Transcript Network Services - Geoff Huston

Network Services
Geoff HUSTON
IP Access is not enough
An ISP service also requires:
mail & mailing lists
DNS
web
usenet
ftp
...
Mail Services
Outgoing Mail server
Outbound Mail
Outbound Mail POP or IMAP Access
Server
to Mail Account
Inbound Mail delivery
Mail Server
Backup
Secondary
Mail Server
Mail Alias
Local Access
Account
Mail
Client
Mail Services
Customer mailboxes
SMTP server
POP / IMAP access server
account management
alias management
Mail Services
SMTP relay for outbound mail
Secondary MX for customers
Mail List management for customers
DNS Services
Hosting Primary Domain Service
Secondary DNS Server
DNS Forwarder
Web Caching
improved fetch performance
ISP cost reduction
virtual web servers (virtual domains)
proxy servers
accepting advertisements on the web
page
Caching
1
cache
www.stuff.isp
2
cache
Large Scale Caching
client
Core Cache System
cache
cache server 172.16.0.1
172.16.0.1
client
ICP requests
client
cache
cache server 172.16.0.1
cache
172.16.0.1
cache server 172.16.0.1
ISP Network
172.16.0.1
POP Cache Architecture
Redirect TCP port 80 requests
to local cache system
to
customer
sites
Core
Network
LAN Switches
Core Router
Access Servers
Servers
Cache
Web Hosting
Virtual web hosts
172.16.0.2
172.16.0.3
172.16.0.4
172.16.0.5
http://www.net.isp
172.16.0.1
http://www.client1.dom
172.16.0.2
http://www.client2.dom
172.16.0.3
user page
sub 1
sub 11
sub 2
sub 12
sub 121
sub 32
sub 321
sub 4
sub 33
sub 322
sub 4
sub 1
sub 11
sub 2
sub 12
sub 121
sub 3
sub 31
sub 32
sub 321
http://www.client4.dom
172.16.0.5
user page
user page
sub 3
sub 31
http://www.client3.dom
172.16.0.4
sub 4
sub 33
sub 322
sub 4
sub 1
sub 11
sub 2
sub 12
sub 121
user page
sub 3
sub 31
sub 32
sub 321
sub 4
sub 33
sub 322
sub 4
sub 1
sub 11
sub 2
sub 12
sub 121
sub 3
sub 31
sub 32
sub 321
sub 4
sub 33
sub 322
sub 4
USENET servers
can be a valuable service
can be expensive!
too much traffic getting-in
too much hard disk capacity
maintenance cost a lot!
Games and Entertainment
The Internet is not intended to be serious
and there’s a perfectly good market for
games and entertainment
Game servers
Streaming audio/video servers
…
Local Office
Local Office
Local Office
Upstream ISP
Network Access
Server
Access
Filters
Local Office
Access Router
Radius
Server
Upstream Feed Router
Mail
Server
Accounting
Network
Data
Management
Server
DNS
Server
WWW
Cache
WWW
Server
Usenet
Server
45Mbps Backbone
45Mbps Backbone
Backbone Router
Backbone Router
Dial-Up Network
Access Server
Network Client
Access Router
Network Client
Access Router
Radius
Server
Accounting
Data
Mail
Server
DNS
Server
Network
Mgmt
Server
WWW
Cache
WWW
Server
Usenet
Server
622MbpsSONET Backbone
Add Drop Mux
Dial-Up Network
Access Servers
Backbone Router
Backbone Router
Fast Ethernet Switch
Fast Ethernet Switch
155Mbps Fiber Connectors
Network Client
Access Routers
Radius
Server
Accounting
Data
Mail
Server
DNS
Server
Network
Mgmt
Server
WWW
Cache
WWW
Server
Usenet
Server
Adding Security to the Design
Service Plane
Network Access
Server
Local Office
Access Router
Network
Router
Radius
Server
Mail
Server
DNS
Server
WWW
Cache
WWW
Server
Control and Management Plane
Network
Accounting
Management
Data
Server
Usenet
Server
Example: Securing the Usenet Server
Local Office
Local Office
Local Office
Network Carriage Plane
Network Access
Server
Local Office
Access Router
no loose source routing
no directed broadcast
permit any source to usenet server TCP port 119
permit NetOpsCenter source to usenet server
deny all else
Upstream Feed Router
Radius
Server
Mail
Server
DNS
Server
WWW
Cache
WWW
Server
Usenet
Server
ISP Service Plane
ISP Management Plane
Accounting
Server
Network
Management
Server
TCP logging
SYN protection
permit any source connect to TCP port 119
permit NetOpsCenter source to any port
deny all else
Service Issues
Do ISP services attract a different tariff?
How are service ports accounted?