I have started to use Cisco Crosswork Network Insights which is the replacement for BGPmon and I am shocked at how Cisco has managed to destroy a useful tool. I have had a paid 50 prefix account since the day BGPmon became available and helped two clients implement a 500 prefix license over the past 4 years. None will be buying Cisco Crosswork Network Insights, based on my recommendation.
I really don’t know where to begin since there is so much to dislike in this new GUI. I will try to give you just a small taste but I suggest you request a 90 day trial license and try it out for yourself.
This was not designed by someone who deals with BGP hijacks or who manages a network. It was probably given to some GUI developer with a minimal understanding of what the users needed. How do I know this? Take for example the main configuration menu: https://crosswork.cisco.com/#/configuration with the first tab of “prefixes”. On that page there is no mention of which ASN the prefix is associated with. That of course was fundamental in the BGPmon menu: https://portal.bgpmon.net/myprefixes.php
Or take for example its “express configuration”, where you insert an ASN and it automatically finds all prefixes and creates a policy. But does it know the name of the ASN? Nope. Something again that was basic in BGPmon via: https://portal.bgpmon.net/myasn.php is non-existent in CNI.
Or how about the alarms one gets to an email? Want to see how that looks?
Hi,
I recognise the issue you describe, and I'd like to share with you that
we're going down another road. Nowadays, RIPE NCC offers a streaming API
("RIS Live") which has the data needed to analyse and correlate BGP
UPDATES seen in the wild to business rules you as operator define.
NTT folks are working on https://github.com/nlnog/bgpalerter/ - which
relies on "RIPE RIS Live", this software should become a competitive
replacement to current BGP monitoring tools. Stay tuned, the software
will be more useful in the course of the next few weeks.
Kind regards,
Job
Hi Job, All,
It relies *exclusively* on "RIPE RIS Live", or does it also use other sources?
Regards,
Carlos
The first useful version will rely exclusively on the "RIS Live"
interface. In a later stage we can consider adding something like the
NLNOG Looking Glass data source.
Kind regards,
Job
Cisco ruins everything they touch.
I would like to point out another more straightforward ignorant UI
design decision for this new service. The login screen assumes and
requires all Cisco.com account usernames to be email addresses. Many
are not, especially for folks like me who have had theirs for decades.
Thus spake Job Snijders (job@ntt.net) on Wed, May 15, 2019 at 12:16:06PM +0200:
I recognise the issue you describe, and I'd like to share with you that
we're going down another road. Nowadays, RIPE NCC offers a streaming API
("RIS Live") which has the data needed to analyse and correlate BGP
UPDATES seen in the wild to business rules you as operator define.
NTT folks are working on https://github.com/nlnog/bgpalerter/ - which
relies on "RIPE RIS Live", this software should become a competitive
replacement to current BGP monitoring tools. Stay tuned, the software
will be more useful in the course of the next few weeks.
Similarly, one can integrate CAIDA's BGPStream Broker Service[1] into
their own tools. Like bgpalerter above, working with open source or
rolling your own tools is increasingly straightforward[2] due to these
community projects.
Another viable project to keep an eye on is ARTEMIS[3] for monitoring.
Dale
[1] https://bgpstream.caida.org/data
[2] https://github.com/dwcarder/bgpwatch
[3] https://www.inspire.edu.gr/artemis/
Hello,
we would be happy to collaborate to deploy and extend the ARTEMIS open-source software tool
for monitoring, detection and potential automated mitigation of prefix hijacks,
available on GitHub at https://github.com/FORTH-ICS-INSPIRE/artemis .
Current monitoring sources include RIS live, BGPStream (classic RV + RIS and beta BMP support) and ExaBGP APIs to local monitors.
You are most welcome to check out the code and test, provide feedback and/or integrate with existing custom tools you might use.
Best regards,
Vasileios
Hi,
Maybe you should contact https://www.isolario.it/ for intergration?
Thanks,