Slashdot Mirror


User: pjtpj

pjtpj's activity in the archive.

Stories
0
Comments
3
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3

  1. Consider an easy to use commercial webapp scanner on Ask Slashdot: Do-It-Yourself Security Auditing Tools? · · Score: 1

    Check out https://purecloud.ncircle.com/solutions/en/WebApp/. It is not free, but it covers common web applications, and it is very easy to use. Disclaimer: I work for nCircle

  2. Re:Linux Routing Features with Dedicated DS3 Route on Channelized DS3 with Linux? · · Score: 1

    Oops. You are right. I meant VRRP between Linux boxes.

  3. Linux Routing Features with Dedicated DS3 Router on Channelized DS3 with Linux? · · Score: 1

    It may be too late to post, but this might still be good info for somebody:

    Until last year, I ran an ISP. Even though we had a pair of 7206VXRs (and access to ebay), we didn't use Cisco CT3 cards. Those cards were too expensive and had these awkward limitations: Bonding T1s was a problem. Traffic shaping doesn't work well. And you can can't have multiple sub-T1 rate customers on a single T1 channel (for example, you can't ask the phone company to put 6 256Kbps (256Kbps = 4 DS0s) customers on a single T1). Our ISP used all three of these features extensively.

    Instead of a Cisco or Linux card (we looked at both), for each CT3 circuit, we bought a Tasman 6300. Plus we kept a "cold spare" 6300 unit on site for an inexpensive kind of N+1 redundancy. A couple of years ago, each 6300 cost $10,000. When our internal routing became complicated enough, we starting running OSPF on everything, including the 6300s.

    You still might use Linux routers as the core of your network - in my latest venture we use a pair of fast Linux routers running HSRP with a group of layer 2 switches. We bought Cisco layer 2 switches. I am not stuck on Cisco, but, to make this work properly, you need to be able to create multiple VLANs (so each subnet's traffic is separate) that can span physical units (when redundancy is required), but you also need to have ports that can be in multiple VLANs simultaneously (so you don't have to buy a zillion Ethernet ports for your Linux routers). Ciscos can do this and I got a good deal on used equipment with ebay. With this setup, the layer 2 switches provide the physical Ethernet connections and your Linux router(s) provide layer 3 (and higher) features - iptables, traffic shaping, whatever. If you buy all the same model Cisco layer 2 switches, you can keep a cold spare for inexpensive kind of N+1 redundancy.

    For connecting non-channelized T3s to Internet backbones (or wherever), you can use Cisco 7200s, Linux routers with non-channelized T3 cards or even a Tasman 4100. If you plan to run BGP with multiple backbones, and you are not a super-duper BGP expert, then a used Cisco 7200 with adequate memory for full backbone BGP tables and a fast CPU is probably a good choice: It will work for sure, you can use sample configurations from your carriers and, chances are, you and the guy on the other end of the support phone line will be using the same equipment when things go wrong.

    Now I know these setup aren't true N+1 redundancy, like you get with a phone switch or UPS. But even with a Juniper, if a line card fails, the customers served by that line card are dead until somebody physically swaps it out. If you have techs on site (or nearby), with a cold spare on site, you can recover from total switch or router failure pretty darn quickly.