Slashdot Mirror
Cisco Turns Routers Into Linux App Servers
symbolset writes "InternetNews is reporting that Cisco's new Application eXtension Platform turns several models of Cisco switches into Linux application servers. With certified libraries in C, Java and Perl, developers will be able to use a downloadable SDK to build their apps. The AXP server is just another module in a Cisco switch running Cisco's own derivation of a modern Linux distro (Kernel 2.6.x) specifically hardened to run on that particular hardware. Modules will include up to 1.4-GHz Intel Pentiums with 2 GB RAM and a 160 GB hard drive."
Yes, it runs linux.
Yes, I know they're switches, not routers.
Now... anybody got any interesting applications for this?
Help stamp out iliturcy.
I've read the marketing release. Now I ask /.
What can you do with this?
No sig for you!!
check this out
Q. How does one develop an application for the AXP service module?
A. Both existing and newly developed applications must be ported to the AXP runtime environment by packaging them using the AXP SDK, which ships with the AXP hardware and software. The SDK package tool creates installation packages that can be loaded on the AXP blade. AXP developers are authorized by Cisco using the AXP Development Partner Program and require an authorization key in order to perform packaging of software.
http://www.cisco.com/en/US/prod/collateral/routers/ps9701/qa_c67_463943.html
That was routers, not switches.
Err in haste, repent at leisure.
Help stamp out iliturcy.
Another Cisco gadget that's cool as a cheap linux box is the NSLU2. For $80, you get a pretty full-featured Linux system. It's the size of a paperback, and draws a negligible amount of power. I use mine as a music server. There's a very lively and helpful user community on IRC. There are various options for modifying or replacing the system it ships with to get a more general-purpose linux box, running off of an external flash drive.
Find free books.
This allows apps to run on a module plugged into a Cisco _router_ , not a switch.
It might be interesting to read the data sheet.
meh.
Help stamp out iliturcy.
Great and I applaud them for doing something truly nerdy. What I am still waiting for is proper for a CISCO VPN client that works well under Linux and MacOS X, and not just Windows. It is irritating to enable firewall requirements, only to find that the only version that supports it is CISCO VPN Client for Windows.
Rant over, now you may mod me down.
Jumpstart the tartan drive.
Requiring authorization will probably cripple its usefulness as a Linux App Server...
BUT! whoever sells/buys this gets to say both "Yes, we're running Linux too" and "But were not really because its all locked down" depending on which constituency they are talking too: The pro open source crowd or the pro security through obscurity crowd.
Reminds me of way back in the days when Novell used to claim Netware 4.x-6.5 was an App Server too: It was a GREAT File and Print Server, with GREAT Directory Services (eDirectory compared to early Active Directory), but it sure was NOT a great App Server.
So this is a whole hardware server module that you stuff into a switch? Why?
A switch (or router, whatever) chassis is a ridiculously valuable piece of real estate... why would you want to spend that slot space plugging in PCs when they could just as easily be somewhere else, on the end of an ethernet cable?
Or is this intended for some highly specialized application where the linux system in tightly integrated with the host hardware in some way?
I didn't expect them to take the phrase "the network is the computer" quite so literally.
i'd hit it so hard, if you pulled me out you'd be the king of britain [bash.org]
Looks like Cisco is copying a 3Com innovation that has been available for over a year. 3Com OSM's are not only available for their routers, but also their 5500G switches.
http://www.3com.com/osn/
The point on making the f/w an appliance is that it has a predictable operating profile and known MTBF and reliability.
By opening it up as an app server, you're encouraging turning your key gateway security device into a one-off, unique, unpredictable infrastructure component.
see architecture pic: http://www.cisco.com/en/US/prod/collateral/routers/ps9701/images/white_paper_c11_459082-5.jpg
It would seem that Mono could be a runtime for apps also. Anybody know why that might not work?
As to why you'd want this on the router, you already have a footprint in that space. Virtualization and Consolidation = decreased (branch) footprint.
Cisco says it this way: http://www.cisco.com/en/US/prod/collateral/routers/ps9701/white_paper_c11_459082.html
Customer and Partner Value Propositions
The nature of the Cisco AXP, that of openness and flexible support of application services, is a catalyst for new growth areas within IT and as far reaching as facilitation of new business processes and enhanced business models. The concept of having application services resident on a Cisco router is appealing to various parts of an organization, be it a desire to minimize physical footprint and maximize service consolidation to hosting a distributed component of an application to promote a new business model. In any case, it is the inherent capability of the Cisco AXP module to assume system-level responsibility of hosting/integrating applications into the network that facilitates these things.
