A handy tip here if you’ve ever lost access to your primary or secondary ASA or SRX device, you can still access them via the other node.

On the Cisco ASA this works on a per command basis, with failover exec mate followed by the command you want to execute on other node.

On the Juniper SRX you can switch the prompt over to the other node through the command request routing-engine login node followed by the nodes number.

In any network the cables that interconnect the devices are as important as the devices themselfs. In you have an Ubiquiti Unifi infrastructure, you can use the switch as a basic cable tester. There are however some caveat to consinder using the built-in Time-Domain Reflectometer (TDR)  Remember the built-in TDR is not a certified cable tester. For instance the cable connecting the UAP-AC-PRO will always return the "open" condition on Ubiquiti equipment. This is also mentioned in this EdgeMAX forum post. Also the distances estimates on short cables are too high, at least on the US-8-150W with fw 3.9.15.8011 and earlier.

Keeping those caveats in mind, the cable test still is usefull, for example combined with the "show port slot/port" command you may find that the port won't negotiate 1000 Full because one or more of the four pairs is open. At the time of writting the switch allas doesn't return which pair has the issue

Here is how you can use the TDR, by going to the DEVICES tab, and then opening the devices properties of the switch. Go to the Config tab within properties, click on debug terminal, and click on Open terminal. After which you can enter the command "swctrl -d cable show", as seen below. Alternatively you can enter the switch-cli via "telnet localhost 2222", enter enable mode, via "enable", and use "cablestatus slot/port"

Cable modem status page

The cable modem status page is available at http://192.168.100.1/ if you have an ex-UPC (Ziggo) cable internet connection. Other providers may use another IP address (you can use a port scanner to scan the entire private IP space to find it, if that information is not available) or disable the page entirely. Below a screenshot of a status page of an Arris TM402B cable modem.

Power 

Is the voltage measured in decibels. 1 Millivolt at 75 ohm resistance is 0dBmV. According to the EuroDOCSIS specifications the input power (i.e. the electrical potential that the cable modem receives from the CMTS) can be between +15dBmV and -15dBmV. Under normal circumstances the value is usually between +4dBmV and -4dBmV. The output power, that is the electrical potential that the cable modem sends to the CMTS, is regulated automatically by the layer 1/ layer 2 EuroDOCSIS protocol stack. According to the EuroDOCSIS  2.0 specification the value should be between the +8 dBmV and +53 dBmV. Theoretically a lower value is better, but noise will have more influence on the signal. Normally the value should be somewhere between the +40 dBmV and +53 dBmV.

Signal to Noise Ratio (SNR)

The signal to noise ratio indicates the quality of the connection. The required SNR differs per modulation method. The more bits per symbol per second the modulation sends, the higher the SNR needs to be. Below a table of the required SNR @ BER<10^-8.

Symbol rate

Actually a synonym for Baud, symbols per second or pulses per second. Depending on the line-coding or modulation method the data density varies. Below a table with the data density per symbol per line-coding.

With the table above, the symbol rate is easily converted to a data rate with the formula Data_Rate = #_Bits_per_symbol * Symbol_Rate. So the upstream data rate calculation: QAM16 (4 Bits) * 5120 kSym/sec = 20,48 Mbits/sec.

The available upstream bandwidth is divided via FDMA/TDMA/S-CDMA to the cable modems per CMTS. In other words, you only have a small section of the bandwidth available on the cable to your disposal. Since the Dutch cable companies switched to EuroDOCSIS 2.0 they use S-CDMA. Since then the cable modems can send within the same TDMA time slot (meaning at the same time), on the same RF channel. With their signals divided by orthogonal codes. Since then it is unnoticeable that bandwidth is shared.

EuroDOCSIS 3.0

EuroDOCSIS 3.0 specification released in 2006, significantly increases transmission bandwidth (both upstream and downstream) and introduces support for Internet Protocol version 6 (IPv6). The transmission bandwidth is increased by channel bonding, which enables multiple downstream and upstream channels to be used together at the same time by a single subscriber. With a minimum requirement of 4 channels both down and upstream. Below a screenshot of the status page of a Technicolor TC7200.U cable modem.

