IPSEC, VoIP, traffic > accounting. Cisco's have traditionally been good at PRI and T-1 and T-3 > type interfaces - which we don't really need -which leads me to think > Foundry might be an option. > > Juniper appears to be at least 7,000.00 - and I am worried about support > - based on other articles I have seen. > > So the question is would a layer 3 switch be a good idea with a lot of > memory - for example the Cat 6509 ? > > Perhaps foundry BigIron with Jetware ? > > Please give me your thoughts - it is hard to believe that the 7507 and > 7513 are my best options.... > > Alexander Hagen > Etheric Networks Incorporated, A California Corporation > 527 Sixth Street No 371261 > Montara CA 94037 > Main Line: (650)-728-3375 > Direct Line: (650) 728-3086 > Cell: (650) 740-0650 (Does not work at our office in Montara) > Home: (Emgcy or weekends) 650-728-5820 > fax: (650) 240-1750 > http://www.etheric.net

10 12

Juniper & DoS
by Alex Bligh 27 Apr '04

27 Apr '04

Guys, Which Juniper router do I need to /realistically/ (i.e. I have seen it do this in practice, not it says it will do this in the specs, which I can read myself) cope with and filter out 1Gbps of small packet DoS, while still carrying a full table and generally behaving like a happy beast. I don't need lots of ports (3xGigE will do) and am looking for the smallest box that will do the job. I will summarise off-list responses to the list. Alex

1 0

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ?
by Michel Py 26 Apr '04

26 Apr '04

> David Barak wrote: > the m7i is a lot of power for not so much money, If you know of one for sale for 5K, please let me know. >> Rodney Dunn wrote: >> That's the most common deployment mistake I see made >> with the 75xx nowadays. People want to move to dCEF to >> get added feature capability or either run a new feature >> that requires dCEF and they don't consider the extra >> load on the VIP CPU's that is required. > jlewis(a)lewis.org wrote: > Does dCEF use much more CPU on the VIPs or just memory > (to store the fowarwarding table on the VIP)? Oh yes. And there are plenty of ways to mess it up, too. I never dared running things such as QoS policy propagation via BGP plus dCAR/dwRED on a 7500. Maybe on a VIP6, any takers? On a VIP2-50/128 as Alexander mentioned, fugged about any extra features. > My experience has been that a 7500 with RSP4's and VIP2-50's > (with dCEF) will handle much more packet forwarding than a > 7206VXR NPE300... This is true but only if you're not fancy. VIP2-50 is a 200Mhz R5000, that's slightly better than a 3640, not fast by any means. That's what you find in a PDA these days. Just handling traffic for two FE PAs will get it pretty busy already. > but with full BGP routes, you need at least 64mb (preferably > 128mb) on the VIPs or you can't use dCEF. Not using dCEF > largely defeats the purpose of using a 7500, doesn't it? Indeed. > You'd get a 7507 (only if it were a choice between that > or a 7505?), but then at the end of your message, you say > you wouldn't buy any 7500? Only if it were a choice between that and a 7505. > A basic 7507 (dual PS, dual RSP4, couple of VIPs and PAs) > is so cheap today, if he's strapped for cash, that's what > I'd go for. I'm guessing you can still get at least several > years out of such a box, and by the time you've outgrown it > or cisco stops making IOS for it (they still make IOS for > AS5200's!), hopefully you'll have the cashflow to upgrade. That summarizes is well, it's a pay me now or pay me later thing. The 7206 might be a little pricier but it will last longer, and that's one thing to take into account when capexing hardware. The bottom line is that as of today and given 400Mbps of traffic it does cost big buck$ to upgrade the 7500 to RSP16 and VIP6 to be able to run everything, and that would not be a wise investment I think. Michel.

1 0