Reply to post: Same old same old

Same old same old

It's still the last mile that matters first and foremost. While reading the article, I was itching with curiosity all along, wondering if telepathic broadband transfer has finally been invented, or if the article would culminate with postal pidgeons over MPLS or something... none of that, actually.

In terms of weird stuff over MPLS, the weirdest I've read about was something like SDH over MPLS.

Back to last mile.

Even if you have a local cable co. / ISP wiring the whole neighborhood (around your offices) with dense FTTB at very friendly consumer prices, and you let him enter your building with a plastic pipe (the extra trench is like 15 m), once you ask for an actual proposal, for some modest symmetric bandwidth over fiber, with a /29 block of public static IPv4... if there's no competition, he will possibly propose the fairly basic service at an outrageous sum of money. I was in that situation as a small business admin and kept using two microwave links (redundancy) for several years, until the local optical ISP finally gave in and proposed something sensible (and the sales guy got fired shortly afterwards.)

Here in CZ in a mid-size town (100k people), the real news in the recent years has been that local optical startups have started trenching across our post-commie residential areas (highrise condos with lots of grass inbetween). Actually in our very town, it's not that optimistic - it's a nation-wide cable co. vs. a local optical competitor. The nation-wide behemoth doesn't bother to offer better pricing, hence the local cable/optical company (in the business for some 25 years now) is earning most of the new consumer customers, for its symmetric optical (FTTB) Ethernet... but they're actually not a new startup, they're more like a local incumbent. Next to the incumbent telco, selling DSL over 20 years old copper, which was then (in mid nineties) totally overhauled using govt subsidies...

The midsize and bigger cities tend to be barricaded against "trenching optical startups" by local incumbents with political connections. I keep hearing about even smaller towns (~10-20k residents) where wireless ISP's turned optical startups are busy trenching consumer broadband and selling it cheap, with the support of an elucidated local authority. Excellent places to live, less excellent to find a job apparently...

Hell I'm told that many locations in Prague are absolutely hopeless in terms of modern broadband, consumer or business-class. And, it's always about the last mile. Noone bothers to lay new optical cables in the densely cobbled urban areas. I used to work for two ISP's in Prague for several years around Y2k, I remember very well the numerous sales opportunities where there simply was no last mile transmission line to use... Where I work now, we have an office in Prague as well, at an outskirt of the city (a residential area with highrises and lots of grass) and our office still uses a microwave link!

I work for an admittedly small business. We don't care about MPLS. Most of our sales people are scattered throughout the country anyway, and the business software has to be useable for them from anywhere they stop for a while, so it wouldn't matter if some bigger "remote offices" had MPLS or some L2 VPN... It's OpenVPN for all of them and RDP on top of that, and the database client running against a local RDBMS on an RDP desktop is throttled mostly by ODBC latency, much more than by RDP screen refresh.

Once you get a good last mile, VPN can be quite a breeze. Perhaps we're lucky that we have a good local (national level) peering arrangement: the independent peering point (called NIX.CZ) now actually runs a distributed infrastructure with nodes in several cities... and I haven't heard about bilateral peering skirmishes among ISP's in the last 15 years or so. As for the firewalls... if you know the necessary basics, a good basic firewall can consist of a Linux PC with OpenVPN for the tunnels and Quagga(Zebra) to do some internal routing of your private subnets. Dual uplinks to two ISP's (with a double NAT) have their inherent limits for outbound internet traffic, but can be pretty nifty for a redundant VPN = if combined with redundant VPN tunnels and some dynamic routing on top (I prefer iBGP over OSPF, as BGP does *not* require a clear "link state" from the lower layers and keeps checking the connectivity on its own). You don't even need a PC for this, you can run OpenWRT on some SoHo router hardware, and theoretically Mikrotik HW/FW should also be capable of this.

Yeah right - I'm at the lowest end in terms of headcounts and bandwidth. It only starts to get interesting when you struggle with bandwidth and complexity (imagine multiple sites linked together in a massive VPN mesh).

I am told that there are off-the-shelf firewall boxes (no, not Cisco) that are miles ahead of my homebrew cobbled gateways. For the lazy folks it must be an excellent solution.

"Local Internet Breakout" - hell, I never knew it's got a dedicated name :-)

Outsourced VPN, outsourced security? God forbid, as long as I have a word... I used to work for the other side.