Wednesday 13 may 2015 | 12:20 CET / @472.beats | AMSTERDAM

While testing newly installed 100GE modules on a PE under maintenance in EQUINIX AM3. An engineer accidentally placed a loop on the ISP peering VLAN. The loop caused a high CPU on all backbone and customer modules resulting in many BGP sessions dropping. The incident lasted 10 minutes. The BGP sessions are restored.

An URL filter is a mechanism to restrict or control access to a website. The URL filter determines what content will be available or perhaps more often what content will be blocked.

Cisco IOS provides us with many different ways to accomplish an URL filter implementation. I'll discuss various techniques and present example configurations.

To perform the HTTP content filtering, the first three methods classify traffic use Cisco's Modular QoS CLI feature. Where after various ways can be applied to filter out the MQC marked traffic.  

With both the Context-Based Access Control and Zone Based Firewall method the decision which URLs to filter can be made by the router itself or by a content filtering server. In this post I will only show examples of URL filtering by the router itself.

Access Control List content filter

! class-map match-any URL_BLOCK match protocol http host "example.com" ! policy-map MARK_URL class URL_BLOCK  set ip dscp 1 ! interface FastEthernet0/0 description WAN interface ip access-group 100 out ! access-list 100 deny   ip any any dscp 1 log access-list 100 permit ip any any ! interface FastEthernet0/1 description LAN interface service-policy input MARK_URL

considerations

Disable sending IP unreachable messages with the no ip unreachable interface-level command to avoid causing the router to expend excessive resources.

Does NOT inform users, that the website is blocked and why.

IOS allows only one ACL per direction, per protocol, per interface. So it may not be practical.

Class-Based Policy content filter

The Class-Based Method, requires even less configuration. It uses the policy-map to drop the marked packets - containing the website requests.

! class-map match-any URL_BLOCK match protocol http host "example.com" ! policy-map MARK_URL class URL_BLOCK  drop ! interface FastEthernet0/0 description WAN interface ! interface FastEthernet0/1 description LAN interface service-policy input MARK_URL

considerations

Disable sending IP unreachable messages with the no ip unreachable interface-level command to avoid causing the router to expend excessive resources.

Does NOT inform users, that the website is blocked and why.

Policy-Based Routing (PBR) content filter

This method, actually gives us two options, either route the to the Null interface, to just drop the website requests for the blocked URLs. Or route the websites marked by MQC, to a local web-server that is configured to reply with a standard page to inform users that their web request is blocked.

! class-map match-any URL_BLOCK match protocol http host "example.com" ! policy-map MARK_URL class URL_BLOCK  set ip dscp 1 ! access-list 100 deny   ip any any dscp 1 log access-list 100 permit ip any any ! route-map test URL_REDIRECT 10 match ip address 100 set ip next-hop 192.168.100.100 ! ! interface FastEthernet0/0 description WAN interface ip policy route-map URL_REDIRECT ! interface FastEthernet0/1 description LAN interface service-policy input MARK_URL

considerations

If the route-map forwards filtered traffic to interface Null0, disable sending IP unreachable messages with the no ip unreachable interface-level command to avoid causing the router to expend excessive resources, 

If the route-map forwards traffic to interface Null0, users are NOT informed that the website is blocked and why.

If the route-map forwards the filtered traffic to a web server, to present an information page to the users, it must be configured as a catch all server. This means that a default virtual host needs to be configured. And it requires that the destination IP address of the HTTP requests are rewritten to the IP address of the server (e.i. destination NAT).

Context-Based Access Control (CBAC) content filter

This method relies on the CBAC Deep Packet Inspection (DPI) to decide which web requests are allowed or denied. The configuration is only a couple of lines.

! ip inspect name URL_FILTER http urlfilter ip urlfilter allow-mode on ip urlfilter exclusive-domain deny example.com ip urlfilter audit-trail ! interface FastEthernet0/0 description WAN interface ! interface FastEthernet0/1 description LAN interface ip inspect URL_FILTER in

considerations

Users are informed that their website request was denied via a 'HTTP 403 - Forbidden' error page.

Only provides the ability to filter on domain names. It does NOT provide the ability to filter on other variables, like file names, or particular directories of the allowed or denied domains.

Zone Based Firewall (ZBF) content filter

With this method DPI analyses the traffic between (security) zones and the ZBF decides based on a policy map if the traffic is allowed.

