I have some idea to put switch before bgp router in order to terminate isp 10G uplinks on switch, not router. Main reason is that could be some kind of 1st level of defence against ddos, second reason, less important, save cost of router ports, do many port mirrors.
I think about N3K-C3064PQ or Juniper ex4500 because there are quite cheap and a lot of on Ebay.
I would like on nexus or juniper try use some feature:
- limit udp, icmp, bum packets (bandwith,pps) at ingress tagged port or vlan
- create counters: passed and dropped packets, best way to get this counters via snmp oid, sent snmp traps, syslog etc in order to monitor
or even as a action shut down port
- port mirror from many ports/vlans to multiple port (other anty ddos solutions)
- limited bgp but with flowspec to comunicate with another anty ddos devices
I'm also wondering how this feature above impact on cpu/whole switch. It can be some performance degradation ot all of this feature are done in hardware, with wirespeeed ? Which model will better to do this ?
I have some idea to put switch before bgp router in order to terminate isp
10G uplinks on switch, not router. Main reason is that could be some kind of
1st level of defence against ddos, second reason, less important, save cost
of router ports, do many port mirrors.
I don't understand your rationale, unless your router is software box,
but as it has 10G interface, probably not.
Your router should be able to limit packets in HW, likely with better
counter and filtering options than cheap switch.
Please also keep in mind that the Juniper EX4500 is an end of life product.
Soon you won't be able to get Juniper to support you. That's why there are
so many for so cheap on eBay.
We had situations, that we lost all our bgp sessions, not even only on ports where flood was coming. Just cpu overloaded. I don't care about support too much, there are cheap enough to have spare. Soft is mature with known bugs so i assume that this risk are accepted. Bigger problem for me is technical details about features, which i desribed in my first post. Most of this features i tested on trident2 chipset extreme 670, it works but with problems and some limits. Now i have to change vendor. Really wondering what can i get from N3K-C3064PQ, its also build on trident2 AFAIK
What is the device you're trying to protect? Perhaps it supports
reasonable CoPP features so that you can protect it directly on
itself. To do this CoPP on neighbouring switch, you'll need unique
policer for each and every BGP session and ARP, your switch may not
support this and it is provisioning nightmare.
That sort of thing has never bothered me much. If the platform is so great, surely it'll last more than a few years. What's the MTBF on these things? Decades?
Better power performance, newer features, higher capacities sure are all great reasons to get newer hardware. EOL isn't. Don't too many of you adopt that strategy, though. I still want my source of cheap EOL hardware.
I like putting a switch in front so then I can run two routers behind and get a /29 from the upstream. I can then do router maintenance, upgrades, etc. without taking the circuit down.
Support, particularly software maintenance is indeed the key deadline,
after that you're on your own. For EX this would be 2019 or 2021
depending on model, if that fits to your amortisation times, then it's
fine. You may get more out of it, but you can't build business case on
it.
Yup, exactly. There are things to keep around from used market for unimportant stuff (OOB etc), but software maintenance support on production box is key.
I have some idea to put switch before bgp router in order to terminate
isp 10G uplinks on switch, not router. Main reason is that could be some
kind of 1st level of defence against ddos, second reason, less
important, save cost of router ports, do many port mirrors.
The distinction on cost of ports is somewhat germain when dealing with
things like span ports. maybe strictly speaking if the router platform
can handle line rate forwarding at minimum packet size it is just as
performant as the switch at both forwarding and probably acl application
(there are of course exceptions). in general these switches has
substantially smaller port buffers then a router or high end l3 switch
platform (qfx10k or ptx for example) would have when spanning ports or
doing some statistical multiplexing. Which can be a liability.
A number of us no doubt use layer2/3 switches as customer aggregation or
indeed peering platforms. and suitability for such may depend on the mix
of hardware and software features available as well as non-forwarding
attributes such as the amount of memory available. i have boxes for
example that have a full table rib but only default route for
non-customer routes. the prospects for gettting away with that sort of
thing with only 2GB of ram are growing increasingly dire.
So i would say this sort thing does work, and with some familiarity with
the platforms you become more comfortable with their limitations, but
it's not automatically the best route, and the additional bump in the
forwarding path is not free of costs or complexity.
