Subject: RE: VPN solution - White flag ?

From: Barry Hass <[email-masked]>
Date: Thu, 26 Oct 2000 08:37:21 -0400

Eric,

Doesn't a PE router have to handle the full Internet routing
table, plus VRFs for whatever VPNs it is supporting? I think
that what some folks are suggesting is that BGP (not "the box",
but BGP specifically) is already bumping up against scaling
limits at 100,000 or so routes, and that burdening it with the
additional responsibility of managing VPNs is not such a great
idea. ("Some folks" please correct me if I'm wrong). Can you
comment on that?

By the way, I don't have enough information to have an opinion
on this. I'm just trying to steer the discussion back to what
I thought was an interesting technical question before the
insults started to fly.

> In the  NBVPN routing environment, it is  not true that 
> anyone  in the world
> needs to be  able to reach anyone else  in the world.  Each 
> VPN  has its own
> inter-connectivity  matrix,  much  smaller  than the  
> Internet  connectivity
> matrix.  Now if you add up all the VPN routes, summed over 
> all VPNs, you may
> indeed get  a much larger  number than the  number of 
> Internet  routes.  But
> there is no one box which needs  to hold them all.  Since an 
> instance of BGP
> runs in a particular box, and only  has to deal with the 
> routes that need to
> be in that box,  you don't run up against the same  box 
> scaling problems you
> run up  against in  the Internet routing  environment.  You 
> can  design your
> system to  have a given box  handle as many routes  or as few 
>  routes as you
> want.

---

From: Eric Rosen <[email-masked]>
Date: Thu, 26 Oct 2000 11:43:08 -0400

Barry> Doesn't a PE  router have to handle the  full Internet routing table,
Barry> plus VRFs for whatever VPNs it is supporting?  

No.   A PE  router doesn't  necessarily  have to  have any  of the  Internet
routing table at all, because Internet  access doesn't have to be offered as
part of the  VPN service, and even if  it is, it doesn't have  to be offered
via an  interface to the  same PE.  Many  providers and their  customers are
actually more  comfortable with a  clean separation of Internet  access from
VPN service.

For the  case in which Internet access  and VPN service are  offered via the
same  PE, it  still is  generally not  necessary to  bring the  full  set of
Internet routes to the edge, as Jim as indicated.

I can certainly see that this is a mismatch with the default-free Tier 1 ISP
that hopes to offer "VPN service" as a sideline in order to sell some of its
excess bandwidth.  That just isn't the  target market for the scheme.  If an
ISP wants  a sideline in order to  sell excess bandwidth, selling  a layer 2
service might well  be the best way  to go.  One size doesn't  fit all.  You
will notice that our documents tend to speak of "SPs" rather than "ISPs".

Barry> I think  that what some  folks are suggesting  is that BGP  (not "the
Barry> box",  but BGP specifically)  is already  bumping up  against scaling
Barry> limits  at 100,000  or  so routes,  and  that burdening  it with  the
Barry> additional responsibility of managing VPNs is not such a great idea

BGP runs in a  box.  The amount of state it needs  to manipulate, the amount
of messaging it  needs to do, the  amount of computation it needs  to do, is
largely a function of the number of routes which the box needs to maintain.  

I  am always at  pains to  emphasize that  the Internet  routes and  the VPN
routes are not just  thrown together in a big mishmash, but  I don't seem to
have succeeded in making this clear.

Paul> When you say  'VPN site' here are you suggesting  that the CE router
Paul> is running eBGP with/to the 'Internet exit point' ? 

The point is  that in those cases where  the CE router wants to  run EBGP to
import Internet routes  into the enterprise network, the  EBGP peer does not
have to be  the PE router.  But there  is no requirement on the  part of the
VPN scheme that the CE router import the Internet routes.