CPE that support 1G with BGP multihomed
Raymond Burkholder
ray at oneunified.net
Sat Sep 30 03:00:11 UTC 2017
On 09/26/17 06:29, marcel.duregards--- via NANOG wrote:
> Dear Nanoger,
>
> Anyone have an advice on CPE which can support the following features,
> please:
I've been building cpe devices using various models from
http://www.lannerinc.com.
I populate with Debian linux:. I use pxeboot to autoboot into install
mode with dnsmasq providing deb-install preseed build files. On the
auto reboot after o/s install, I finish up with consistent, documented
builds with SaltStack. This provides the necessary customized
switching, routing, security, and monitoring.
Raymond Burkholder
https://blog.raymond.burkholder.net
441 705 7292
> 1)
> 1 Gigabits/s ipv4 or ipv6 forwarding IMIX or Internet traffic, full
> duplex (not sure if cisco or miercom are conducting bidirectionals
> traffic flows at the same time).
With an FW-7543, I can iperf bidirectional 1gbps with no acl. I can get
strongswan ipsec bidirectional at about 50mbps (the cpu has AES-NI). I
havn't tried ipsec on devices like the FW-7573.
>
> 2)
> with ACLs and with uRPF
> with prefix filtering
> with bgp ext-communities (rfc 8092 would be a ++, but not mandatory)
I can customize configs with various combinations of VRRP,
FreeRangeRouting BGP/OSPF (full routes are no problem), nftables for
ACL, lldpd, hostapd for wireless, openvswitch for bridging
requirements/netflow/sflow ...
The linux kernel supplies uRPF. FreeRangeRouting (a fork of Quagga) can
do prefix filtering, ext-communities, etc. They have even recently
implemented EVPN using VxLAN for encapsulation.
> 3)
> with BGP full route, 1 eBGP session + 1 iBGP (--> multihomed, single
> attached solution, so there is 2 CPE connected to 2 bgp transit))
I've used the FW-7543 in pairs to a customer for this: a management
port, a port between the two, an upstream port, and a downstream port.
> 4)
> vrf light and
> SNMP + telnet/ssh with ACLs
Linux kernel has VRF capabilities, or use namespaces or native
containers for segregation of functions or for implementing virtual
functions.
>
>
> Currently on Cisco side, we see the following candidates:
>
> - ASR 1001-x
> - ASR 1002
> - ISR 4431, 4451
> - ISR G2 2921 + 2951 + 3925(E) (EoL soon, so we are currently in the
> process of evaluating other solution).
>
>
> But we would like also to include other manufacturer : juniper, mikrotik
> , etc....
>
>
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the NANOG
mailing list