Subject: RE: VPN solution

From: "Newcomb, Robert" <[email-masked]>
Date: Wed, 25 Oct 2000 09:18:11 -0400

Hello Diego,
 
I am not sure what you have been reading and who you have been talking to,
but one of the biggest challenges encountered in deploying RFC 2547 VPNs is
scalability and manageability.  These have been discussed throughout and I
believe that there is a general consensus in the market that it is difficult
to do both with this Informational Draft approach.  With that said, it is
also the one MPLS VPN solution in deployment today.  There are also a number
of deployments using the Virtual Router VPN approach and it has its
advantages as well.  
 
Robert
 
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Juan Diego
Otero
Sent: Wednesday, October 25, 2000 10:04 AM
To: Wenbo Sheng
Cc: MPLS WG
Subject: Re: VPN solution

Hi Wenbo, 

The method to build VPNs most discussed (and that makes me think 
that is the most popular) in this mailing list is 
the BGP/MPLS model explained in  draft-rosen-rfc2547bis-02.txt
<http://www.ietf.org/internet-drafts/draft-rosen-rfc2547bis-02.txt>  .
Personally I 
think this method has a lot of advantages such as scalability, security,
manageability 
and use of private addressing. Some of this advantages (specially
scalability) have been  
discussed in this mailing list. 

Best Regards, 

Diego 

Wenbo Sheng wrote: 

HI, 

Assuming my customer need to create a VPN, I just want to know which
solution is better - using MPLS-VPN or virtual routers? Which solution
is/will be more popular in creating a VPN? 

Thanks in advance, 

W.S.

-- 
http://www.geocities.com/diego_otero/
<http://www.geocities.com/diego_otero/>

---

From: Robert M Matheson <[email-masked]>
Date: Wed, 25 Oct 2000 15:26:07 +0100

Hi Robert,
What exactly is/are  the scalability issue/s with RFC 2547 VPNs?
Robert

"Newcomb, Robert" wrote:

>  Hello Diego,I am not sure what you have been reading and who you have
> been talking to, but one of the biggest challenges encountered in
> deploying RFC 2547 VPNs is scalability and manageability.  These have
> been discussed throughout and I believe that there is a general
> consensus in the market that it is difficult to do both with this
> Informational Draft approach.  With that said, it is also the one MPLS
> VPN solution in deployment today.  There are also a number of
> deployments using the Virtual Router VPN approach and it has its
> advantages as well. Robert
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Juan
> Diego Otero
> think this method has a lot of advantages such as scalability,
> security, manageability
>> solution is better - using MPLS-VPN or virtual routers? Which
>> solution is/will be more popular in creating a VPN?
>>
>> Thanks in advance,
>>
>> W.S.
>
>
> --

---

From: Yakov Rekhter <[email-masked]>
Date: Wed, 25 Oct 2000 07:38:22 -0700

Robert,

> scalability and manageability.  

Do you have any *facts* to support the above statement ? Or is
it just rumors ?

> These have been discussed throughout and I
> to do both with this Informational Draft approach.  

While you certainly entitled to express *your* belief in what general
consensus is, all I'd like to say that there is no general consensus
that your belief (even remotely) reflects reality.

> With that said, it is

As well as its drawbacks...

Yakov.

P.S. While some folks like to complain about scalability and
problems with BGP (and therefore with BGP/MPLS VPN), please
note that without working BGP, it would be highly unlikely that
you'll be able to receive this e-mail.

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 10:45:35 -0400

When someone  asks a  question which is  of the  form "which vendor  has the
best product offering for some  particular purpose", you can't really expect
a technical discussion to follow, but you can expect a lot of FUD. 

This thread is of that sort.  All you can learn from it is that everyone has
their  own favorite  scheme,  and you  can  pretty much  guess which  scheme
someone will like by noting which company he works for. 

You know the thread has reached  the point of absurdity when people refer to
a scheme  which has been widely adopted  and assert that there  is a "market
consensus" against it.

