Subject: RE: your mail

From: [email-masked]
Date: Wed, 3 Jul 2002 19:21:46 +0100

Hi Giles,

Giles Heron wrote 03 July 2002 18:09
> so let's to go back to Yakov's email of 31st May:
> 
> ------
> Giles,
> 
> > 1.  Efficient encapsulation of VPN traffic
NH=> So the need for forced over-engineering because one can't determine
anything with confidence on a per customer basis is efficient is it?  That's
a novel take on the definition of efficiency.

> > 2.  Ability to run VPN on current hardware
NH=> Just 'who's HW'?  This should surely not be a 'compelling reason'.
> > 
> > There are probably other reasons as well...
NH=> The appeal to 'etc' when the real reasons dry-up.
> 
> One of the "other reasons" is straightforward protection 
> against packet 
> spoofing.
NH=> Hardly compelling is it?  If you really want strong protection why not
use IPSec?
<snipped to end>

---

From: Giles Heron <[email-masked]>
Date: 04 Jul 2002 12:42:03 +0000

> a novel take on the definition of efficiency.

if "over-engineering" (by which I presume you mean "over-provisioning")
means fewer staff to run the network then yes - it is more efficient. 
As someone once said "bandwidth is cheaper than smart people" (or words
to that effect).  Incidentally if anyone here knows the original quote
then do send it to me offlist...

In any case if you run RSVP-TE end to end in a large network you will
hit the LSP scaling wall sooner rather than later (particularly if you
have different LSP meshes for different classes of customers, as you
seem to suggest regularly).  LDP end-to-end with RSVP-TE in the core
lets you have the best of both worlds - TE in the core to optimise your
use of resources (and keep your job secure) and LDP to the edge so you
can scale your network ;-)

(I'm sure Heinrich can jump in here and remind us about hierarchical
LSPs).

> NH=> Just 'who's HW'?  This should surely not be a 'compelling reason'.

it is compelling to a lot of carriers right now!
 
> NH=> The appeal to 'etc' when the real reasons dry-up.

that was just me being lazy ;-)

> NH=> Hardly compelling is it?  If you really want strong protection why not

and why would a carrier want to run IPSec for anti-spoofing? 
Sledgehammers and walnuts come to mind ;-)

Giles

-- 
=================================================================
Giles Heron    Principal Network Architect    PacketExchange Ltd.
ph: +44 7880 506185              "if you build it they will yawn"
=================================================================