6 ms·

This is a great example of why more operators should adopt white box solutions.

by mmmBacon 5y ago

Datagenerator 5y ago
Open- and FreeBSD deserve more usage
- 0x000000001 5y ago
  Well, JunOS is FreeBSD -- the magic is in their proprietary hardware. I'm not aware of open/whitebox solutions that can compete
  - bifrost 5y ago
    Yes and no TBH. Some Juniper gear emulated the IP2 forwarding asics in software, its fairly decent for what it is. All of the packet inspection stuff runs inside of FreeBSD. The new vSRX is all software and uses commodity cpu power for everything. For raw speed, pfsense does a really good job on the low end of things but doesn't offer a lot of the inspection/IPS features that JunOS has. Arguably few people actually need IPS anyways.
    - kazen44 5y ago
      The same goes for a VMX, which arguable is even harder to virtualize (and it is not on par with a real MX series router yet). Mainly because emulating some trio chipset features is at the moment very hard/impossible to do with great performance. (especially the dense queing part)
  - Hikikomori 5y ago
    Which platform? Most of their hardware uses commodity ASIC/npu which really isn't magic, lots of great white label choices around.
  - dhanna 5y ago
    There’s nothing special with the asics. Juniper makes it’s own Core and Edge routing chips but Arista competes successfully using Broadcom silicon.
    - 0x000000001 5y ago
      There are switches out there by either Juniper or Cisco (can't remember which job I used them at) which actually have ARM CPUs on each switchport for one hardware acceleration feature :)
tyingq 5y ago
It would be interesting to see a refreshed view of what products white-box is able to replace. I recall that Juniper and Cisco were hard to replace for some products because the performance edge was in proprietary ASICs that aren't available to white box builders. I suspect that CPU improvements and things like user-space networking (DPDK and friends) might have closed the gap some, but I haven't seen any recent analysis.
- kazen44 5y ago
  i doubt you are able to get the same features out of whitebox hardware. Juniper's core routers have neat features in terms of redundancy. failing over a FPC (card with ASIC) to another routing engine(control plane) without downtime or packet flow impact is a big one. Performance might be there on the lower end (<40g), but there are a lot of features which require asics. Another example is QoS/CoS without impacting performance or queues. These are the kind of things you cannot handle at the CPU without impacting traffic performance, which bites you when you are doing major traffic flows.
- bifrost 5y ago
  The main leap for whitebox is AES-NI for SSL/TLS offload. Nobody is really using DPDK/NETMAP in OSS products from what I can tell. Netgate is doing TNSR, but its not open source: https://www.netgate.com/tnsr-applications/edge-routing https://www.netgate.com/tnsr-applications/edge-routing
  - sekh60 5y ago
    Check out vyos.net
    - bifrost 5y ago
      True, although every time I've tried it out its been fairly garbagey so I never considered it seriously. Its been at least 2 years though, I'll try it again.
- mmmBacon 5y ago
deleted 5y ago
[deleted]
pacetherace 5y ago
Whitebox solutions can be adopted by corporations that can afford to have dedicated teams to maintain the software stack. For others, it can be quite risky.
- rodgerd 5y ago
  > Whitebox solutions can be adopted by corporations that can afford to have dedicated teams to maintain the software stack. Pretty much. Unless you have some remarkably top-notch people, this proposal is just security theatre. The chances you'll compromise yourself through an error in a complex area are much higher than the liklihood a sophisticated attacker will breach you.

This is a great example of why more operators should adopt white box solutions.

Datagenerator 5y ago

Open- and FreeBSD deserve more usage

0x000000001 5y ago
Well, JunOS is FreeBSD -- the magic is in their proprietary hardware. I'm not aware of open/whitebox solutions that can compete
- bifrost 5y ago
  Yes and no TBH. Some Juniper gear emulated the IP2 forwarding asics in software, its fairly decent for what it is. All of the packet inspection stuff runs inside of FreeBSD. The new vSRX is all software and uses commodity cpu power for everything. For raw speed, pfsense does a really good job on the low end of things but doesn't offer a lot of the inspection/IPS features that JunOS has. Arguably few people actually need IPS anyways.
  - kazen44 5y ago
    The same goes for a VMX, which arguable is even harder to virtualize (and it is not on par with a real MX series router yet). Mainly because emulating some trio chipset features is at the moment very hard/impossible to do with great performance. (especially the dense queing part)
- Hikikomori 5y ago
  Which platform? Most of their hardware uses commodity ASIC/npu which really isn't magic, lots of great white label choices around.
- dhanna 5y ago
  There’s nothing special with the asics. Juniper makes it’s own Core and Edge routing chips but Arista competes successfully using Broadcom silicon.
  - 0x000000001 5y ago
    There are switches out there by either Juniper or Cisco (can't remember which job I used them at) which actually have ARM CPUs on each switchport for one hardware acceleration feature :)

tyingq 5y ago

It would be interesting to see a refreshed view of what products white-box is able to replace. I recall that Juniper and Cisco were hard to replace for some products because the performance edge was in proprietary ASICs that aren't available to white box builders. I suspect that CPU improvements and things like user-space networking (DPDK and friends) might have closed the gap some, but I haven't seen any recent analysis.

kazen44 5y ago
i doubt you are able to get the same features out of whitebox hardware. Juniper's core routers have neat features in terms of redundancy. failing over a FPC (card with ASIC) to another routing engine(control plane) without downtime or packet flow impact is a big one. Performance might be there on the lower end (<40g), but there are a lot of features which require asics. Another example is QoS/CoS without impacting performance or queues. These are the kind of things you cannot handle at the CPU without impacting traffic performance, which bites you when you are doing major traffic flows.
bifrost 5y ago
The main leap for whitebox is AES-NI for SSL/TLS offload. Nobody is really using DPDK/NETMAP in OSS products from what I can tell. Netgate is doing TNSR, but its not open source: https://www.netgate.com/tnsr-applications/edge-routing https://www.netgate.com/tnsr-applications/edge-routing
- sekh60 5y ago
  Check out vyos.net
  - bifrost 5y ago
    True, although every time I've tried it out its been fairly garbagey so I never considered it seriously. Its been at least 2 years though, I'll try it again.
mmmBacon 5y ago

deleted 5y ago

[deleted]

pacetherace 5y ago

Whitebox solutions can be adopted by corporations that can afford to have dedicated teams to maintain the software stack. For others, it can be quite risky.

rodgerd 5y ago
> Whitebox solutions can be adopted by corporations that can afford to have dedicated teams to maintain the software stack. Pretty much. Unless you have some remarkably top-notch people, this proposal is just security theatre. The chances you'll compromise yourself through an error in a complex area are much higher than the liklihood a sophisticated attacker will breach you.