---

From: Christian Kuhtz <[email-masked]>
Date: Wed, 25 Oct 2000 11:08:51 -0400

> of deployments using the Virtual Router VPN approach and it has its

Aside from misrepresentation, what do you have to contribute to this 
conversation?

-- 
Christian Kuhtz                                     Architecture, BellSouth.net
<[email-masked]> -wk, <[email-masked]> -hm                       Atlanta, GA
                                                    "Speaking for myself only."

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 11:11:57 -0400

Yakov> P.S. While some folks like to complain about scalability and
Yakov> problems with BGP

***SARCASM ALERT***

Well, if BGP were really scalable, then the Internet would no longer be just
a small  scale academic and government  toy; it would  have world-wide scope
and be heavily used by commerce and industry.

I always  find it interesting  that people will  say that the  network layer
mechanisms which  hold the Internet  together are unscalable, and  then will
advocate the use  of data link layer mechanisms instead.   I guess that once
we have  the scalable and easy to  manage "world wide lan",  or the scalable
and easy to  manage "word wide mesh of point-to-point  links", we won't need
stuff like BGP any more.

***END OF SARCASM ALERT***

(and sorry for wasting everyone's time)

---

From: Paul Doolan <[email-masked]>
Date: Wed, 25 Oct 2000 11:49:01 -0400

>you'll be able to receive this e-mail.

Which is true. But irrelevant. BGP helps the IP internetwork deliver
email ergo it's good for VPNs ?

Mail works as well as it does because of the reliability built into the
application
and transfer protocols. That reliability is provided because of the unreliable
nature of the underlying network layer which can be attributed to a number of
causes including failures in IDR.

As an aside I'm not aware of anyone who is suggesting building VPNs to deliver
email. Are you ?

pd

---

From: Paul Doolan <[email-masked]>
Date: Wed, 25 Oct 2000 12:05:59 -0400

Eric,

Yesterday, in response to Bryan,  it was 'hogwash' today its 'FUD'. This is
not your usual dispassionate approach. Has something touched a raw nerve ?

There's an unintentional, I'm sure, hilarity in your last paragraph. While
Robert's
probably going a little over the top with his "market concensus" (he was
probably
using George's definition) how about "widely adopted" ? Don't you think that's
overstating the case just a wee bit ?

pd

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 12:27:21 -0400

Paul> how about  "widely adopted" ?  Don't you think that's  overstating the
Paul> case just a wee bit ?  

No. 

Paul> Yesterday,  in   response  to  Bryan,  it  was   'hogwash'  today  its
Paul> 'FUD'. This  is not your  usual dispassionate approach.  Has something
Paul> touched a raw nerve ? 

No, sometimes it's just necessary to call 'em like I see 'em.

---

From: Rob Coltun <[email-masked]>
Date: Wed, 25 Oct 2000 12:41:03 -0700

We're starting to move into inappropriate territories. Can we move this thread
to the more appropriate dukeitoutsomewhereelse mailing list.

thanks,
---rob

---

From: Karthik Muthukrishnan <[email-masked]>
Date: Wed, 25 Oct 2000 10:52:49 -0400

Eric:

The question is not whether BGP is scalable. The question is whether informational rfc 2547 use of BGP to build MPLS VPNs is scalable..

-karthik

---

From: Yakov Rekhter <[email-masked]>
Date: Wed, 25 Oct 2000 09:59:06 -0700

Karthik,

> Eric:
> 
> The question is not whether BGP is scalable. The question is whether 
> informational rfc 2547 use of BGP to build MPLS VPNs is scalable..

For those interested in answering this question, please read
the scalability analysis described in section 15 of 
draft-rosen-rfc2547bis-02.txt.

Yakov.