Independent software vendor (ISV) value proposition:
- Addresses Cisco large installed base and use Cisco's well-established channel relationships.
- The Cisco ISR has industry-leading market share. It serves as an excellent platform to integrate applications with security, unified communications, and WAN optimization built in.
- Provides ISVs with a faster time to market.
- Uses Cisco brand name and multi-geography reach.
Channel partner and service provider value proposition:
- Provides additional revenue opportunities and facilitates higher margins.
- Helps move from a product centric approach to a solution centric approach.
- Increases customer penetration and stronger bonds across multiple categories of decision makers.
- Is backed by strong worldwide Cisco support, including Cisco Validated Designs (CVD), training material, documentation, and so on.
- For managed service providers, it further reduces management complexity and on-site administration needs.
Customer value proposition:
- Provides server consolidation and decreased branch footprint.
- Lowers TCO with less power consumption.
- Provides enhanced productivity, better management.
- Provides better network and application services integration.
- Is compliant to industry standards such as payment card industry (PCI), Health Insurance Portability and
Accountability Act (HIPAA), and so on.
- Is one vendor to contact.
"Well, figure out where it's coming from"
"It's coming from the network sir"
"Of course it is, now where is it?"
"No, sir. The network is hacking itself. It's coming from one of the switches"
First it was printers that could run applications. Pop a tunneling app on the printer and remote in and now you're hacking them from their printer. Now switches can run apps too. Sure, a lot of problems related to this could be avoided by proper network administration but it's just one more thing to worry about if the network admin gets the order from management to turn those switches into servers because there's not enough room in the budget for more servers.
For $80, you get a pretty full-featured Linux system.
According to the Wikipedia entery you quote, its status is "Discontinued - no longer shipping."
Is this correct? Is there a followon to replace it?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Why let a serious multi thousend dollar switch run a applation stack you can run on a 500euro desktopc pc? Well, there are 3 ways yo spend money:
-Women. Most expense one, but definity most fun.
-Gambling. Most unsure way to loose money.
-Computers, most sure way to spend a large amoutn of money.
PS, not sure what the F stands for in MTBF.
Disclaimer- I work for Cisco as an Entrprise Sales Engineer
Lets clear a few terms up first-
Switch- Handles moving packets between endpoints on a single IP Subnet (layer 2 Device)
Router- Moves packets between different IP Subnets (Layer 3 Device)
Firewall- Applies security rules to routed packets
While the line is blurring physically between theses functions, as alot of switches can route and routers can switch, the logical functions are still the same. Your Standard Linksys/Dlink/netgear is a switch/router/firewall combined.
The AXP platform is a module that fits into our ISR router family, NOT into any switches.
Yes, the space in a router is valuable, that is exactly why companies want to get as much value as possible out of it. Most companies are looking for ways to consolidate and cetralize to reduce costs and ease management while adding features and functionality. Virtualization is the buzzword of the day.
Applications- Think about a company that has 200 remote offices that each have a server, if that server could be collapsed into a router blade (in combination with some other cisco technology like WAAS, that is possible) you reduce management, hardware and maintenance costs, electricity costs (green is also the word of the day) and provide the necessary services integrated into the heart of the network. Pretty cool.
It may be a little bit of "If you build it, they will come" so we built it, now let the programmers loose, change the game and build something cool.
So, this exciting new product is basically an underpowered and overpriced server blade that consumes slot space in your very expensive router? Well, at least it has a 10/100/1000 ethernet connection to the switch backplane, no way you could have a connection like that to a physically separate device.*snicker* Plus, it's locked down hard, and development requires Cisco's extra special blessing, that part makes me feel snuggly and secure!
Cisco has become a slow giant.
MRV had that Zuma router switch (lightreef series) in 2K that did BGP routing, strong switching and you could plug in CPU blades (was PPC G3 and later G4), that ran Debian.
They also marketed it as a developer platform, but i just ran linux on it, one blade for L2 firewall, one blade for load balancer, one for VPN gateway, DNS, Radius etc...
Basically you can build a quick ISP in a box with that Z16 beauty.
For redundancy you just had 2 of them, still cost half than 1 Catalyst 6500 .
Here is an old news post about it from ITworld, since MRV doesnt sell it anymore:
http://www.itworld.com/Net/3089/NWW010507120431/
Sad they weren't called Cisco, they might have gotten some front page in Slashdot.