! parameter-map type urlfpolicy local URL_FILTER block-page message "You do NOT have permission to view this page" ! parameter-map type urlf-glob EXAMPLE pattern example.com parameter-map type urlf-glob ALLOW pattern * ! class-map type urlfilter match-any BLOCK match  server-domain urlf-glob EXAMPLE class-map type urlfilter match-any ALLOW match  server-domain urlf-glob ALLOW ! class-map type inspect match-any HTTP match protocol http class-map type inspect match-any HTTPS match protocol https class-map type inspect match-any DNS match protocol dns ! policy-map type inspect urlfilter URL_FILTER parameter type urlfpolicy local URL_FILTER class type urlfilter BLOCK  log  reset class type urlfilter ALLOW  allow ! policy-map type inspect URLs class type inspect HTTP  inspect  service-policy urlfilter URL_FILTER class type inspect HTTPS  inspect class type inspect DNS  inspect class class-default  drop ! zone security LAN zone security WAN ! zone-pair security LAN_OUT source LAN destination WAN service-policy type inspect URLs ! interface FastEthernet0/0 description WAN interface zone-member security WAN ! interface FastEthernet0/1 description LAN interface zone-member security LAN

considerations

Users are informed that their website request was denied via a customizable error page. 

Requires complete configuration of Zone Based Firewall, for all security policies.

Conclusion

Unlike Ethernet, WiFi is by nature a half-duplex medium. The half-duplex constraint applies to devices that share a relative physical area and RF frequency. Several mechanisms within the 802.11 protocol minimize the likelihood of frame collision and define the appropriate response in the event that a collision is inferred. 

The main mechanism is Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). An asynchronous message passing mechanism, delivering best effort service without any bandwidth or latency guaranty. 

By manually directing traffic flows we can improve the performance of the wireless links, and create full-duplex (like) behavior.

The concept is to cause the traffic from one side to use link A and the traffic going the other way to use link B. If either link fails, the traffic will automatically fail-over and use the working link. In the configuration example below an implementation using OSPF, the configuration will cause traffic from the router at Building 1 to use Link A (lower cost on fa0/0). And will cause traffic from the router at Building 2 to favor Link B (lower cost on fa1/0).

Router at Building 1:

! interface FastEthernet0/0 description ### Link A ### ip ospf 1 area 0 ! interface FastEthernet1/0 description ### Link B ### ip ospf 1 area 0 ip ospf cost 100 ! router ospf 1 router-id 1.1.1.1 !

Router at Building 2:

Before we dive into the configuration first lets review the components needed to build the lab.

GNS3 is a software suite that simulates complex networks, providing an intuitive graphical user interface to design and configure virtual networks.

Virtualbox is a virtualization software package for x86 and AMD64/Intel64-based computers from Oracle Corporation. It can be integrated into the GNS3 software suite.

MiniNet is an OpenFlow testing platform consisting of a realistic virtual network, running real kernel, switch and application code, with a single command prompt.

Virtualbox / Mininet

Download Virtualbox HERE, and install (default settings are fine in most cases). Download Mininet HERE. After installing Virtualbox, and downloading Mininet.

Now create the Mininet VM in Virtualbox. To do this select NEW button from the toolbar and go through the wizard to install the Mininet VM. At step one select the name and operating system. Type is Linux and Version is Ubuntu. Click NEXT through the memory size configuration. At the Hard drive selection option, select 'Use an existing virtual hard drive file' and add the mininet vmdk file. Now click CREATE.

The Mininet VM is created. Now we need to add extra network adapters to Virtualbox. To do this open the File -> Preferences... menu item, and open the NETWORK tab. Within the NETWORK tab, select the 'Host-only Adapter' tab and click 'Add host-only network' icon, until there are at least three 'VirtualBox Host-Only Adapter's', then click OK.

Virtualbox is now configured.

GNS3

In GNS3 click Edit -> Preferences... and open the VirtualBox tab. Select the 'VirtualBox Guest' sub tab. Now select the 'Mininet' VM from the 'VM List' drop down list. Set the 'Number of NICs' to 3, and check the 'Reserve first NIC for VirtualBox NAT to host OS', the 'Enable Console Support', and the 'Enable Console Server' checkboxes. Add an 'Identifier name', I choose Mininet, click SAVE button and then click OK button.

