Subject: RE: VPN solution - White flag ?

From: Eric Gray <[email-masked]>
Date: Thu, 26 Oct 2000 11:27:18 -0700

Eric,

	On a technical note (:-)) - I believe it is
possible to support a logarithmic growth in the
number of "boxes" relative to services.  I suspect 
this would make service providers happier than a
linear growth.  It would also allow larger service
providers to realize economies of scale - an idea
which has been fairly low profile in industry in
general these days...

> --- <snip> --- 
> 
> Now someone will say, "Wait a minute, as your customer base 
> increases, this may require you to deploy more boxes; unscalable, 
> unscalable".  I have to admit, the scheme does not allow you to 
> provide an unbounded amount of service in a single box.  Both 
> the growth is not exponential, geometric, factorial, or any of 
> that really bad stuff.  The growth is linear, which is about the 
> best you can do.
> 
> --- <whack> ---

---

From: Randy Bush <[email-masked]>
Date: Thu, 26 Oct 2000 15:37:31 -0700

> linear growth.

but not as happy as zero growth, which solutions such as
ipsec provide.  remember, for a provider, management cost
is a function of number of customers, which we want to
increase, and routers,which we prefer not to increase.

and, as it seems to be agreed that the 2547 cleverness is
not really for isps, it's lucky we have a useful alternative.

randy

---

From: Eric Osborne <[email-masked]>
Date: Thu, 26 Oct 2000 23:13:04 -0400

> increase, and routers,which we prefer not to increase.

Sure, but consider what you can sell.  If the customer usees IPSec,
they they have to manage the VPN themselves, as well as needing to
approximate something close to N^2 connections.  If the (I)SP sells
VPN service, then the customer has offloaded the work onto the ISP.    

There's a few ways you can give private-network solutions to an
enterprise.  The ones I can think of are:

1) dedicated line (ATM/FR/Leased Line) 
2) IPSec sessions over Internet connectivity
3) MPLS VPN

With #1, the customer can't do full-mesh, becuase with a large enough
number of sites, full-mesh is just too expensive and too much to
manage.  Plus Internet connectivity is not inherent in the mechanism
you use to build your VPN, so has to be managed on top of that.

With #2, the customer has to manage the IPSec sessions.  Sure, you
could manage the CPE, but then *you* have to manage the IPSec
sessions.  And full-mesh is still a problem with many (hundreds to
thousands) of sites, so you have to have hub and spoke again.  One
place IPSec works real well, though, is for roaming access - plug in
anywhere, and IPSec-tunnel back to your corporate access point.  SO
I'm not saying IPSec is dissmissable just yet.

With #3, the customer has nothing to manage.  And the provider has to
manage a technology whose main scalability concern is BGP.  Sure, you
can overload BGP on anybody's box if you add too many routes and/or
neighbors.  But it seems to me that there are design schemes to make
it so that your PE does not have to do all the work.

So yes, you have to do more work and buy more routers.  And no, MPLS
BGP VPNs are not the solution to every possible VPN or VPN-like
scenario you could come up with.  But the assumption here is that it
is less expensive for the (I)SP to manage an MPLS VPN setup
(conectivity information distributed by BGP) than to manage/administer
a large number of IPSec sessions.  My assumption may be wrong, but
certainly there are enough people out there who are actively pursuing
MPLS VPN as a connectivity service that I don't think the assumption
is too far off-base.
 
So customers give you money to provide a VPN service.  You give some
of this money to your vendor of choice, give some to your
infrastructure buildout, and keep the rest. :)

eric

---

From: Greg Ketell <[email-masked]>
Date: Thu, 26 Oct 2000 22:16:33 -0700

You are forgetting the obvious, which is being sold around the world today 
(and has been being sold since at least 1995 when I was installing it): 
managed router service.

IPSec at the edges with the customer paying the (I)SP to manage the 
CPE.  Add some CoS capabilities in the core to give priority to the IPSec 
traffic and you have a very good service offering.   With the correct tools 
the management of it scales well too.

GK

---

From: Randy Bush <[email-masked]>
Date: Thu, 26 Oct 2000 23:15:56 -0700

> If the customer usees IPSec, they they have to manage the VPN themselves,

bzzzt!  next contestant.

> as well as needing to approximate something close to N^2 connections.

no.  though as many security associations as vpns need to be created.  of
course, as 2547 has no securith, there is no such problem there.  of course,
being security conscious when selling a vpn, i don't see that as a benefit.

> If the (I)SP sells VPN service, then the customer has offloaded the work
> onto the ISP.

indeed.

> 2) IPSec sessions over Internet connectivity

yup.  except i worry about the privacy in 1 and 3.  but they can run ipsec
over l2 or over the l2.5 tunnel.

> manage.

agreed.  but many customers have the layer 2 solution today and want to
convert.  kompella's solution looks tasty, but i want to see more about
how to provision it.

> Plus Internet connectivity is not inherent in the mechanism you use to
> build your VPN, so has to be managed on top of that.

isps think of it as overlaying managed ipsec services on top of internet
connectivity.

> With #2, the customer has to manage the IPSec sessions.

not any more than they do for 2547.  the isp can maintain the cpe, the
tunnel can originate on the isp's router a la 2547, or one can use one of
the ipsec aggregation boxes.

> Sure, you could manage the CPE, but then *you* have to manage the IPSec
> sessions.

as i have to manage the lsps.  no biger deal.  except with ipsec there is no
weight in the middle of my network.  internet architecture 101, unlike the
phone network, the internet is a stupid middle with smart edges.

