Subject: Re: VPN solution - White flag ?

From: Paul Doolan <[email-masked]>
Date: Wed, 25 Oct 2000 14:09:44 -0400

Eric,
      don't know how it's going at your end but the private mail to me
is 5 to 2 in favor of
keeping this up. Which only goes to prove there are some folks with too
much time on
their hands;-) But we've probably tried the patience of a bigger number
of folks. So I'm
done after this.

Eric>but rhetorically sliding from the  technical meaning ("IP provides
an unreliable
Eric>service")  to  the  common  meaning  ("the Internet  is
unreliable")  is  a
Eric>fallacy.

  True but one which I didn't commit.

>Paul> As an aside I'm not aware of anyone who is suggesting building
VPNs to
>Paul> deliver email.
Eric>I think that close to 100% of those who have VPNs use them for
email.

  And I agree with you. But its not got much to do with what I said has
it ?

Eric>Recognizing that "deliver email" is  really placeholder for
"support a large
Eric>and  varied set  of  networking  applications", let's  rephrase:
if BGP  is
Eric>scalable enough to  handle a large and varied  set of Internet
applications,
Eric>why should we think it is not scalable enough to handle VPNs."

    Have you moved into marketing :-)

    BGP doesn't 'handle ...... applications'. It distributes
reachability information
    in the IDR system. We may agree or disagree on how well it scales in
that
    application. That has little bearing on whether that property
applies in this
    different application.

Eric>Of course, the fact  that BGP is scalable enough to handle  VPNs
does not by
Eric>itself imply  that VPNs  should be built  according to RFC2547,
because the
Eric>scalability of BGP is only one of the issues.

     Ignoring the contentious first part I have to say I'm glad we can
agree on one point.
     The scalability of BGP is only one of the issues with the protocol
which call its use in
     this application into question. And there are other issues with
building VPNs as well.

pd

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 14:42:39 -0400

I  don't really  want  to  keep it  up  either, but  as  long as  misleading
statements are being made I feel I have to reply. 

Paul> BGP ...   distributes reachability information  in the IDR  system. We
Paul> may agree or disagree on how well it scales in that application.  That
Paul> has little bearing on whether  that property applies in this different
Paul> application.

Whether  something  scales in  an  extremely  large  environment has  little
bearing on whether it scales in  a smaller environment?  I can't imagine why
anyone would make such a claim. 

Paul> The scalability  of BGP is  only one of  the issues with  the protocol
Paul> which call its use in this application into question. 

Now that's an example of FUD!!

---

From: Paul Doolan <[email-masked]>
Date: Wed, 25 Oct 2000 15:33:28 -0400

>Paul> has little bearing on whether  that property applies in this different
Eric>Whether  something  scales in  an  extremely  large  environment has
little
Eric>bearing on whether it scales in  a smaller environment?  I can't imagine
why
Eric>anyone would make such a claim.

  Neither can I. And _again_ if you read a little more carefully you'll see that
it is
  not what I wrote.

  But since you mention it I'm a little puzzled by you choosing to define (the
NBVPN)
  as a 'smaller' environment. Lets assume the the (internet) core routers are
currently
  handling ~60,000 routes. And there are (?) thousands of AS's. That's big. No
doubt about
  it. A lot of routing information.

  In contrast  your own colleagues refer to the  "virtually
  unlimited scalability" of your VPN approach while your marketing  has talked
about
  "hundreds of thousands of VPNs". Allowing and order of magnitude  for
marketing
   hyperbole (and for the fact I can only find a reference to tens of thousands
  to hand :-) ) that leaves say 6 routes per VPN. Even with the paucity of
routes that I
  postulate per VPN this hardly seems to qualify as a 'smaller' environment.

  And we haven't begun to think about the poor folks who are being told that
they can
  use BGP to support VPNs while it is also performing the role for which it was
designed.
  And they are being told this......or at least not being clearly told the
opposite.

  pd

---

From: Paul Doolan <[email-masked]>
Date: Wed, 25 Oct 2000 17:32:45 -0400

Not everyone in cisco is a rogue! And its very hard to write
anything down with you carping away in the background all
day.

