[113692] in North American Network Operators' Group
Re: IXP
daemon@ATHENA.MIT.EDU (Jack Bates)
Sat Apr 18 13:45:41 2009
Date: Sat, 18 Apr 2009 12:44:37 -0500
From: Jack Bates <jbates@brightok.net>
To: "nanog@merit.edu nanog@merit.edu" <nanog@merit.edu>
In-Reply-To: <1446.1240070501@nsa.vix.com>
Errors-To: nanog-bounces@nanog.org
Paul Vixie wrote:
> in terms of solid and predictable i would take per-peering VLANs with IP
> addresses assigned by the peers themselves, over switches that do unicast
> flood control or which are configured to ignore bpdu's in imaginative ways.
>
Simplicity only applies when it doesn't hinder security (the baseline
complexity). PE/BRAS systems suffer from a subset of IXP issues with a
few of their own. It amazes me how much "security" has been pushed from
the PE out into switches and dslams. Enough so, that I've found many
vendors that break IPv6 because of their "security" features. 1Q tagging
is about the simplest model I have seen for providing the necessary
isolation, mimicking PNI. For PE, it has allowed complete L3 ignorance
in the L2 devices while enforcing security policies at the aggregation
points. For an IXP it provides the necessary isolation and security
without having an expectation of the type of L3 traffic crossing through
the IXP.
It's true that 1Q tagging requires a configuration component, but I'd
hesitate to call it complex. 10,000 line router configs may be long, but
often in repetition due to configuration limitations rather than
complex. HE's IPv6 tunnel servers are moderately more complex and have
handled provisioning well in my experience.
Multicast was brought up as an issue, but it's not less efficient than
if PNI had been used, and a structure could be designed to meet the
needs of multicast when needed.
Jack