Now we are ready the to build our first lab.

The lab

For demonstration purposes the lab will consist of two routers connected to the Mininet VM. The Mininet VM will be started in the standard configuration: one Openflow switch, one controller, and two virtual hosts.

After which I manually attached both the interfaces eth1 and eth2, to the switch s1.

Both routers are configured with in the IP range 10.0.0.0/24. The .1 and .2 are used by the two virtual hosts.

The result of a ping from R1 to R2, from the perspective of R2.

R2# *Mar  1 00:07:24.155: IP ARP: rcvd req src 10.0.0.3 c00d.2440.0000, dst 10.0.0.4 FastEthernet0/0 *Mar  1 00:07:24.155: IP ARP: sent rep src 10.0.0.4 c00e.2440.0000,                 dst 10.0.0.3 c00d.2440.0000 FastEthernet0/0 *Mar  1 00:07:24.159: IP ARP: rcvd rep src 10.0.0.3 c00d.2440.0000, dst 10.0.0.3 FastEthernet0/0 R2# *Mar  1 00:07:42.775: ICMP: echo reply sent, src 10.0.0.4, dst 10.0.0.3 *Mar  1 00:07:42.823: ICMP: echo reply sent, src 10.0.0.4, dst 10.0.0.3 *Mar  1 00:07:42.847: ICMP: echo reply sent, src 10.0.0.4, dst 10.0.0.3 *Mar  1 00:07:42.867: ICMP: echo reply sent, src 10.0.0.4, dst 10.0.0.3

*Mar  1 00:07:42.887: ICMP: echo reply sent, src 10.0.0.4, dst 10.0.0.3

Conclusion

Mininet provides a great tool to experiment with Software-defined networking (SDN), while providing an software switching platform within the GNS3 environment. Non of the routers available in the GNS3 (officially) support Openflow. Limiting the experimentation with Openflow to switching only.

References

Mininet Walkthrough

Virtualbox documentation

GNS3 documentation

In today's corporate networks the layer-2 domain is collapsed down to the access layer - at least it should be, in most cases -, and there is virtually no requirement for a contiguous layer-2 domain passed the access layer switches.

However there are corner cases where extending the layer-2 domain across a layer-3 network is a requirement. For example server visualization may require the storage network to be on the same layer-2 domain. Or when a layer-2 interconnect circuit is backed up by a cheap(er) layer-3 circuit.

I'll discuss various technologies to accomplish transparent Ethernet over an IP network and present sample configurations, for them.

In the topology we will be using for the sample configurations are two routers (i.e R1 and R2) connected back-to-back. R1 will have a loopback interface configured with the IP 1.1.1.1 and R2 will have a loopback with the IP 2.2.2.2. The physical back-to-back interfaces are configured on the 10.0.0.0/30 subnet, R1 has the IP 10.0.0.1 and R2 - how surprising - has 10.0.0.2. The routing is done through a static route, pointing to the IP address of other router's physical interface.

GRE Tunnel

Generic Routing Encapsulation (GRE) is a mechanism for encapsulating any network layer protocol over any other network layer protocol, developed by Cisco. The general specification is described in RFC 2784 (obsoletes earlier RFC 1701 and RFC 1702).

Configuration example:

R1:

! bridge irb ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 no ip address bridge-group 1 ! interface Tunnel0 no ip address tunnel source Loopback0 tunnel destination 2.2.2.2 bridge-group 1 ! interface Serial0/0 ip address 10.0.0.1 255.255.255.252 ! ip route 2.2.2.2 255.255.255.255 10.0.0.2 !

R2:

! bridge irb ! interface Loopback0 ip address 2.2.2.2 255.255.255.255 ! interface FastEthernet0/0 no ip address bridge-group 1 ! interface Tunnel0 no ip address tunnel source Loopback0 tunnel destination 1.1.1.1 bridge-group 1 ! interface Serial0/0 ip address 10.0.0.2 255.255.255.252 ! ip route 1.1.1.1 255.255.255.255 10.0.0.1 !

considerations

Supports Dot1Q, and ISL VLAN trunking, depending on the routing platform.

Integrated Routing and Bridging does NOT support transparent tunneling of CDP, STP, VTP, LLDP, PAgP, LACP, and UDLD.