> --------------B033CE14D591AC54FDBF8DDD
> Content-Type: text/x-vcard; charset=us-ascii;
>  name="mkarthik.vcf"
> Content-Transfer-Encoding: 7bit
> Content-Description: Card for Karthik Muthukrishnan
> Content-Disposition: attachment;
>  filename="mkarthik.vcf"
> 
> begin:vcard 
> n:Muthukrishnan;Karthik
> tel;pager:[email-masked]
> tel;fax:(978)-692-1509
> tel;work:(978)-952-1368
> x-mozilla-html:TRUE
> adr:;;;;;;
> version:2.1
> email;internet:[email-masked]
> end:vcard
> 
> --------------B033CE14D591AC54FDBF8DDD--
>

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 13:29:27 -0400

Paul> Mail works  as well as it  does because of the  reliability built into
Paul> the application

Having  had several years'  experience managing  a large  world-wide mailing
list, I will never again speak of the "reliability" of the mail application.
If you  could only  see the  hundreds of error  messages that  are generated
every time someone  sends a message to the MPLS  list!  The Internet routing
is one  of the  most reliable  components of the  whole operation,  far more
reliable than the operations that occur at the mail servers.

Paul> and transfer protocols. 

It may be  comforting to think of TCP as maintaining  an open connection for
weeks while the  operators work heroically to restore  the connectivity that
has been  lost due to the plethora  of major routing failures.   But I don't
think  this  happens  much.   A  lack  of connectivity  will  result  in  an
application-layer retry at some later time.  In any event, the vast majority
of the connectivity problems (from my experience managing the MPLS list) are
due to  problems at the mail  servers.  DNS problems are  probably a distant
second.

Paul> That reliability is  provided because of the unreliable  nature of the
Paul> underlying network layer which can be attributed to a number of causes
Paul> including failures in IDR.

TCP provides  reliability not because  the underlying network  is unreliable
(in any common  sense of the word), but because  the underlying network does
not  provide a service  which guarantees  against loss.   "Doesn't guarantee
against  loss"  is  perhaps  the  technical  meaning  of  "unreliable",  but
rhetorically sliding from the  technical meaning ("IP provides an unreliable
service")  to  the  common  meaning  ("the Internet  is  unreliable")  is  a
fallacy. 

The various TCP  optimizations which presume in-order packet  delivery to be
the normal case are in fact  testimony to the reliability in practice of the
underlying network layer service.

Paul> As an aside I'm not aware of anyone who is suggesting building VPNs to
Paul> deliver email. 

I think that close to 100% of those who have VPNs use them for email.

Anyway, I'm sure you realize that  when Yakov said "email" he was just using
it  as an  example of  a  commonly used  Internet application.   The set  of
commonly used Internet  applications does bear a passing  resemblance to the
set of commonly used intranet applications. 

People build  VPNs to  support the entire  set of network  applications that
they need to run, email being one of them, of course.  

Paul> BGP helps the IP internetwork deliver email ergo it's good for VPNs ? 

I don't think Yakov said that, what he was saying is that if BGP is scalable
enough to handle Internet email, why should we think that it is not scalable
enough to handle VPNs.

Recognizing that "deliver email" is  really placeholder for "support a large
and  varied set  of  networking  applications", let's  rephrase:  if BGP  is
scalable enough to  handle a large and varied  set of Internet applications,
why should we think it is not scalable enough to handle VPNs."

Of course, the fact  that BGP is scalable enough to handle  VPNs does not by
itself imply  that VPNs  should be built  according to RFC2547,  because the
scalability of BGP is only one of the issues.

Paul> What does FUD stand for by the way

Fear, uncertainty, and doubt.  (I.e., marketing.)

---

From: Randy Bush <[email-masked]>
Date: Wed, 25 Oct 2000 09:11:14 -0700

> mechanisms which hold the Internet together are unscalable

and operators find it amusing that vendors thing their products are not
dying from overload already and requiring massive effort to keep semi-
functioning.

