MPLS alternative
-
@hobbit666 said in MPLS alternative:
@Dashrender said in MPLS alternative:
What is your Citrix environment providing you? What are you deploying using it?
We use MS Dynamics GP. So instead of installing this on 300+ computers (then having to update 300+ computers when updated keys and modules come out) we have 15 Citrix Xen Desktop servers that these computers access to get onto the GP stuff. They've always used Citrix instead of RDS as "apparently" ICA protocol uses less bandwidth.
Yep, that's been generally true ICA has used less bandwidth than RDP (*pssst - the server side still has RDS installed on it as far as I know - they just add the Citrix stuff on top of RDS to gain access to ICA and other Citrix stuff)
-
@hobbit666 said in MPLS alternative:
@Dashrender said in MPLS alternative:
Yeah, What you mention is doable sharepoint/OD4B.
Yeah we moving more to this everyday, especially when replacing machines/deploying new ones.
Iām not sure if RDS/Citrix can use AAD, but that could be an option for your central Authentication.
Why AAD instead of on site AD? As i thought you didn't want AD doing the central point for security/authentication?
Or is AAD a better choice as it's protected in the cloud?AAD =/= AD
Azure AD is a completely different beast than AD.
That said, I know of many larger networks 1000+ users (could easily be 5000+, I just don't know) that do exactly what you're looking at. They have on prem AD, which syncs with AAD, and that same credential is what they use to access all of their systems as they have SSO'ed them all together.
@scottalanmiller said in MPLS alternative:
Someone accidentally ties the Citrix ICA authentication to AD. They then expose AD to the Internet.
I'm not sure what he means by the expose AD to the internet? I would hope that he doesn't simply mean that Citrix's exposure is exposing AD to the internet?
Frankly, at this level I don't know where good practices sit.
You have 300+ users, and since Citrix runs on Windows (the Citrix product we are talking about anyway) I can't imagine not using AD to manage those users on the 15 Citrix servers. You could use SAMBA instead, it might be a bit more secure, but by it's nature of being compatible with AD, I "feel" that seems unlikely.
@scottalanmiller what would your system look like that does this? 15 Citrix server farm, 300+ users. Assuming everyone has a laptop provided and managed by the company - what are you doing for those devices?
-
@Dashrender said in MPLS alternative:
Look at the full convisation.
I said we had some site with 100Mb leased lines.He then asked
Why would you ever want a leased line? Leased lines essentially only exist today to make MPLS possible. They are costly and risky.
Which i explained
Because we "couldn't" get a line above 5mb so Replication to the DR site would be impossible. Also handling the traffic from all the sites, like print servers, smb shares etc
he then said
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Which lead me to explain we can only get ADSL with no bandwidth or Leased line for MPLS OR Internet access.
-
@hobbit666 said in MPLS alternative:
@Dashrender said in MPLS alternative:
Look at the full convisation.
I said we had some site with 100Mb leased lines.He then asked
Why would you ever want a leased line? Leased lines essentially only exist today to make MPLS possible. They are costly and risky.
Which i explained
Because we "couldn't" get a line above 5mb so Replication to the DR site would be impossible. Also handling the traffic from all the sites, like print servers, smb shares etc
he then said
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Which lead me to explain we can only get ADSL with no bandwidth or Leased line for MPLS OR Internet access.
Let me digest this in Scott terms:
ScottWhy would you ever want a leased line? Leased lines essentially only exist today to make MPLS possible. They are costly and risky.
hobbit
because we can't get more than 5 Mb (great answer)
This is where Scott could have said - OK - that sucks, but at least that explains why you have leased lines. But he skipped that part as assumed, because you just said it.
now Scott moved onto
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
and you replied
Wrong!!! We are in the UK and bound by Openreach infrastructure, where some site only have ADSL products and long line lengths. If we need more bandwidth we have to pay for better lines. Thankfully 4G coverage is getting better and that's a good alternative.
that does say this
we can only get ADSL with no bandwidth or Leased line for MPLS OR Internet access.
but a bit less straight forward.