The APIs are available in C, Java, and Python. The article says this, but the summary is wrong.
Hardware cost? A Dell vs a Cisco router blade... Hmm...
Maintenance... A Dell vs a Cisco router... Hmm...
And integrating services into the "heart of the network"? The network should be a dumb connection. It shouldn't be running services.
Deleted
Juniper's Linux IPS Hits 10Gb/sec
New things are always on the horizon
FYI, the AXP solution is for Cisco Integrated Services Routers - the modular enterprise branch routers... Not for its switches. This is a branch play.
While I believe there is a need for consolidation of equipment to reduce the footprint/power consumption required in remote offices. I think some of us are missing the point here. 1) I know this has been identified in other posts but, these modules work with the ISR ROUTERS, not the switches. They include the 1800, 2800, and 3800 series. 2) The specifications of the modules (AIM/NM) are really not that impressive. The 3800 series NM (NME-APPRE-522-K9) is about the only one I would even consider if "running infrastructure/directory services". 3) Reliability: This is not an enterprise class server. Some of us know the reliability issues with the IDSM blade for the 6500 series switches. 4) The main point of this module is to integrate the network and application layers. Packet monitoring API. Applications can monitor selected packets flowing through the network for monitoring and analysis purposes. With AXP, the need for a dedicated span port and complex wiring is no longer necessary. Cisco IOS Software information API. Utilizing this API, an application can programmatically query the router to retrieve current configuration, statistics, routing information, and so on. All information available to the Cisco IOS Software CLI and Simple Network Management Protocol (SNMP) agents are accessible though this interface. Event trigger API. The event trigger API allows the application to react to changes or events that occur within the router. An application event can be triggered on events such as a router interface failing over, packet loss exceeding a certain threshold, changes to routing table state, and so on. Cisco IOS Software configuration API. The configuration API allows the application to dynamically change the configuration of the router. Used in conjunction with the monitoring, information, and event trigger APIs, an application can dynamically change the behavior of the router in real time. Serial device API. AXP provides an application to communicate directly with serial ports of the router. This provides the ability for the integrated services router to support connectivity to traditional and nonstandard devices.
I don't know much about this, and the press release wasn't exactly illuminating, but said the APIs include Python. So if I have a SQL server hanging off of this AppServer/ISR, would that be a good place to deploy the front-end to a database?
Don't trust anyone under thirty.
So this is a whole hardware server module that you stuff into a switch? Why?
There are a bunch of things you'd like to do in a (non-backbone) router (i.e. and edge router or an enterprise router). Like high-intelligence packet filtering (such as malware detection). You'd like to do these in the routers at the edge of the ISP's network (where the packets for a customer finally come together after load-balancing multipathing), at the incoming firewall, and in the switches/routers within a campus LAN (i.e. to block the spread of viruses/worms once a behind-the-firewall machine is compromised.)
Some of the expertese to do this is in other companies than the router makers. It would cost a LOT to replicate this in a router company. (Example: The infrastructure to surveil for malware, analyze it, extract signatures, and maintain databases of them.) Better to partner with such companies, letting them provide the components they do well.
But there are a lot of potential problems with letting third parties build their software into the guts of the router:
- The processors and related infrastructure aren't optimized for performing this extra work.
- The amount of extra processing is enormous.
- Router internals don't provide a lot of protection from buggy - or malicious - code. Much of this is traded away for efficiency, minimizing the per-packet overhead. Major-league software QA substitutes for many hardware safeguards. Modules provided by third parties could break the router code, make it miss its performance requirements, and/or insert malware vulnerabilities in the routers themselves.
- Letting partners provide modules means giving them considerable visibility into the guts of the router. This means the router company's "secret sauce" recipies leave the building. The more partnering is done, the more potential leaks to the competition. (And the partners have much less incentive to protect the router company's secrets.)
A "resource card" design - a card fitting into a linecard slot, carrying the company's backplane routing interface plus commodity and/or special purpose processors, with their own API for plugging into the box's routing infrastructure, solves these problems.
- The box's routing code remains with the router company. It only needs to identify the packets requiring attention from the third-party resource, route them to the appropriate resource card, and route the result onward to the destination.
- The third party has an easy-to-understand environment that closely matches what they already work with and provides all the hooks they need. No "secret sauce" recipie required.
- The third party's code is compartmentalized - on hardware that provides security hooks as a given. Even if it is compromised the worst it can do is send malicious packets across the backplane to other line cards or across the control interface to the management processor(s) - and these can be alert for problems and protect themselves, just as they do from nasties arriving on network interfaces.
