Community discussions

 
marcusfrenkel
just joined
Topic Author
Posts: 2
Joined: Mon Nov 03, 2014 10:01 am

CCR1036-8G-2S+EM for border/edge router

Mon Nov 03, 2014 10:39 am

Hello there!

We're an ISP and we're considering to buy two CCR1036-8G-2S+EM to be used as border/edge router. Two of these since they don't come with dual PSU. Our setup will be:

[Two upstream Internet transit providers in full BGP] => [CCR1036] => [Huawei carrier-grade core switches configured to provide Internet connection to customers based on VLAN groups and static IPs]. Total traffic about 8Gbps.

We still doubt whether to give Mikrotik a try since there were many reviews talking about these issues:
A. If CRC functions as firewall too, the routing capability is significantly decreased due to high CPU load. Especially on DOS attacks, when it can turn into non-responsive device.
B. BGP routing table updates uses one CPU core, and the core load may stay at 100% all the time.
C. Uptime is not really long.

While we can risk with points B and C, we can not do it with point A, as our network receives a lot of attacks. What would be your advice on overcoming the issue with network attacks when CRC is first on the line of defense?
 
User avatar
sergejs
MikroTik Support
MikroTik Support
Posts: 6616
Joined: Thu Mar 31, 2005 3:33 pm
Location: Riga, Latvia
Contact:

Re: CCR1036-8G-2S+EM for border/edge router

Mon Nov 03, 2014 1:04 pm

Please use MikroTik RouterOS v6.21.1 or later. Device responsiveness was significantly improved when it is under DoS attack.
CCR should be configurable even with loads that are indicated in performance table on bottom of the page:
http://routerboard.com/CCR1036-8G-2SplusEM

BGP full feed takes 1cpu ~3min to load, but after that is should work without any problems.
Make sure there are no no unnecessary routing table updates.

Please, contact support@mikrotik.com with supout.rif file after device rebooted, currently we are not aware of any remaining issues that cause reboots on CCR devices.
 
SystemErrorMessage
Member
Member
Posts: 378
Joined: Sat Dec 22, 2012 9:04 pm

Re: CCR1036-8G-2S+EM for border/edge router

Mon Nov 03, 2014 7:07 pm

aside from updating routerOS, consider using tarpits instead of dropping packet. It uses less CPU and it will eventually slow down DOS attacks. I find this to work very effectively with mine. It is very satisfying to watch DDOS and abuse attempts suffer slow downs eventually as their computer resources fill up.

I have a CCR1036-8G-2s+ and i am a little impressed with it so far with what it can handle with routerOS updated. The first thing i did when i got it was update routerOS and the firmware. I tend to bombard it with many different tasks and it handles them well. I am not so sure about BGP but the CCR1036 is currently the best routerboard has to offer. If it is not enough than consider an x86 based server. Facebook uses x86 servers with 100 core TILE network cards. The CCR can handle quite a lot of bandwidth but it is mainly the number of packets that should concern you. The only thing the CCR is poor at is at single core stuff and switching. I get slightly increased latency (100-200 microseconds more) compared to using a managed switch but at least i can even control L2 at the same time to a much greater degree. I wanted to get a 100 core TILE network card but couldnt find one and mikrotik's CCR comes with a newer version of TILE.

You can modify the CCR1036 to add another PSU to it. On the mainboard there are 4 more 3pin fan slots and another PSU slot which can fit another PSU but you would have to modify the case. It is too bad mikrotik didnt include SATA and PCIe as well as usb3.
 
marcusfrenkel
just joined
Topic Author
Posts: 2
Joined: Mon Nov 03, 2014 10:01 am

Re: CCR1036-8G-2S+EM for border/edge router

Tue Nov 04, 2014 6:47 pm

Thanks a lot!

How did the other users handle the issue of DoS attacks? Moving the firewall to the second level at devices after the CRC, such as mainstream switch? Or maybe placing a dedicated firewall device before CRC - while keeping CRC as a border gateway?
 
SystemErrorMessage
Member
Member
Posts: 378
Joined: Sat Dec 22, 2012 9:04 pm

Re: CCR1036-8G-2S+EM for border/edge router

Wed Nov 05, 2014 7:06 pm

what i do is just use tarpit instead of dropping packets. It is very effective but it can take a few hours to slow down the attacker but if the attacker is an adware botnet you can cripple his revenue with tarpit. Aside from securing things i would advice to use scripts to grab well known malicious IP lists and use a tarpit on them as well. You cant really hide your gear by dropping packets so you might as well slow them down and fill up their CPU and ram.

Mikrotik tarpit is very effective. A high end desktop will slow down within minutes of performing a DoS attack.

very important rule with tarpit is not to touch packet rates or even speed in the advanced/extra because than the other packets will get through.
 
dottxt
just joined
Posts: 15
Joined: Sun Feb 02, 2014 5:53 pm

Re: CCR1036-8G-2S+EM for border/edge router

Thu Nov 06, 2014 2:33 am

We use the 1036-8G-2S+ models for our edge routers, and they work great. Here's how we have them configured:

1) No firewall rules, so fastpath is enabled. If we need to drop packets, we add a null/blackhole route. We also announce that IP to our upstreams blackhole BGP session.

2) Any filtering via ACLs happens in our core routing layer. At this point we don't need large memory for half a million routes, so the equipment is much less expensive (Cisco/Brocade, etc). This sometimes means that the edge is passing a lot of garbage traffic into the core, but the cost to filter it is less. So long as the total stream doesn't exceed 10G per upstream we can maintain.

that being said, I have seen a few DDOSs come through that basically crippled the routers at around 1.5MPPS / router. All the CPUs were spiked. We weren't able to get a dump of the traffic to analyze what caused this increased forwarding overhead, but it may have been fixed in the newest release of ROS.

Aside from that, uptime is excellent. Had to replace the memory in one of the units, but its been working great ever since.

Good luck with your project

Who is online

Users browsing this forum: Majestic-12 [Bot] and 15 guests