In the end, I think you are both on the same page.
Scott says don't use leased lines unless you have no other choice - you declare you have no other choice - check!
Now we move forward and look at the MPLS component of the lease line contract, can you ditch it?
-
@Dashrender said in MPLS alternative:
Now we move forward and look at the MPLS component of the lease line contract, can you ditch it?
Yes if we ditch the MPLS, but what will we replace it with
that's the big question -
@hobbit666 said in MPLS alternative:
@Dashrender said in MPLS alternative:
Now we move forward and look at the MPLS component of the lease line contract, can you ditch it?
Yes if we ditch the MPLS, but what will we replace it with
that's the big question First things first - do you need to replace it with anything? Do you need LAN level connection between your locations for a specific reason? If the answer is yes, then you'll use your own firewalls that create site to site VPNs. I've been doing this since 2001. It works great.
Question: do you have any firewall(s) today? One could potentially have managed firewall services as part of MPLS as well, since you say internet access is all part of that same connection.
-
@hobbit666 said in MPLS alternative:
@Dashrender said in MPLS alternative:
Now we move forward and look at the MPLS component of the lease line contract, can you ditch it?
Yes if we ditch the MPLS, but what will we replace it with
that's the big question - Replace it with not needing it.
- If you can't do #1, then standard everyday VPN. There's no other rational option and you should not be digging for you. VPN is the one and only reasonable answer to this.
-
@hobbit666 said in MPLS alternative:
@Dashrender said in MPLS alternative:
Now we move forward and look at the MPLS component of the lease line contract, can you ditch it?
Yes if we ditch the MPLS, but what will we replace it with
that's the big question One option would be to move your entire environment to LAN infrastructure.
- You install a firewall to put a guard between the leased line and your company,
- The PCs use RMM for centralized management, and a local user account (makes sharing computers a bit harder, but not impossible)
- You use AAD for access to email/word/excel/OD4B/Sharepoint/etc
- You use "something" to manage user account on Citrix - let's see Scott's answer on this
- printing is all local or could be cloud managed (there are newer services for this).
- VOIP phones connect directly over the internet to a PBX
in that setup, there would be no reason to have direct connections from the branches to the home offices.
-
@hobbit666 said in MPLS alternative:
I'd guess we still would want a Firewall of some sorts at each site?
Every LAN should have a firewall (and has to have one, it is the firewall that makes it a network, it's literally impossible to have a network without a firewall.)
Note: This is because all firewalls are routers and all routers are firewalls. Technically you can make a router exist without being a firewall, but not if you need standard network addressing and no one has made one of these for decades because it would be useless. So while yes, they aren't the same thing in reality, they absolutely are in practice.
-
@hobbit666 said in MPLS alternative:
Yes it does, we've used it several times when we were with BT foe the MPLS. We log a call and WITHIN 4hrs the hardware is replaced.
You don't understand. You cannot use what has happened to determine what it means. I have outages all the time without an SLA and it never takes four hours. By your logic, the SLA is what makes them do it in 4 hours. My point is, it isn't.
Even if you did this a thousand times, while that does show a good trend, it never tells you what guarantee there is under the hood and how risky it is before they fail. Every supply chain breaks at some point. You are using "got lucky" to denote "can't go wrong."
-
@scottalanmiller said in MPLS alternative:
@hobbit666 said in MPLS alternative:
I'd guess we still would want a Firewall of some sorts at each site?
Every LAN should have a firewall (and has to have one, it is the firewall that makes it a network, it's literally impossible to have a network without a firewall.)
Note: This is because all firewalls are routers and all routers are firewalls. Technically you can make a router exist without being a firewall, but not if you need standard network addressing and no one has made one of these for decades because it would be useless. So while yes, they aren't the same thing in reality, they absolutely are in practice.
