On 12/02/2013 09:38, Phil Mayers wrote: > I had a discussion with some ASA BU people about BGP on firewalls, and I > explained how we used it (routing between L3VPN for enterprise network > segmentation). They seemed interested, and didn't categorically rule out > the notion of adding BGP, but I wouldn't bet on it...
I would very much like BGP support on the ASA. At the moment I use local ospf networks with redistribution into the bgp core, but that's hacky (although a lot less hacky than distributing routes right across the network with ospf). > Surely that depends on the router; I keep hearing how crappy the sup720 is > now that the new shiny is out, for example ;o) The sup720 has its uses. It doesn't quite have enough rate limiter buckets, and there are nasty problems with link-local connectivity but it's not bad as a P router. So long as you aren't doing ipv6 that is. > Joking aside, I agree that having a router on the link generally allows > first-line filtering (e.g. iACLs) with more predictable and consistent > performance characteristics. Firewalls fall over at the funniest things; > they'll happily handle 30k TCP connections/sec but can't handle 1k PPS of > UDP dst port 80, or something equally random. Just dns blast an ASA and it will fall over splat on its face. Watching this happen is hilarious in a slightly sick way, with session count going up to maxsession + 1, and input errors / underruns on the ingress interface as the box desperately tries to handle this stuff. Nick _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
