Hacker News Reader

Comment by mmmBacon | Hacker News Reader

This is a great example of why more operators should adopt white box solutions.

It would be interesting to see a refreshed view of what products white-box is able to replace. I recall that Juniper and Cisco were hard to replace for some products because the performance edge was in proprietary ASICs that aren't available to white box builders.

I suspect that CPU improvements and things like user-space networking (DPDK and friends) might have closed the gap some, but I haven't seen any recent analysis.

i doubt you are able to get the same features out of whitebox hardware.

Juniper's core routers have neat features in terms of redundancy. failing over a FPC (card with ASIC) to another routing engine(control plane) without downtime or packet flow impact is a big one. Performance might be there on the lower end (<40g), but there are a lot of features which require asics.

Another example is QoS/CoS without impacting performance or queues. These are the kind of things you cannot handle at the CPU without impacting traffic performance, which bites you when you are doing major traffic flows.

The main leap for whitebox is AES-NI for SSL/TLS offload.

Nobody is really using DPDK/NETMAP in OSS products from what I can tell.

Netgate is doing TNSR, but its not open source: https://www.netgate.com/tnsr-applications/edge-routing

Check out vyos.net

True, although every time I've tried it out its been fairly garbagey so I never considered it seriously. Its been at least 2 years though, I'll try it again.

Actually I think P4 programmable switch ASICs such as Barefoot are going to become more prevalent over time and hence features will be available in software.

hasn't P4 been kind of dead in the water for the last couple of years.

P4 programmability is available in Cisco Silicon One so wouldn’t call P4 dead in the water. Cisco Silicon One is meant to go head to head against Broadcom.

https://www.cisco.com/c/en/us/solutions/collateral/silicon-o...

In other merchant silicon, while not P4, Broadcom has offered their own proprietary programmability in Trident 3/4.

I think adoption has been slower more due to lack of relevant domain expertise in software as well as relative inability of pretty much anyone to properly model the impact of routing features on a production network than anything else.

P4 is being widely adopted at the NIC level.

Whitebox solutions can be adopted by corporations that can afford to have dedicated teams to maintain the software stack. For others, it can be quite risky.

> Whitebox solutions can be adopted by corporations that can afford to have dedicated teams to maintain the software stack.

Pretty much. Unless you have some remarkably top-notch people, this proposal is just security theatre. The chances you'll compromise yourself through an error in a complex area are much higher than the liklihood a sophisticated attacker will breach you.

Open- and FreeBSD deserve more usage

Well, JunOS is FreeBSD -- the magic is in their proprietary hardware. I'm not aware of open/whitebox solutions that can compete

Yes and no TBH.

Some Juniper gear emulated the IP2 forwarding asics in software, its fairly decent for what it is. All of the packet inspection stuff runs inside of FreeBSD. The new vSRX is all software and uses commodity cpu power for everything.

For raw speed, pfsense does a really good job on the low end of things but doesn't offer a lot of the inspection/IPS features that JunOS has. Arguably few people actually need IPS anyways.

The same goes for a VMX, which arguable is even harder to virtualize (and it is not on par with a real MX series router yet). Mainly because emulating some trio chipset features is at the moment very hard/impossible to do with great performance. (especially the dense queing part)

Which platform? Most of their hardware uses commodity ASIC/npu which really isn't magic, lots of great white label choices around.

There’s nothing special with the asics. Juniper makes it’s own Core and Edge routing chips but Arista competes successfully using Broadcom silicon.

There are switches out there by either Juniper or Cisco (can't remember which job I used them at) which actually have ARM CPUs on each switchport for one hardware acceleration feature :)

Reply on news.ycombinator.com