> And full-mesh is still a problem with many (hundreds to thousands) of
> sites, so you have to have hub and spoke again.

not at all.  it's all in the provisioning tools.

> manage a technology whose main scalability concern is BGP.

it violates a basic architectural principal.  bgp is the first bad
consequence we see.  i am far from sanguine it will be the only one.

> So yes, you have to do more work and buy more routers.

thanks anyway.

> So customers give you money to provide a VPN service.  You give some of
> this money to your vendor of choice, give some to your infrastructure
> buildout, and keep the rest. :)

or give them security and vpns, and keep all the cash (or charge less).
plus i have some hope of my network continuing to scale.  and scaling is
what the internet is about.

randy

---

From: Jim Guichard <[email-masked]>
Date: Fri, 27 Oct 2000 08:59:53 +0100

Randy,

I think there are many ISPs that would disagree with you, especially here
in Europe. Therefore, we are not all agreed that 2547 is a useless
alternative to overlay or other types of peer-to-peer VPN connectivity. So,
if the glove does not fit, do not wear it, this is fine .... but it is a
solution that many ISPs have adopted and are implementing as we speak, so
we cannot make a generalization  .. Jim

>not really for isps, it's lucky we have a useful alternative.

Jim Guichard CCIE #2069
Network Design Consultant EMEA
Global Solutions Engineering 

+44 208 756 8806
Mobile: +44 7802 809763

---

From: Eric Rosen <[email-masked]>
Date: Fri, 27 Oct 2000 09:56:57 -0400

Greg> You are forgetting  the obvious, which is being  sold around the world
Greg> today  (and  has been  being  sold  since at  least  1995  when I  was
Greg> installing it): managed router service. 

No one is forgetting  this.  Most of the SPs who are  moving to layer 3 VPNs
have been  doing this  for years.  Many  of the  SPs who actually  have been
offering managed router services over  layer 2 backbones don't seem to think
it's so scalable.

Greg> IPSec at  the edges with the  customer paying the (I)SP  to manage the
Greg> CPE. Add  some CoS capabilities  in the core  to give priority  to the
Greg> IPSec traffic  and you  have a very  good service offering.   With the
Greg> correct tools the management of it scales well too.

Well, we could  have a long discussion of the  alleged scalability of IPsec,
but I doubt we'd reach much of a consensus. 

You will  note that  there seems  to be a  considerable market  for PE-based
IPsec capabilities.  Given the fact that CPE-based IPsec provides a lot more
security, the  existence of  this market perhaps  says something  about what
many SPs think of CPE-based solutions.

Whether layer 3  VPNs or a managed  router service over layer 2  VPNs is the
best solution  for a Service Provider  to offer is  certainly something that
each Service Provider can decide for himself.

---

From: Christian Kuhtz <[email-masked]>
Date: Fri, 27 Oct 2000 11:16:25 -0400

> being security conscious when selling a vpn, i don't see that as a benefit.

Hmm, so, what percentage of l2 VPN customers would you say are buying crypto 
gear to crypt their frame and cell shredder ckts?

-- 
Christian Kuhtz                                     Architecture, BellSouth.net
<[email-masked]> -wk, <[email-masked]> -hm                       Atlanta, GA
                                                    "Speaking for myself only."

---

From: Randy Bush <[email-masked]>
Date: Fri, 27 Oct 2000 09:15:28 -0700

> in Europe.

unfortunately, all these big isps who are successfully deploying 2547 seem
to have broken keyboards.  i did not expect keyboard damage to be a scaling
consequence of 2547, but surprises happen. :-)  luckily, they seem to have
many people with cisco email addresses to speak for them.

randy

---

From: Yakov Rekhter <[email-masked]>
Date: Fri, 27 Oct 2000 09:23:45 -0700

Randy,

> not really for isps, it's lucky we have a useful alternative.

All I can say that the usefulness of various alternatives is unlikely
to be determined by the debates on this list, but is likely to be
determined by the competition on the marketplace. With this in mind,
what exactly are you trying to accomplish by continuing this debate ?

Yakov.

---

From: Rene Tio <[email-masked]>
Date: Fri, 27 Oct 2000 11:29:29 -0700

> > If the customer usees IPSec, they they have to manage the VPN themselves,

Speaking as an impartial third party, I have to say that given your
requirement for zero router growth you're expecting customers to manage
the routers themselves.  Otherwise what's the difference between buying
PE routers and passing the cost to the customer or buying CE [IPsec]
routers and passing the cost to the customer?

---

From: Randy Bush <[email-masked]>
Date: Fri, 27 Oct 2000 10:34:51 -0700

> what exactly are you trying to accomplish by continuing this debate ?

the ever-dauntful task of getting operational input into the vendor driven
steam-roller.

randy

---

From: Randy Bush <[email-masked]>
Date: Fri, 27 Oct 2000 12:03:13 -0700

> requirement for zero router growth

zero would be nice.  very small would be reasonable.

> you're expecting customers to manage the routers themselves.

nope.  we're selling a managed service, whether it's at the cpe or in
aggregation.

> Otherwise what's the difference between buying PE routers and passing the
> cost to the customer or buying CE [IPsec] routers and passing the cost to
> the customer?

there seems to be some confusion.  for cpe-based ipsec, the customer's
normal single router does not need to be replecated.

randy