18 Mar
2019
18 Mar
'19
8:39 p.m.
- We are an island, so our network will be managed as
a "closed" network, with only two gateways to "the rest of the world",
in two data centers located in the two the main cities.
It should be possible to get it working correct in that setup.
The main problems of the German network are:
- the use of many exitpoints towards internet that use consumer lines and NAT
- the reliance on consumer routers that offer no flexibility in routing and connection
marking (AVM Fritzbox etc)
- the separation of different connection technologies in different routing tables
evaluated sequentially instead of from smallest subnetsize up
- (motivated by some of the above points) the naive routing that does not take connections
into account, so it cannot differentiate between outgoing and incoming connections
When you (and it looks like you do) abolish those internet connection points with NAT,
most of the problems are already solved even in cases where the routing is asymmetrical
and not optimal.
At least it works.
Rob
19 Mar
19 Mar
9:24 a.m.
New subject: BGP routes in RIP transmissions - Using ampr-ripd in parallel with BGP ?
Hi Rob,
Thank you for your answer.
Le 18/03/2019 à 21:39, Rob Janssen a écrit :
When you (and it looks like you do) abolish those
internet connection
points with NAT, most of the problems are already solved
After carefully reading this list for a while now, that's one of the
reasons why we choosed this setup ;-) It's also very close from our old
"private" design, which will make migration easier.
But it also has a drawback : our network is not full-mesh. It will
mostly be dual-hub-and-spoke (hub-and-spoke with two hubs), with some
additional loops between endpoints (where there's budget, and not too
much mountains for 5 GHz).
even in cases where the routing is asymmetrical and
not optimal.
This is another drawback : all outgoing traffic (to Internet) has to go
through one of our gateways, and can not be forwareded to Internet
directly by an endpoint via its local (NATted) ISP. In most locations
(QRAs, low points), we are using existing end-users ISPs for VPNs. Due
to how those ISP created their backbones (the LNS are not located on the
island, but are in Paris/France), this will involve additional latency
due to multiple and potentially unneeded crossings under the
Mediterranean sea.
F/ex, a packet from my home (44.190.11.x) to Internet will use the
following path :
QRA (Corsica) -> my ISP xDSL PPPoE LNS (Paris) -> TKNet data center
(Corsica) -> TKNet BGP endpoint (Paris) -> Internet
This may seem a bit odd, but we have the same problem in our job for
business VPNs, and there's not much thing we can do (unless all ISPs
create a GIX on the island, but this is a little bit out of scope here,
HI). Moreover, we hope to be able to reduce the latency by 1/3 via a new
transit provider in the DC (current: 45ms, planned : 30ms). It's still a
shorter path than a journey via San Diego, HI :-)
73 de TK1BI
2087
days inactive
2088
days old
1 comments
2 participants
participants (2)
-
Rob Janssen -
Toussaint OTTAVI