jlewis@lewis.org wrote:
Do we then also buy/maintain VPN hardware to connect all the various 1918 management networks to the NOC?
Um, it isn't that hard or expensive. I just put an older box -- like a 133 or 200 MHz machine -- at each pop, running OpenBSD. Allows a simple VPN throughout, and runs ntpd, too. And sometimes running a remote copy of MRTG at a particular POP is nice for hunting down infected local DSL customers without tying up the backbone. Look, it's a lot less costly than the routers, the DSLAMs, even the managed switches. My main difficulty is they aren't rackable (just old desktop machines), so they sit in the bottom of the rack. Someday, someday. It's time we all run with better security. (As we frantically put in more filtering in the middle of the night based on the report -- no matter how proactive we try to be, the bar keeps moving and moving.) -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32