When you resort to including this sort of stuff we're clearly at point where
your emotions have gotten the better of you. Its a pity because the
first part of your mail was relevant and valueable. So at least I've
gotten something more out of you taoday than 'mailserver' war stories.

pd

>
>
>         "Eric, you  didn't read my message  carefully, you didn't
>         answer my  question, what you are saying  makes no sense,
>         what  you  are  saying  is  irrelevant,  you  don't  know
>         anything  about   routing,  you  don't   understand  BGP,
>         everyone  at cisco  is a  rogue, and  I have  a  bunch of
>         detailed technical  criticisms of your ideas  but I don't
>         have time to write them down now."

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 16:49:44 -0400

Paul> I'm  a little  puzzled by  you  choosing to  define (the  NBVPN) as  a
Paul> 'smaller' environment 

The reason I  regard the NBVPN routing environment as  smaller in scale than
the Internet routing environment is the following. 

In the Internet routing environment, anyone in the world needs to be able to
reach  anyone  else  in  the   world.   This  creates  an  enormous  "inter-
connectivity matrix", and one which  is constantly growing.  If, through the
liberal application of route aggregation, this inter-connectivity matrix can
be reduced to 100,000 routes, then quite  a few routers are going to have to
be  able to  hold 100,000  routes.  Since  the inter-connectivity  matrix is
constantly growing in  size, this poses an evident  box scaling problem; the
number of routes which a single router must hold is constantly growing.  

In the  NBVPN routing environment, it is  not true that anyone  in the world
needs to be  able to reach anyone else  in the world.  Each VPN  has its own
inter-connectivity  matrix,  much  smaller  than the  Internet  connectivity
matrix.  Now if you add up all the VPN routes, summed over all VPNs, you may
indeed get  a much larger  number than the  number of Internet  routes.  But
there is no one box which needs  to hold them all.  Since an instance of BGP
runs in a particular box, and only  has to deal with the routes that need to
be in that box,  you don't run up against the same  box scaling problems you
run up  against in  the Internet routing  environment.  You can  design your
system to  have a given box  handle as many routes  or as few  routes as you
want.  

Now someone will say, "Wait a  minute, as your customer base increases, this
may require  you to deploy more  boxes; unscalable, unscalable".   I have to
admit,  the scheme  does not  allow you  to provide  an unbounded  amount of
service in  a single  box.  Both the  growth is not  exponential, geometric,
factorial, or any of that really  bad stuff.  The growth is linear, which is
about the best you can do.

There are other  differences between the NBVPN environment  and the Internet
routing environment that make the former less stressful.  In the most common
cases,  you are  not relying  on routing  information from  independent (and
perhaps uncooperative) third parties in order to provide service to your own
customers. This in itself reduces the stress on the system considerably.

What we  really have is the  application of highly  scalable techniques from
the  world  of inter-domain  routing  applied to  a  much  more orderly  and
controllable  environment.  I  think  it does  provide  virtually  unlimited
scalability because  there is nothing that  will stop you  from adding more,
and the "more"  you have to add grows at worst  linearly with the additional
service you need to provide.

Some people shudder at the thought of having to add all the VPN routes to an
already stressed out Internet routing  system, but that's really not how the
scheme works.  You can maintain as  much or as little separation as you want
between the VPN routing and the Internet routing. 

Paul> And we haven't begun to think  about the poor folks who are being told
Paul> that they can use BGP to  support VPNs while it is also performing the
Paul> role for which it was  designed.  And they are being told this......or
Paul> at least not being clearly told the opposite.

I'm not sure  I can comment on who  you say is being told what  by whom.  As
far as I  know, we have always  placed an emphasis on scaling  the system by
limiting  the number  of routes  that need  to be  known in  any  one place,
including  partitioning  the system  of  route  reflectors.  It's  perfectly
accurate  to say  that BGP  is supporting  both VPNs  and  Internet routing,
what's not accurate is to say that it has to support all those routes in any
one box.

To save you the trouble of replying, let me compose a reply for you: