ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Co-lo + 5 (or more) sites....connect 'em all

    IT Discussion
    edgerouter edgerouter 4 colocation it support vpn zerotier
    7
    82
    5.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      scottalanmiller @JaredBusch
      last edited by

      @JaredBusch said in Co-lo + 5 (or more) sites....connect 'em all:

      @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

      @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

      @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

      @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

      @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

      Hmmm...is this an option...? https://www.tnsr.com/

      An option in general? Sure, it's just a vRouter that does IPsec. I'm sure it is good, but you can't run it on an EdgeRouter because it's an OS.

      One would have to switch to pfSense if TNSR is a viable option.

      I guess the real question I'd have is... why? What about TNSR makes it interesting in any way? Aren't you just looking at replacing tried and true, built in IPSec implementations with this complicated package that is just repacking OpenSwan?

      I'm confused what you are trying to achieve. Connecting 5+ sites is the absolute clear use case for normal everyday IPSec on your outside hardware router. This is as "by the textbook" as it gets.

      Can you use other VPN tech for this like OpenVPN, yes. Should you? Not really, it has no benefits to you. IPSec is best for this for speed, support, ease of use.

      This is not a case where ZT has applicability unless you have needs that haven't been mentioned. Same with TNSR, what would this do other than make simple IPSec really hard and complicated for no reason?

      This feels like one of those Aaron threads where he's captivated by all kinds of shiny product pages and misses that he's trying to do something very straightforward that is handled best by the tools that everyone uses for this every day. I'm missing what is driving the attempt to research new, hip, flashy products as none of them seem to bring anything to this particular table.

      The claimed speeds is what caught my attention.
      TNSR "claims" they can do High Speed Site-to-Site IPsec VPN
      "TNSR provides secure high-speed routing solutions at 1, 10, 40, 100 Gbps, and beyond - at a fraction of the price of alternatives."

      Any vRouter should be able to do this though. All you need for any IPSEC solution is enough offloaded processing power to handle the chosen encryption level.

      Yeah, this is 100% about selecting the CPU, nothing else.

      1 F 2 Replies Last reply Reply Quote 1
      • 1
        1337 @scottalanmiller
        last edited by 1337

        @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

        Any vRouter should be able to do this though. All you need for any IPSEC solution is enough offloaded processing power to handle the chosen encryption level.

        Yeah, this is 100% about selecting the CPU, nothing else.

        That's not entirely true. The problem with high speed I/O is that the kernel eventually becomes a bottleneck. So to get the performance that the CPU is truly capable of you have to basically bypass the kernel.

        That's why routers that are using DPDK can get much higher performance.linux-kernel-w-DPDK.png

        1 Reply Last reply Reply Quote 0
        • 1
          1337
          last edited by

          Just to show how much DPDK can improve things when you have lots of packets and fast interfaces. This is a performance tests using 4x10GbE.
          dpdk_total-test-throughput.png

          1 Reply Last reply Reply Quote 0
          • F
            FATeknollogee @scottalanmiller
            last edited by

            @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

            Yeah, this is 100% about selecting the CPU, nothing else.

            If that's the case, there should be some "better/more" choices than the ER4?

            S 1 Reply Last reply Reply Quote 0
            • S
              scottalanmiller @FATeknollogee
              last edited by

              @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

              @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

              Yeah, this is 100% about selecting the CPU, nothing else.

              If that's the case, there should be some "better/more" choices than the ER4?

              Your basic choices are....

              ER4 is you want cheap, small hardware.
              Bigger Ubiquiti if you want the same but even faster.
              Whitebox with larger than Ubiquiti scale hardware.

              There are loads of vendors out there, but you are pretty much replicating these three underlying choices in some way. Small hardware, big hardware, white box. In all cases, IPSec is the choice for the fastest option on the given platform.

              F 1 Reply Last reply Reply Quote 1
              • F
                FATeknollogee @scottalanmiller
                last edited by

                @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

                Your basic choices are....

                ER4 is you want cheap, small hardware.
                Bigger Ubiquiti if you want the same but even faster.
                Whitebox with larger than Ubiquiti scale hardware.

                Cheap: ER4/ER6
                Bigger Ubiquiti: ER Infinity
                Whitebox: pfSense (insert fav brand) w own hardware - bigger/faster cpu, more RAM, SSD, Intel NICs etc

                1 Reply Last reply Reply Quote 0
                • 1
                  1337
                  last edited by

                  Shouldn't the first question be - how big are your pipes?

                  Then - how much of that will run over IPsec?

                  And - what features do you need?

                  F 1 Reply Last reply Reply Quote 2
                  • F
                    FATeknollogee @1337
                    last edited by FATeknollogee

                    @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                    Shouldn't the first question be - how big are your pipes?

                    Then - how much of that will run over IPsec?

                    And - what features do you need?

                    That's a reasonable question(s)

                    1. Pipe size: 1x 400/400 (AT&T), 3x 500/500 (Frontier) & 1x 1000/40 (Spectrum). Colo pipe will be adjusted as needed.
                    2. How much over IPsec: as much as I can get!
                    3. Features: mainly Site to Site VPN
                    1 S J 4 Replies Last reply Reply Quote 0
                    • 1
                      1337 @FATeknollogee
                      last edited by 1337

                      @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                      @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                      Shouldn't the first question be - how big are your pipes?

                      Then - how much of that will run over IPsec?

                      And - what features do you need?

                      That's a reasonable question(s)

                      1. Pipe size: 1x 400/400 (AT&T), 3x 500/500 (Frontier) & 1x 1000/40 (Spectrum). Colo pipe will be adjusted as needed.
                      2. How much over IPsec: as much as I can get!
                      3. Features: mainly Site to Site VPN

                      Well, you have peak 1900 Mbps in one direction and 940 in the other. But you never get that all the way so 1000/1000 in the colo will likely be more than you need. If it's all going to be IPsec traffic then ER4/ER6 is too small. Do you need HA as well?

                      F S 2 Replies Last reply Reply Quote 0
                      • F
                        FATeknollogee @1337
                        last edited by

                        @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                        @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                        @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                        Shouldn't the first question be - how big are your pipes?

                        Then - how much of that will run over IPsec?

                        And - what features do you need?

                        That's a reasonable question(s)

                        1. Pipe size: 1x 400/400 (AT&T), 3x 500/500 (Frontier) & 1x 1000/40 (Spectrum). Colo pipe will be adjusted as needed.
                        2. How much over IPsec: as much as I can get!
                        3. Features: mainly Site to Site VPN

                        Well, you have peak 1900 Mbps in one direction and 940 in the other. But you never get that all the way so 1000/1000 in the colo will likely be more than you need. If it's all going to be IPsec traffic then ER4/ER6 is too small. Do you need HA as well?

                        HA would be a nice "luxury" to have!

                        If the ER4/6 is too small, what other choice(s) are available?

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          scottalanmiller @FATeknollogee
                          last edited by

                          @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                          @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                          Shouldn't the first question be - how big are your pipes?

                          Then - how much of that will run over IPsec?

                          And - what features do you need?

                          That's a reasonable question(s)

                          1. Pipe size: 1x 400/400 (AT&T), 3x 500/500 (Frontier) & 1x 1000/40 (Spectrum). Colo pipe will be adjusted as needed.
                          2. How much over IPsec: as much as I can get!
                          3. Features: mainly Site to Site VPN
                          1. So the fastest reasonable is like 500, since the 1Gb has nothing else to talk to.
                          2. That's never a good way to look at it. I see tons of places do this and then realize that they don't even touch what they hae.
                          3. Is that even a need?
                          1 Reply Last reply Reply Quote 1
                          • S
                            scottalanmiller @1337
                            last edited by

                            @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                            @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                            @Pete-S said in Co-lo + 5 (or more) sites....connect 'em all:

                            Shouldn't the first question be - how big are your pipes?

                            Then - how much of that will run over IPsec?

                            And - what features do you need?

                            That's a reasonable question(s)

                            1. Pipe size: 1x 400/400 (AT&T), 3x 500/500 (Frontier) & 1x 1000/40 (Spectrum). Colo pipe will be adjusted as needed.
                            2. How much over IPsec: as much as I can get!
                            3. Features: mainly Site to Site VPN

                            Well, you have peak 1900 Mbps in one direction and 940 in the other. But you never get that all the way so 1000/1000 in the colo will likely be more than you need. If it's all going to be IPsec traffic then ER4/ER6 is too small. Do you need HA as well?

                            Oh, I assumed that those were all different sites, not all in one. Then yeah, that's a lot of speed.

                            1 Reply Last reply Reply Quote 0
                            • S
                              scottalanmiller @FATeknollogee
                              last edited by

                              @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                              If the ER4/6 is too small, what other choice(s) are available?

                              Way too small. You are talking about some crazy serious stuff here.

                              First, you need to figure out your pipe aggregation and speed from the other sites. The VPN piece isn't so hard, but combining all of those pipes will be.

                              1 Reply Last reply Reply Quote 0
                              • S
                                scottalanmiller
                                last edited by

                                So the plan to do BGP routing?

                                F 1 Reply Last reply Reply Quote 0
                                • F
                                  FATeknollogee @scottalanmiller
                                  last edited by

                                  @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

                                  So the plan to do BGP routing?

                                  I'm just trying to keep it real simple & take advantage of the available internet speeds!

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    scottalanmiller @FATeknollogee
                                    last edited by

                                    @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                                    @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

                                    So the plan to do BGP routing?

                                    I'm just trying to keep it real simple & take advantage of the available internet speeds!

                                    If you have all of those connections to a single colo (I'm not sure that that is what you were saying, trying to figure that out) then there is no simple answer. It's going to be really complex to try to aggregate them.

                                    J 1 Reply Last reply Reply Quote 0
                                    • J
                                      JaredBusch @scottalanmiller
                                      last edited by

                                      @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

                                      @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                                      @scottalanmiller said in Co-lo + 5 (or more) sites....connect 'em all:

                                      So the plan to do BGP routing?

                                      I'm just trying to keep it real simple & take advantage of the available internet speeds!

                                      If you have all of those connections to a single colo (I'm not sure that that is what you were saying, trying to figure that out) then there is no simple answer. It's going to be really complex to try to aggregate them.

                                      On the colo side, he has a possible max of 400 + 500 + 500 + 500 + coax (ignored). That is where 1900 came from, 4 remote sites with solid fiber connections.

                                      Now, there is no individual IPSEC tunnel that needs more than 500. He is not aggregating anything.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JaredBusch @FATeknollogee
                                        last edited by

                                        @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                                        1. How much over IPsec: as much as I can get!

                                        What does this even mean?

                                        F 1 Reply Last reply Reply Quote 0
                                        • J
                                          JaredBusch @FATeknollogee
                                          last edited by

                                          @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                                          1. Features: mainly Site to Site VPN

                                          Duh, that was that point of the entire thread.

                                          What are you doing over the tunnel?

                                          F 1 Reply Last reply Reply Quote 0
                                          • F
                                            FATeknollogee @JaredBusch
                                            last edited by

                                            @JaredBusch said in Co-lo + 5 (or more) sites....connect 'em all:

                                            @FATeknollogee said in Co-lo + 5 (or more) sites....connect 'em all:

                                            1. Features: mainly Site to Site VPN

                                            Duh, that was that point of the entire thread.

                                            What are you doing over the tunnel?

                                            S2S!! Like you said, this is the point of the thread.

                                            J 1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 3 / 5
                                            • First post
                                              Last post