A switch (or router, whatever) chassis is a ridiculously valuable piece of real estate... why would you want to spend that slot space plugging in PCs when they could just as easily be somewhere else, on the end of an ethernet cable?
Because a backplane is SO much faster and a single box system SO much cheaper (especially in rack-unit rent) than a multi-box, router/server system.
For starters: A multi-box system doing any kind of filtering puts the packets through the switch TWICE, once on its way to the third-party resource, once on its way back. You'll need to chew up a slot or two just to provider enough networking bandwidth to exchange one slot's full line rate worth of traffic with the resource. So why fill the front of the card with interfaces and packet processors just for the handoff, when you could put the resource there in the first place and save a box?
Putting the resource in a
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
The Point, though Cisco isn't bragging it, is about control. What part of the network do you want to exert control on applications and data? Traditional concept of "the network as the computer" as proposed by Sun or Oracle puts the OS in charge, commoditizing servers, and requiring only dumb network switches and routers. This is about taking back the leverage and power companies like Cisco, 3Com, and Juniper felt they have given away. And this development finally begin to make each network device intelligent. Just a first step. More power and greater capabilities are sure to come embedded on each new generation of routers and switches. For all the years Linux desktop market share struggle at 1-2%, we are finally seeing the flexibility of Linux take off in areas that will give Windows real trouble - in the low-cost laptops and directly on non-PC devices. While the Gartner boys may argue that Windows need to become more modular, the hardware makers are moving ahead already. Piece by piece they will take away the need to have an all encompassing OS like Windows that controls everything. If the network manages and controls the applications and data, and runs on VMs, then even a traditional OS is just a commodity application on the network. The modern OSs have commoditized servers. Now the h/w and VM makers are trying to commoditize the OS. Sure, Windows has the resources to respond. The relevance of Windows still lies in its 90% desktop software dominance, and parlaying that user dependency into the future of computing. When or whether that dominance will be slowly chipped away through these new developments in mobile and cloud computing advances, hard to say, but sure it's fun to watch all these tech companies fighting for a bigger stake in the ever changing new fields.
What about using it as a departmental imaging server.
With a 160GB drive - put some images on the router - plug a machine into a VLAN and the machine could then boot off the network and be imaged with the system image for that department/VLAN.
It could be used for Caching and proxy services.
How about a web based chat channel. - jsut enter the IP of your default Gateway and you get a web based chat room. You can see all the other people on your subnet hanging from that device - and see its peers - you could then open channels to upstream routers as well - maybe the admins could control how many hops away you can see.
How about an integrated monitoring app. Go to the IP of the gateway and it will show you waht services it thinks your system is running (and the services of all the other machines directly attached) and you can configure monitoring and alerts for those services. Log in and tell it "this machine I am on is a web server - check this URL if you cant get to it email/SMS me"
I absolutely HATE the fact that there is no intrinsic bandwidth monitoring and reporting in many networking devices. I would want the machine to have integrated traffic reporting at every hub. (you know what I mean by hub). I should be able to look at all flows through a router/switch and see what/how much/who is doing what. And I shouldnt have to ahve some external app/license to do so.
Cisco claiming a piece of software they make is hardened is absurd. In the past, they've used Redhat 7.1 as the base for their appliances, shipping security software with 5 year old versions of openssh and Apache, and then tried to claim they were "hardened". After breaking in, they turn out to be off the shelf RH 7.1, just without cups running.
Cisco and software do not get along. They make ok hardware (overpriced, but it works), but they have never once made a good piece of software.
Well, I work for a company that has been developing an application that runs on AXP that I would consider somewhat interesting.
In Germany they have mandated a decentralised health care IT infrastructure that enables people to store and manage identity (X509 certificates) and health related information on a smartcard (think ePrescription, HMO contract data, emergency data).
This system has rather hard requirements to security that involve among other things a sort of dedicated hardware platform that mediates between patient and doctor smartcards and a secure backend.
Since the CISCO ISR brings with it the entire network stack and it has this AXP platform for deploying applications on Linux, it's a pretty good match. We write our software in Java, expose a web service to the doctor/pharmacy system, talk to card readers in the LAN and establish VPN tunnels to the backend.
Since you have a dedicated hardware box doing this with a certified firewall, hardened Linux and a certified application stack you are able to provide a pretty robust device that has near-zero maintenance overhead. You drop it in the physician's network, do an initial setup and then forget about it.
The only link I can come up with on the fly is this marketroid page that lists our "solution".