SSH on the router - was( IT security people sleep well)

Alex Bligh alex at alex.org.uk
Mon Jun 7 21:56:23 UTC 2004




--On 07 June 2004 17:50 -0400 Valdis.Kletnieks at vt.edu wrote:

> Well, either you have one per POP (and that, as Randy Bush points out, can
> be quite the headache in itself), which is still a single point of
> failure for that POP, or you're advocating that the routers be reachable
> from the magic box at *any* POP (which is right back into the "large
> number of machines" issue....)

Well the way we did it, all routers were accessible from 2 (large) POPs,
two being in the NOC, and one being elsewhere (now you mention it, it was a
datacenter & POP combined). So the "large" number of machines was 3. I am
sure we could have scaled this to (say) 4 without substantial difficulty.

I agree one in every POP would be both painful and pointless. But that
wasn't what I meant.

Alex



More information about the NANOG mailing list