Anyone deployed FlexCAP2 ADSL?

Wed Jan 28 19:09:58 UTC 1998

>Has anyone on this list deplyed an ADSL network using Westell's FlexCAP2
>product? I have some network engineers telling me that they need to use an
>entire /29 of 8 IP addresses for each single subscriber connection. This
>doesn't seem right to me and I'd love to talk with someone who has
>actually deployed this stuff..

I've been looking into ADSL, and this doesn't seem right to me.
Historically, I  have assigned employees a /29 so that they can have
multiple machines at home with global network addresses if they indicate
they have multiple machines, but thats not a requirement. They can easily
get along with a single address and a NAT.

>The ADSL component basically provides an Ethernet bridge between the
>subscriber and the CO. The network engineers that I am dealing with tell
>me that these bridged Ethernet connections have to go into a Catalyst 5500
>switch in which each Ethernet port is on a separate VLAN in order to
>prevent neighbors from sniFfing each other's traffic. And because of the
>VLANs in the 5500 with 2 RSMs, they need to allocate a block of 8 globally
>routable IP addresses in order to supply a subscriber with one globvally
>routable host connection.

Ah. Thats a slightly different requirement. The advantage of the VLANs is
that they prevent distribution of all traffic including broadcast traffic
to other VLAN's as in the picture below.  Are you committed to this type of
network design?

     Cat Etherswitch -- ADSL bridge -- Customer1 Ethernet
       ^- x.1 -------------- VLAN ------------ x.* -^
                     \-- ADSL bridge -- CustomerN Ethernet
       ^- y.1 -------------- VLAN ------------ y.* -^

I actually have some customers within our Boston building who are connected
this way, but I had spare ethernet ports on the router, rather than a VLAN.

The early Xylan VLAN's I think were limited in their size. Basically, they
have an internal table that could overflow.  As I recall, when it
overflows, performance is degraded, but traffic isn't sent to everyone. I'm
not sure on the catalyst.  I used the Xylans back in '94 or so to connect
multiple ethernet and token ring networks over a single fiber pair between
offices on different floors in a large office building,turning 2 Xylan
boxes into big IP multiplexors to handle a very large number of fairly
small IP networks for testing purposes.  But the equipment has changed a
lot since then, and is quite a bit better, now.

In the above case though, the customer will probably still need a router or
NAT,or will have to be very small. On the other hand, this has the
advantage that it is probably easier to sell to the small customer without
a firewall or NAT, since they don't actually need another router, initially.

This is what I am planning:

   Some Etherswitch -- ADSL bridge -- CPE router -- Customer1 Ethernet
       ^- a.1 ---- internal net ----- a.2 -^ ^---- Cust glbl addr space
                   \-- ADSL bridge -- CPE router -- CustomerN Ethernet
       ^- a.1 ---- internal net ----- a.n -^ ^---- Cust glbl addr space

In this case, the customer may or may not need/want another router or a
NAT.  It's up to them. Address space allocation is flexible, and operations
are identical to current leased line operations, from the point of view of
the customer.

A possibility available with this design is to use RFC 1918 nets for the
internal bridged ethernets, thus reducing your own needs for address space.
This can't really be done with VLAN's unless your customer doesn't need any
global address space.

There are some issues to consider.  The customer could remove the router,
and deviously send multiple mac addresses, in order to snoop the switch.
This is a detectable situation on good snmp manageble switches.

An etherswitch normally prevents sniffing of all non-broadcast traffic.
Assuming you have a only a router at the client site, you shouldn't be
getting any broadcast traffic on the switch, except for arps.  The router
should be the only device seen by the switch.

The etherswitch usually has limited number of entries in its internal per
port mac address table, (8 or 16 mac addresses per port on most older
equipment). When the number is exceeded, the port changes from switching to
normal ethernet, distributing all traffic, and allowing the customer to
snoop the hub. Once this is detected, the port can be turned off via SNMP.
(out of band, of course  If its done in-band, the snooper can see the snmp
set, and get the community name, and possibly turn the port back on via
another connection).

However this depends on and requires that you monitor your switches, and
that your switch either reports the number of MAC's per port, or better,
limits the MAC to a specified MAC (turning off the port when a different
MAC is seen), and can shut off ports individually.  I think you'll find the
Synoptics/Bay switches fit nicely, and are sometimes cheaper than the
catalyst.

A disadvantage is that you have to exercise more control over the router on
the customer premises, and be able to handle the case where it is
compromised, or removed by the customer.  But this is a surmountable
problem.

		--Dean

P.S.  An SNMP RMON device would be a pen register, and thus excluded from
18 USC 2511 monitoring.  :-)

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
           Plain Aviation, Inc                  dean at av8.com
           LAN/WAN/UNIX/NT/TCPIP          http://www.av8.com
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++