CISCO & FireBrick?

As ever this is very much my personal opinion... I hope it makes sense.

I used to be somewhat in awe of the likes of CISCO. After all they made these big routers and profession kit that everyone uses. When we started making FireBrick routers I felt a bit like we were sort of a Mickey Mouse company by comparison. Just a few developers working on hardware and software, and doing it from scratch, following RFCs, even making an operating system from scratch.

But oddly, over time, that view has changed both ways. I am actually feeling that what we make is very much "proper" in so many ways. We are out there, and A&A run an ISP on largely FireBrick kit. Many small ISPs use the same kit, and loads of end users make use of FireBrick firewalls. It works. But of late we have some CISCO switches in the A&A network. I sort of swore I would never use anything but FireBrick, but we have not got 10Gb/s FireBrick switches yet, so we had to get them. I wish we had FireBrick 10Gb/s switches to be honest :-)

They are actually pretty good. I will say one thing for CISCO, they can make some impressive hardware. Some fast switches and fast ASICs in their routers. We are not a patch on that. Our hardware is fast but is designed to do software routing very fast. So we are there at a few Gb/s, and CISCO are there with boxes that do way way more. We're getting there - the 10Gb/s+ box is on the drawing board, obviously. But we will never manage anything like CISCO's top end, well, probably not. We can hope.

But using CISCO kit has been a challenge. It has quirks and bugs and things that will drive you mad. I never realised this until we started using it. We have seen error cases, in one case a significant A&A outage, that seems largely attributable to the switches playing up in odd ways. CISCO TAC (the support side) is expensive, but a necessary cost with CISCO kit.

I do not see our hardware equalling CISCOs top end, as they have very fast kit, but I see our hardware working well at the level it is designed to work.

Do I see CISCO software on a similar level? Well, I am beginning to think so in some ways. CISCO have way more software, and way more things they do in their kit. We have focused on what we need for the products and added lots of features, but nothing like the features CISCO have. The down side is that CISCO have loads of old and legacy code and protocols to maintain. We have less code, and newer code to maintain. So this makes things a tad more equal in terms of things that can go wrong.

We are looking at a quirk in the CISCO switches today, and will be tomorrow. An odd L2 or L3 routing issue. It should not happen, and will be a lot of head scratching and may involve calling TAC. I am sure it will be resolved, but it is a good example of the sort of problems one can have. If we had the same problem on FireBrick kit we would know a lot more, but that stands to reason. We are not without issues, obviously, but I would not say we have more than CISCO.

So with all of this I was rather interested in the views of a potential customer recently, which sort of fits with how I now feel about companies like CISCO, and comparing to FireBrick.

Firstly the customer was keen to use FireBrick as he needed IPv6 that works properly. Now, I have not tried any CISCO kit with IPv6 - we are using switches at present with a small amount of IPv4 BGP to carriers, and that is it. But the view is that FireBrick have been doing IPv6 for like a decade. Our current code base was designed with IPv6 from scratch. IPv6 is in serious use in A&A using FireBrick kit. One advantage of not having all that legacy code. So actually we were seen as more "mature" in handling IPv6, which is good news. Score one for FireBrick.

Secondly, for the scale of operation the customer needs, we can do the job with the 2Gb/s capable FB6000 series, but we are more expensive than a CISCO box that can do the same. There is not quite the same second hand and used market for FireBrick as with CISCO (yet). But that is until you factor in TAC. The support for CISCO is not cheap, and suddenly we came out on top on price when considering only a few years of support. Just our policy on free s/w updates is a huge win. So score again for FireBrick.

So here I am, well down the line in terms of FireBrick as a product and a company, many years of work (almost two decades), and I realise that we are a "contender". Our code and our hardware is far from Mickey Mouse, and even the big players have their off days and their issues. I realise that we have a really good product, and it seems from the enquiries and recent sales that customers are seeing this too.

We are still going, and the new FB2900 product is due out real soon now (boards exist, EMC testing passed, stuff on order, even rack mount kits!). We are starting on the new FB9000, with is a 10Gb/s+ ISP grade router and LNS. The future is looking bright.

P.S. Sitting down with print outs of CISCO configs and marker pens, and half an hour later we found the smoking gun - actually a config error on our part. Very odd config attributed to someone that does not work for us now, but we all have a much clearer understanding of how it works now, and the problem we were chasing is fixed and not a CISCO bug - phew.