1. 1 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security To Route Or Not To Route? Michael H. Behringer Dirk Schroetter TERENA Networking Conference 2006 17 May 2006, Catania, Italy

2. 222 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security The Internet: Historic Observations Grown from an academic experiment Today connecting everybody (almost) Global reachability Independent of underlying infrastructure The glue: Routing & Global addressing

3. 333 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security Another Historic Observation: ATM ATM was going to replace IP “ATM to the desktop” Why did this not happen?  No killer application for ATM at the desktop  IP works

4. 444 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security Today’s Trends Commercial ISPs: “Value added services”  Up the OSI stack Goal 1: Tie customer to SP Goal 2: Not become a commodity NRENs: “Lambda switching”  Down the OSI stack Goal 1: Not become a commodity Trend: Away from IP??? (up or down)

5. 555 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security Axiom Directions for the core: Mix of technologies Backbones based on different technologies (SDH/SONET, MPLS, optical, ATM, …) Interconnection between cores: Also IP, probably “IP will dominate the endpoint for the foreseeable future”.

6. 666 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security Commercial Providers IP connectivity is a commodity  Service decided by price only  Advanced SPs want to charge a premium Offer of services on top Content filtering, portals, spam control, security, etc. Also: VoIP, Video, etc. Also: VPNs  “Service selection” Up the OSI stack!

7. 777 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security NRENs and Higher Layer Services IP connectivity is a commodity  Must justify NREN’s existence by “value add” Many content services not acceptable to research community  Often break the “end-to-end principle”  If so, must be “non-intrusive” Limit to “acceptable” content services: CERT coordination, PKI, “community services”  Not enough to justify a NREN

8. 888 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security NRENs and Lower Layer Services Need for “guaranteed bandwidth”, and “high b/w” Perceived need for dedicated bandwidth Guaranteed bandwidth in the past: ATM Problems: - Inter-provider guarantees hard to achieve - Scaling issues for global guarantees - economical issues Today’s Keyword: Lambda Switching Same requirements as in the past Same issues as in the past, really And, IP will remain the endpoint interface!!!

9. 999 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security „IP Expensive – Optical cheep“??? -- Not Always True!! True without statistical multiplexing With statistical multiplexing: Routed infrastructure significantly cheaper! Key question for optical: Scalability! Works well for small set-ups (star, ring) When scaling up, becomes expensive (full / partial mesh) Small scale optical is price effective Large scale, routing is cheaper

10. 10 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security Technical Considerations Routing required to make networks scale point-to-point (optical, ATM, …) does not scale Policy control required at the provider edges  Hard with IP  Even harder with optical IP abstracts from the upper layers  Any application can run on IP IP abstracts from the lower layers  Over any network infrastructure

11. 11 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security Summary Any point to point technology has scalability limitations. Optical is an example. Endpoints are IP for the foreseeable future  The network must “speak” IP at the edge Inter-provider: Require an “abstraction point” between, to scale  IP Routing is required for large scale networks