The MTU of the sending device may need to be adjusted, Integrated Routing and Bridging does NOT support fragmentation.

Native support for tunneling over an IPv6 network.

More information about Generic Routing Encapsulation on the Cisco website can be found here .

DLSw+ circuit

Data-Link Switching is an almost forgotten technology, originally developed to tunnel non-routable, non-IP based protocols such as IBM Systems Network Architecture (SNA) and NetBIOS/NetBEUI across IP networks, described in RFC 1434 (updated by RFC 2166).

DLSw+ is Cisco's proprietary implementation of DLSw, with following extensions:

Choice of transport option, including TCP, FST (fast-sequenced transport), and direct encapsulation.

Scalability enhancements through: peer groups, on-demand peers, explorer firewalls, and location learning.

Media conversion between local and remote LANs and SDLC or Ethernet.

One of the more popular uses of DLSw+, was bridging Token ring networks over other media.

DLSw+ is a flexible, though dated technology that can transport of Ethernet frames across an IP network.

Configuration example:

R1:

! bridge irb ! dlsw local-peer peer-id 1.1.1.1 dlsw remote-peer 0 tcp 2.2.2.2 dlsw bridge-group 1 ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 no ip address bridge-group 1 ! interface Serial0/0 ip address 10.0.0.1 255.255.255.252 ! ip route 2.2.2.2 255.255.255.255 10.0.0.2 !

R2:

! bridge irb ! dlsw local-peer peer-id 2.2.2.2 dlsw remote-peer 0 tcp 1.1.1.1 dlsw bridge-group 1 ! interface Loopback0 ip address 2.2.2.2 255.255.255.255 ! interface FastEthernet0/0 no ip address bridge-group 1 ! interface Serial0/0 ip address 10.0.0.2 255.255.255.252 ! ip route 1.1.1.1 255.255.255.255 10.0.0.1 !

considerations

Supports Dot1Q, and ISL VLAN trunking, depending on the routing platform.

Integrated Routing and Bridging does NOT support transparent tunneling of CDP, STP, VTP, LLDP, PAgP, LACP, and UDLD.

The MTU of the sending device may need to be adjusted, Integrated Routing and Bridging does NOT support fragmentation.

NO native support for tunneling over an IPv6 network.

DLSw+ is process switched.

NO support for DLSw+, on any Cisco IOS XE, IOS RX, or NX-OS platform.

Support for DLSw+ is only available on legacy Multi-Layer Switches, for example the CAT4500, and the CAT6000.

More information about Data-Link Switching (DLSw) and Data-Link Switching Plus (DLSw+) on the Cisco website can be found here.

L2TP Tunnel

Layer-2 Tunneling Protocol, described in RFC 2661, is based on primarily two older tunneling protocols for Point-to-Point communication: Cisco's Layer 2 Forwarding Protocol (L2F) and USRobotics Point-to-Point Tunneling Protocol (PPTP). The original L2TP implementation uses UDP for transport. The newer L2TP version 3, described in RFC 3931 (updated by RFC 5641), uses IP as transport - just like GRE -, that can be implemented on any IP-aware network. L2TPv3 has two 'modes' point-to-point and point-to-multipoint. We will be focusing exclusively on L2TPv3 point-to-point mode tunneling.

Configuration example:

R1:

! pseudowire-class TEST encapsulation l2tpv3 ip local interface Loopback0 ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 no ip address no cdp enable xconnect 2.2.2.2 1 encapsulation l2tpv3 pw-class TEST ! interface Serial0/0 ip address 10.0.0.1 255.255.255.252 ! ip route 2.2.2.2 255.255.255.255 10.0.0.2 !

R2:

! pseudowire-class TEST encapsulation l2tpv3 ip local interface Loopback0 ! interface Loopback0 ip address 2.2.2.2 255.255.255.255 ! interface FastEthernet0/0 no ip address no cdp enable xconnect 1.1.1.1 1 encapsulation l2tpv3 pw-class TEST ! interface Serial0/0 ip address 10.0.0.2 255.255.255.252 ! ip route 1.1.1.1 255.255.255.255 10.0.0.1 !

considerations

Cisco Express Forwarding must be enabled. The xconnect configuration mode is inaccessible until CEF is enabled.

Native support for tunneling over an IPv6 network.