---

From: Juan Diego Otero <[email-masked]>
Date: Wed, 25 Oct 2000 19:23:23 +0100

Hi again,

Paul Doolan wrote:

> >advocate the use  of data link layer mechanisms instead.
>
> I'd find it interesting also. But it doesn't appear to me that Robert was
> suggesting
> that. So I'm puzzled why you would float such a notion in response to his mail ?
> What
> does FUD stand for by the way ?

FUD = Fear Uncertainty Doubt

I think Eric Rosen is right  when he says:

    "When someone  asks a  question which is  of the  form "which vendor  has the
    best product offering for some  particular purpose", you can't really expect
    a technical discussion to follow, but you can expect a lot of FUD.

    This thread is of that sort.  All you can learn from it is that everyone has
    their  own favorite  scheme,  and you  can  pretty much  guess which  scheme
    someone will like by noting which company he works for. "

Look, we are doing what Eric said:
Everybody says that the model is scalable or not but nobody says why. I think
we should do what Yakhov says and read the scalability analysis described in section
15 of draft-rosen-rfc2547bis-02.txt.
 When I answered the VPN solution first mail
I expected this kind of reaction from the people in the mailing list.

Best regards,

Diego

---

From: Randy Bush <[email-masked]>
Date: Wed, 25 Oct 2000 11:25:33 -0700

> No, sometimes it's just necessary to call 'em like I see 'em.  

all depends on what glasses one wears, i guess.  i am sure it's widely
deployed within cisco.  or is it.

i just operate a network.  i wouldn't touch 2547[bis] with a bargepole.  it
will not scale, will eat massive hardware, which i imagine is why uyou like
it, and will make a fool of anyone who deploys it in large quantities.

as mo says, i wish all my competitors would use it.

randy

---

From: Paul Doolan <[email-masked]>
Date: Wed, 25 Oct 2000 12:16:57 -0400

Eric,

I'd find it interesting also. But it doesn't appear to me that Robert was
suggesting
that. So I'm puzzled why you would float such a notion in response to his mail ?
What
does FUD stand for by the way ? Oh, I apologise. You seem to be commenting on
the, also irrelevant, observation wrt email & BGP made by Yakov.

>(and sorry for wasting everyone's time)
 You said it ;-)

pd

---

From: "S. Chkaravorty" <[email-masked]>
Date: Wed, 25 Oct 2000 21:28:51 -0400

Eric,

You echo our feelings altogether.  This thread has been a zoo of ideas for a
while - going nowhere.  We feel this is because MPLS is perhaps one more
impossible 'technology' people are trying to design for everything and it isn't
working.  (Remember IPv6 - had flow control and authentication and just about
everything tho' the problem really was the limited addressing space - probably
could have been solved by using the IP option fields and providing extensions to
IPv4?)

Sorry, if I offended anyone.

SC
****************

---

From: Eric Rosen <[email-masked]>
Date: Wed, 25 Oct 2000 15:29:17 -0400

Randy> i am sure it's widely deployed within cisco

Cisco is not  a service provider.  "Widely adopted",  in this context, means
deployed or  being deployed  by a significant  number of  service providers.
No, I won't furnish the number, you can either believe me or not.

Randy> i just operate a network. 

I don't mean to  make light of your experience in this  area, but I can tell
you that  many others  who operate networks  do not share  your conclusions.
That doesn't  mean you are  wrong or right,  it just means that  operating a
network doesn't make one omniscient.

Randy> it ... will eat massive hardware, which i imagine is why you like it

I  think the  best way  for a  vendor  to make  money is  by providing  good
business solutions.   Deliberately advocating a  bad business solution  as a
way  of selling  hardware  would  be counter-productive,  imho,  and is  not
something I would do.

---

From: Yakov Rekhter <[email-masked]>
Date: Wed, 25 Oct 2000 12:11:09 -0700

> all depends on what glasses one wears, i guess.  

Yes, indeed. Including the glasses you wear...

Yakov.