Experimentation on the Live Network Brian Nisbet Network Operations Manager, HEAnet TNC 2014, Dublin

Fadó, fadó in Eireann Fadó, Fadó in Eireann, (12 years ago) Internet was important, but not the absolutely vital thing it is now. 2

Static HTML Internet access was important, but not vital. VLEs & remote lectures were far off, future things. Usage was relatively low. We generally knew about an outage before our client did. Not the wild west of the 80s (1980s), but not today No VLEs, no learning through You Tube. We would notice an outage before our clients did (mostly).

Oh the things that we did! Dual-stacking networks! Dangerous Habits Oh the things that we did! Dual-stacking networks! Core & access upgrades in one day! Crazy times! Could play around with risky things, like dual-stacking the network. Upgrade the whole thing in one day… We would notice an outage before our clients did (mostly). So, a bit more freedom to play (strike) experiment & research in a controlled fashion.

Freedom to Play Experiment So, a bit more freedom to play (strike) experiment & research in a controlled fashion.

Everything is Different Now <Insert Stock Photos of Students Online Here> We still like to research, but always on is the thing now.

Need to reduce equipment use & save money. Urge to Experiment Need to reduce equipment use & save money. Official project is Juniper based vCPE. Decided to try an unofficial project. We also need to save money on routers, switches & electricity. Official project is vCPE (in pilot phase now) I said this at a meeting, and then a little while later…

HEAnet Skunkworks Cisco ME3400, split into a L2 Switch & L3 Router. A Swouter! Needed to fit into L2 provisioning system and keep the two networks separate. Two VRFs, connected via Ethernet cable. Project started by the NetOps team in HEAnet, aim to combine L2 & L3 capabilities into one box. Needed to fit into L2 Provisioning system and be separately manageable by the L2 & L3 network management systems. Opted for Cisco 3400, two VRFs, box sitting on both networks, completely home built config, significant work required to integrate it with provisioning system. Research!

It’s Not Working! Max 20Mbps initially. Authentication. Monitoring. Multicast. Security! Required extensive lab work. Had to ensure there was no access to L2 network via L3, many ACLs (some mistakes initially made). Throughput started at about 50Mbps, then to over 200Mbps, at production over 500Mbps.

It’s Working! ~500Mbps (after IOS change & SDM template change) now. Small security issue in test, secured. Auth works. Monitoring works. Had to ensure there was no access to L2 network via L3, many ACLs (some mistakes initially made). Throughput started at about 50Mbps, then to over 200Mbps, at production over 500Mbps.

Under the Radar Boxes now on the live network. Perfect for clients that need more than 100Mbps, but less than 500Mbps. Several upgraded from Cisco 2821s. Full SLAs & HW/SW support. Perfect replacement for clients being upgraded from 100Mbps links (and Cisco 2821s) to 1Gbps (but who don’t initially, require anything like 1Gbps line rate). Full vendor support for IOS & hardware. Lab testing for months. Installed on small client campus, full maintenance window etc.

Results Saved money. Saved power. Bottom-up project, engineer lead. Team got to experiment *and* provide full SLA-ed service. Running stable now, going to deploy second box in higher bandwidth location. Bottom up, achieved all of the goals.

brian.nisbet@heanet.ie @natural20