Ray, This is changing now. MPLS at access is becoming popular since there are ways to provide adequate security. Unified MPLS is one example.
Best Regards, [http://www.cisco.com/web/europe/images/email/signature/horizontal06.jpg] Waris Sagheer Technical Marketing Manager Service Provider Access Group [email protected]<mailto:[email protected]> Phone: +1 408 853 6682 Mobile: +1 408 835 1389 CCIE - 19901 <http://www.cisco.com/> [Think before you print.] Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html From: Raymond Burkholder <[email protected]<mailto:[email protected]>> Date: Friday, February 22, 2013 5:12 AM To: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>> Subject: [c-nsp] u-pe placement At http://etutorials.org/Networking/MPLS+VPN+security/Part+III+Practical+Guidel ines+to+MPLS+VPN+Security/Chapter+7.+Security+of+MPLS+Layer+2+VPNs/C6+VPLS+a nd+VPWS+Security+Overview/ they say: "We recommend that no service provider edge (PE) router be located at a customer premise because such an installation exposes the service provider to unwelcome access. Further, in order to mitigate against control plane spoofing, examples of protocols that should never be exposed to untrusted routers include IGP, BGP, LDP, and RSVP-TE." Is this common best practices? Is there indeed quite a bit of risk in exposing the u-pe at the customer site? Is this exploited regularily? Are there methods of mitigating the risks? With routers like the 1921 sitting at customer sites, with better than adequate horsepower to handle mpls, it is very tempting to take the pe out to the customer site as a u-pe in the form of a 1921 or similar. Any comments on advantages/dis-advantages? Ray -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. _______________________________________________ cisco-nsp mailing list [email protected]<mailto:[email protected]> https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
