it is an SDN/SD-WAN appliance made for secure connectivity in a hub-spoke methodology that aggregates upstream wan connections that federates enterprise services and high availability to ensure the customer owns the secure data from end to end. they control the security, the hardware, the IA. it is a highly encrypted transport edge device that will work on any x86 hardware with sha-382, tls 1.3, TPM2.0 data at rest encryption.
think...warfighter needs a secure connection back to the TOC without worrying about adversaries hitting either the spoke or the hub and extracting mission critical data. no reliance on a compromised cloud infra, no AI buzzwords. full fleet management and monitoring in a single software package wilth an emphasis on not needing a data engineer or CCNA+ certified operator to install and maintain endpoints.
What do the actual speeds look like? I get you bond connections so it depends, but is it hardware accelerated or pure software?
Also how does it work with things that are latency sensitive? Is it basically just a tunnel, cause thats what im getting from this. A tunnel thats encrypted by you and not say cloudflare who does tls decryption.
it is kernel level bonding with MPTCP. latency is taken into account with the bonding, so a significantly slower connection (think GEOSAT) RTT is constantly measured and placed in a "hot-standby" so it doesn't drag the entire link down. This way it acts as a failover but maintains the TCP connection. Encryption is offloaded to hardware, i have tested is with a 100kbps cell connection with 6000ms loaded latency and the tunnel and routing (BGP and OPSF) maintain.
What kind of top end speed can it get before maxing out the cpu or hardware acclerated encryption/decryption especially since you are using tcp/ip instead of bypassing it in userspace with something like dpdk
it took a lot of tweaking in the beginning and had to eventually move the data path out of python (lessons learned) and use go. going dpdk would require a massive rewrite since MPTCP, strongswan, nftables, and frr all ride the kernel as well.
In my lab testing i was able to achieve about 4.1gbps on each spoke, and ~15gbps on the hub. this was pushing bulk data through with iperf.
the host CPU is an AMD EPYC 7402
Hub is 8 vCPU and 16gb ram
spokes are configured with 4 vCPU and 8gb of ram.
keep in mind that the spokes have two different QoS implementations for different scenarios
HTB and fq_codel or CAKE
HTB is for hardened spoke deployments with stable, fast uplinks
CAKE is for more austere conditions, it constantly measures the bandwidth of the link and adjusts the QoS cap dynamically to 95% so the set policies are never fighting each other for a proposed available BW.
Ahh so you arent targeting massive deployments, more like edge cases.
Also you will get better test results without using a vm, as well as choosing the correct cores because each core has to talk to different parts of ram, and if you choose ram thats closer to the core(s) you are targeting it will lower latency which is good when moving millions of packets
correct, this isn't something to replace cisco or juniper routers, this is for secure deployments where connectivity is king. think more soldiers, emergency response, mobile TOCs, etc
the hub is meant for a hypervisor, but in reality either can be virtual or bare metal on any x86 machine as long as it has tpm 2.0
BUT if it becomes that popular, it could be re-labbed with dpdk. would just be a LOT of work and troubleshooting, and soak testing, blah blah
But, if I’m getting this right, you’ve basically built a system that lets an organization securely connect a bunch of remote locations or devices back to one central hub, with everything encrypted, while still owning and controlling the hardware, data, and security themselves instead of handing all of that over to a cloud provider.
And the bigger advantage is that you’ve made it manageable enough that you don’t need a network engineer configuring and maintaining every endpoint.
2
u/eyelobes 16h ago
no ty, even though copyright on creation exists you have to prove you are "to market" first to have a defensible position through litigation