I can't agree with you here scott - only thing required to make a network is NICs and some type of connectivity between them. Now if you're talking about one that access the internet or other networks - then I agree with you.
-
@hobbit666 said in MPLS alternative:
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Wrong!!! We are in the UK and bound by Openreach infrastructure, where some site only have ADSL products and long line lengths. If we need more bandwidth we have to pay for better lines. Thankfully 4G coverage is getting better and that's a good alternative.
Sure, but it doesn't have to be a private line, it can be an Internet line. I didn't say you didn't have to pay more than ADSL, just saying you don't need private lines that don't go to the Internet because any line that can be private, can be Internet.
-
@Dashrender said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
@hobbit666 said in MPLS alternative:
I'd guess we still would want a Firewall of some sorts at each site?
Every LAN should have a firewall (and has to have one, it is the firewall that makes it a network, it's literally impossible to have a network without a firewall.)
Note: This is because all firewalls are routers and all routers are firewalls. Technically you can make a router exist without being a firewall, but not if you need standard network addressing and no one has made one of these for decades because it would be useless. So while yes, they aren't the same thing in reality, they absolutely are in practice.
I can't agree with you here scott - only thing required to make a network is NICs and some type of connectivity between them. Now if you're talking about one that access the internet or other networks - then I agree with you.
Okay... with the implication that it has to talk to something. Obviously.
-
@Dashrender said in MPLS alternative:
@hobbit666 said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Wrong!!! We are in the UK and bound by Openreach infrastructure, where some site only have ADSL products and long line lengths. If we need more bandwidth we have to pay for better lines. Thankfully 4G coverage is getting better and that's a good alternative.
Is your internet charge a different charge on top of the MPLS?
If so you should be able to get leased lines with internet for the same or less cost, because they are dropping the MPLS component.
Exactly. Standard high cost fiber rather than a leased MPLS line. Leased/MPLS is always a fee on top of what internet access costs on the same non-leased/MPLS line.
-
@scottalanmiller said in MPLS alternative:
Sure, but it doesn't have to be a private line, it can be an Internet line. I didn't say you didn't have to pay more than ADSL, just saying you don't need private lines that don't go to the Internet because any line that can be private, can be Internet.
OK miss read that one
-
@scottalanmiller said in MPLS alternative:
@Dashrender said in MPLS alternative:
@hobbit666 said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Wrong!!! We are in the UK and bound by Openreach infrastructure, where some site only have ADSL products and long line lengths. If we need more bandwidth we have to pay for better lines. Thankfully 4G coverage is getting better and that's a good alternative.
Is your internet charge a different charge on top of the MPLS?
If so you should be able to get leased lines with internet for the same or less cost, because they are dropping the MPLS component.
Exactly. Standard high cost fiber rather than a leased MPLS line. Leased/MPLS is always a fee on top of what internet access costs on the same non-leased/MPLS line.
In your situation it's likely still a leased fiber line - seeing Scott toss that in there some places and not others - don't let that confuse you to think they are different things, the fiber itself and the contract for the fiber are the same as it would be under MPLS.
-
@hobbit666 said in MPLS alternative:
Another fundamental flaw of the business in general: "management have never liked." Management's job here is to make sure that "what is good for the business"
Their mind set is to keep the business running, i.e. if it's working why change? (I'm not disagreeing with you but we live in the real world)
No, their mindset is to spend money on things salespeople tried to sell them. Keeping the business running is exactly what they aren't doing. That's my entire point - they are acting like making money or keeping the business running (those are not necessarily the same thing, another common business mistake) don't matter.
If they cared about profits, they'd be looking at the big big picture and considering the cost which they have to be ignoring completely to be where they are.
