> > Hi > We area going to deploy a new MPLS network which will be used for Internet > customers and IP/VPN customers. I understand that there are two options > with running these networks: > 1. Run the internet natively across all boxes and secure them down against > DoS attacks etc > 2. Create an Internet VRF whereby all internet traffic is simply seen as a > large IPVPN network, thereby utilising some of the inherent security > factors associated with IPVPNS > My question is whether anyone has other pros and cons from real life > experience, associated with the two options previously stated. > I would like to add that the platforms will be provisionally Cisco 6500s > with SUP720s (edge) and Cisco XR 12406's (core) > Regards > Mark > You can do that, I did it for one customer on a 12k/7k6 network and it works. You did not mention whether you want to do default routing or full BGP in the VPN. Having the latter on 6k5/7k6 (although supported by -XL hardware) brings some serious limitations to the network, as BGP/prefix/TCAM/whatever else processing on the platform is far from optimal. Consider this especially if anything like fast convergence is your goal. But then - yes, there's so many nice thingies on having inet in VPN...
And then - the folks still have some issues when the full-BGP VRF on the 7k6 occasionaly stops forwarding anything, but that probably is a different story. -- deejay _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
