North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: SSH on the router - was( IT security people sleep well)

  • From: Alex Bligh
  • Date: Mon Jun 07 17:58:30 2004 

--On 07 June 2004 17:50 -0400 [email protected] wrote:


Well, either you have one per POP (and that, as Randy Bush points out, can
be quite the headache in itself), which is still a single point of
failure for that POP, or you're advocating that the routers be reachable
from the magic box at *any* POP (which is right back into the "large
number of machines" issue....)

Well the way we did it, all routers were accessible from 2 (large) POPs,
two being in the NOC, and one being elsewhere (now you mention it, it was a
datacenter & POP combined). So the "large" number of machines was 3. I am
sure we could have scaled this to (say) 4 without substantial difficulty.

I agree one in every POP would be both painful and pointless. But that
wasn't what I meant.

Alex