If they can't grasp the big picture but are obsessed emotionally with uptime alone, they are still missing the big picture because they did the polar opposite. The riskiest form of network connection is the MPLS / leased line approach. Of course, it beats cheap consumer DSL, that is generally the case (absolutely not always, the biggest downtimes I've ever witnessed are 100% on leased lines with SLAs - no consumer line comes close to what those see in downtime) but the point is for less money there are better ways to use technology to get uptime. If uptime mattered and the same providers were all that were available, just skipping the MPLS alone would improve uptime, let alone all the other potential approaches.
-
@Dashrender said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
@Dashrender said in MPLS alternative:
@hobbit666 said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Wrong!!! We are in the UK and bound by Openreach infrastructure, where some site only have ADSL products and long line lengths. If we need more bandwidth we have to pay for better lines. Thankfully 4G coverage is getting better and that's a good alternative.
Is your internet charge a different charge on top of the MPLS?
If so you should be able to get leased lines with internet for the same or less cost, because they are dropping the MPLS component.
Exactly. Standard high cost fiber rather than a leased MPLS line. Leased/MPLS is always a fee on top of what internet access costs on the same non-leased/MPLS line.
In your situation it's likely still a leased fiber line - seeing Scott toss that in there some places and not others - don't let that confuse you to think they are different things, the fiber itself and the contract for the fiber are the same as it would be under MPLS.
No, not a leased line. Leased line means that the connection goes from site to site rather than site to the Internet. It's a cheaper Internet line rather than a leased line.
Still the same physical fiber, but when you go to the Internet it stops being leased.
Why is the word "leased" used to be "private site to private site", heaven only knows. But that's what the term means. A private fiber line that you install between you and the Internet is not called leased, even though there is no more or less logic to this name.
-
@hobbit666 said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
Sure, but it doesn't have to be a private line, it can be an Internet line. I didn't say you didn't have to pay more than ADSL, just saying you don't need private lines that don't go to the Internet because any line that can be private, can be Internet.
OK miss read that one
So what I'm saying the standard patterns are would be these...
Leased Line (MPLS or Other)
Office A leases a line to CLEC X. Office B leases a line to CLEC X. CLEC X connects the two together and there is no Internet involved. There's also no security because all traffic on this network is wide open plain text. The CLEC and anyone that taps the line can see all the traffic.
Internet Based Connection
Office A buys Internet line from CLEC X. Office B buys Internet line from CLEC X. Office A and Office B connect their firewalls via an IPSec VPN and all traffic bound for the other site goes through CLEC X (and not the Internet ever) in a secure tunnel that the CLEC cannot read. Any traffic to the Internet goes directly and does not go through the VPN.
-
@scottalanmiller said in MPLS alternative:
@Dashrender said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
@Dashrender said in MPLS alternative:
@hobbit666 said in MPLS alternative:
@scottalanmiller said in MPLS alternative:
Anything you can get in a leased line you can get in an Internet line for the same or cheaper. Leased lines aren't magic, they are just the same lines without Internet access.
Wrong!!! We are in the UK and bound by Openreach infrastructure, where some site only have ADSL products and long line lengths. If we need more bandwidth we have to pay for better lines. Thankfully 4G coverage is getting better and that's a good alternative.
Is your internet charge a different charge on top of the MPLS?
If so you should be able to get leased lines with internet for the same or less cost, because they are dropping the MPLS component.
Exactly. Standard high cost fiber rather than a leased MPLS line. Leased/MPLS is always a fee on top of what internet access costs on the same non-leased/MPLS line.
In your situation it's likely still a leased fiber line - seeing Scott toss that in there some places and not others - don't let that confuse you to think they are different things, the fiber itself and the contract for the fiber are the same as it would be under MPLS.
No, not a leased line. Leased line means that the connection goes from site to site rather than site to the Internet. It's a cheaper Internet line rather than a leased line.
Still the same physical fiber, but when you go to the Internet it stops being leased.
Why is the word "leased" used to be "private site to private site", heaven only knows. But that's what the term means. A private fiber line that you install between you and the Internet is not called leased, even though there is no more or less logic to this name.
huh - OK didn't specifically know that.
