On 06/05/13 00:34 +0200, Mikael Abrahamsson wrote:
I read:
http://www.nanog.org/sites/default/files/tues.general.Papandreou.conservatio...
I would like to point out RFC 3069. On most cisco equipment this is done using static routes and "ip unnumbered".
So my question is basically: What am I missing? Why can't data center guys not build their network the same way regular ETTH is done? Either one vlan per customer and sharing the IPv4 subnet between several vlans, or having several customers in the same vlan but use antispoofing etc (IETF SAVI-wg functionality) to handle the security stuff?
VLAN-per-subscriber (1 customer per VLAN), can require more costly routing equipment, particularly if you're performing double tagging (outer tag for switch, inner tag for customer). Sharing an IPv4 subnet among customers is appropriate for residential and small business services, which is how we typically deliver service. But may be less appropriate for larger business customers (and I presume hosting customers) where the number of IPs is large enough that you're throwing away less addresses ratio-wise. Generally the simpler deployment model wins out in that type of scenario. Also, the 'ip unnumbered' approach may require some layer-3 security features. VLAN-per-service (>1 customer sharing a VLAN) is problematic, and typically pushes a lot of IPv4 specific layer-3 security features (MACFF, DHCPv4 snooping, proxy arp, broadcast forwarding/split horizon) down into the access equipment, and that's rarely a perfect feature set. In my experience, IPv6 services lag behind on such equipment because those v4 security features break v6.
One vlan per customer also works very well with IPv6.
+1 -- Dan White