up vote 0 down vote favorite
share [g+] share [fb]

I work in a small satellite office of a large corporation. They would like to change our routing structure so all our internet data bounces off their main NOC. They say this is to prevent intrusions and to monitor our traffic. My office would rather not have our traffic monitored and possibly have our performance degraded by bouncing all packets off a building 1000 miles away.

What are the reasons I can present to the higher ups as to why we shouldn't allow this change? I suspect performance is one reason, but I would to hear more if they exist.

link|improve this question
feedback

closed as off topic by ErikA, Scott Pack, Shane Madden, Iain♦, Holocryptic Aug 19 '11 at 20:54

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

2 Answers

up vote 9 down vote

I appreciate that you don't want your traffic monitored, but unless you're on the netadmin team for your company I'm afraid the answer here is "tough noogies". It's not a great policy, but it's a reasonable one and a viable alternative to setting up traffic monitoring at every satellite office.

While you may expect a marginal performance decrease from the extra hop through the central hub 1000 miles is a speed-of-light distance of just under 6ms so any added latency is negligible, and as long as your main office is capable of handling the traffic (sufficient bandwidth, well-designed/well-configured core) I doubt you'll have a noticeable reduction in bandwidth/speed.
To bolster that case, I know of one company that has a 3000-mile circuit over a dedicated link and has no substantial speed problems at the satellite office.

link|improve this answer
1  
We add about 40ms round-trip on our network to back-haul remote office traffic about 1500 miles on average. Generally, we setup dedicated Internet egress if the site's bandwidth requirements to the Internet exceed 10Mbits/sec or so sustained. We back-haul to a data center if it's less than that to save money. Such is life. – JakePaulus Aug 19 '11 at 15:32
40ms might be pushing my limit if VOIP is involved (that starts to be an obvious delay), but for general internet traffic "any reasonable ping time" is typically fine :) – voretaq7♦ Aug 19 '11 at 15:34
In my experience, 40ms for VoIP (SIP in this case) is actually ok, as long as it's consistently 40ms. It's when latency starts jumping all over the place that issues pop up. – ErikA Aug 19 '11 at 15:37
I disagree. Cisco says latency can be as high as 150ms one-way without a problem. The key is keep jitter under 30ms one-way. The first impact I see from high latency (but otherwise good network) is CIFS traffic throughput degradation. This won't be an issue for Internet traffic though. – JakePaulus Aug 19 '11 at 15:38
VoIP has consistently been a problem for us. After 5 months of problems, we finally have them working. Would it be fair to say that changing around the SIP routing is likely to induce new bugs? – Jakers Aug 19 '11 at 15:40
show 3 more comments
feedback
up vote 9 down vote

My office would rather not have our traffic monitored

Wow. Just wow. This is not your home network we're discussing. It's your employer's network, and while on it your primary task is to do whatever it is you were hired for. Your employer has every right to monitor what is going on on their network. If you're concerned about that, perhaps you need to re-evaluate your usage of their network.

The only way you're going to win this argument is if you can convince your leadership that there is a compelling business reason to egress your internet traffic locally. Yes, it's going to take a bit longer to pull up facebook, but that's not going to help you build your case.

Honestly, maintaining a single (or very small number of) egress point for internet traffic is something that nearly all medium to large size companies do, and for good reason.

link|improve this answer
2  
+1 - most likely it will take FOREVER to pull up Facebook - but on the bright side a compelling business case can be made for access to ServerFault, StackOverflow and a few other SE sites. – voretaq7♦ Aug 19 '11 at 15:32
1  
Well, Facebook takes forever to pull up regardless of whether or not you have a fatty Internet pipe or not. – Holocryptic Aug 19 '11 at 15:34
@voretaq7 Thanks, that's a great example. My office is full of developers while the rest of company is not, programmers might need access to some sites that could be considered questionable. – Jakers Aug 19 '11 at 15:42
1  
@Jakers - then they should be able to petition the network team to whitelist those sites. – ErikA Aug 19 '11 at 15:49
2  
@Jakers monitoring your traffic is very unlikely to mean that they'll be actively looking at what you're up to. They're more likely to be routing you through something that checks for malware and malicious sites, etc. Traffic logs are not something anyone wants to read through. This is something you'll find it hard to argue against. Also remember that if you already have a network connection back to the main office then they're most likely already monitoring all sorts of other things about your PCs and files anyway. – GAThrawn Aug 19 '11 at 16:02
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.