The MTU of the sending device may need to be adjusted, to prevent fragmentation. The ingress router receives an Ethernet frame and encapsulates the packet by removing the preamble, the start of frame delimiter (SFD), and the frame check sequence (FCS), inserts the frame into a L2TPv3 packet and transmits the packet to its peer.

You may need to configure the l2protocol-tunnel command to enable or disable tunneling of Layer 2 protocols (e.i. CDP, STP, VTP, LLDP, PAgP, LACP, and UDLD) depending on the platform. In my test environment (GNS3, c3725, IOS 124-15.T8) CDP was tunneled transparently.

More information about Layer Two Tunnel Protocol (L2TP) on the Cisco website can be found here.

EoMPLS over GRE Tunnel

Ethernet over Multi Protocol Label Switching is a mechanism to encapsulate and transport Ethernet Protocol Data Units (PDUs) over an MPLS network, and is described in RFC 4448 (updated by RFC 5462). Basically a frame is received on a switch, MPLS labels the frame, transportes it via MPLS labels over an IP routed network, and the receiving switch removes the MPLS label, and switches the frame out the appropriate port(s).

EoMPLS is the most common method Internet Service Providers use to implement Virtual Private Wire Service (VPWS) and Virtual Private LAN Service (VPLS), on their networks.

MPLS requires every hop in the path to be an MPLS router. Here is where the GRE Tunnel comes in to play. We will use GRE to tunnel the MPLS traffic, end-to-end.

Configuration example:

R1:

! ip cef ! mpls ip ! interface Tunnel0 ip address 172.16.1.1 255.255.255.252 mpls ip tunnel source Serial1/0 tunnel destination 192.168.100.4 ! interface FastEthernet0/0 no ip address no cdp enable xconnect 172.16.1.2 1 encapsulation mpls ! interface Serial1/0 ip address 192.168.100.1 255.255.255.0 ! mpls ldp router-id Tunnel0 force !

R2:

! ip cef ! mpls ip ! interface Tunnel0 ip address 172.16.1.2 255.255.255.252 mpls ip tunnel source Serial1/0 tunnel destination 192.168.100.1 ! interface FastEthernet0/0 no ip address no cdp enable xconnect 172.16.1.1 1 encapsulation mpls ! interface Serial1/0 ip address 192.168.100.4 255.255.255.0 ! mpls ldp router-id Tunnel0 force         !

NOTE: In the configuration above I used the 172.16.1.0/30 IP address range on the tunnel interface. Also the Tunnel interface on the platform used defaults to tunnel mode gre ip.

considerations

Cisco Express Forwarding must be enabled. The xconnect configuration mode is inaccessible until CEF is enabled.

Native support for tunneling over an IPv6 network.

The MTU of the sending device may need to be adjusted, to prevent fragmentation. The ingress router receives an Ethernet frame and encapsulates the packet by removing the preamble, the start of frame delimiter (SFD), and the frame check sequence (FCS), inserts the frame into a MPLS packet and transmits the packet to its peer.

You may need to configure the l2protocol-tunnel command to enable or disable tunneling of Layer 2 protocols (e.i. CDP, STP, VTP, LLDP, PAgP, LACP, and UDLD) depending on the platform. In my test environment (GNS3, c7200, IOS 150-1.M) CDP was tunneled transparently.

More information about Multi Protocol Label Switching (MPLS) on the Cisco website can be found here.

Conclusion

Both the 'vanilla' GRE Tunnel and the DLSw+ circuit use the Integrated Routing and Bridging feature to span the Ethernet across the layer-3 network. And therefore these two methods carry the same limitations as a single router bridging two layer-2 domains, using the IRB feature. You can either bridge a normal Ethernet connection, a single VLAN or a Trunk, per bridge group. Since the router is not a switch it does not support DTP or VTP, nor will it transparently carry those and other layer-2 protocols (e.g. CDP, STP) - since the router is a layer-2 hop, just like a switch.

For more information about Integrated Routing and Bridging (IRB) see the Cisco website here.

As mentioned earlier DLSw+ in not supported on any of the Cisco IOS XE, IOS RX, or NX-OS platforms. Also the protocol is process switched which may require extensive tuning, you can find an excellent post about tuning DLSw performance here, on the Packetpushers website.