Why is the design "intelligence on the edge" better for a computer network?

Question

I have always been told during my network education that the Internet (and any computer network) is and should be designed so that the intelligence is not located on the core of the network. The core should only have the "dumb" objective to only deliver the data. That means no big firewall on the center, no content-serving, etc.

While I completely agree with this design, I'm looking at the "why?". Why is this the best design? Is there some kind of literature (RFC, etc.) about that ? I'm looking for rational arguments in favor of this design.

Answer 1

While I completely agree with this design, I'm looking at the "why?". Why is this the best design?

Think about it in simple practical terms. What kinds of intelligence are we talking about? Two concrete examples that often come quickly to mind would be the processing of ACLs (or the like) and QoS.

Now consider what happens if you place this intelligence at the core. Data will have to be carried over "some number" of links and devices before it reaches the core to be processed.

In the case of traffic that would be dropped by ACL, this traffic is now carried further into the network and takes up resources (whether these are bandwidth, CPU cycles, memory, or anything else) that may be needed by other legitimate traffic.

In the case of QoS, unless you trust end devices to properly mark traffic (bad idea), traffic would have to travel some distance unmarked until it reaches the core. If there is link congestion on the way to the core, any priority traffic will be treated the same as your best effort traffic.

It doesn't take a RFC or standard to see it is better to do this type of processing as close to the edge as possible.

Answer 2

The Core layer is responsible for fast transportation across a network. The more intelligent routing you try and perform there the more you slow down the rate of packet flow. You don't want to have a WAN Router also be doing VLAN routing, if you don't have to. You want it receive traffic not bound for the LAN and send it out over the internet or MPLS network. If you had the Core layer do the routing, you'd essentially have all L3 traffic hit it first and be sent back in to the LAN. This is inefficient and causes load on the router that could easily be handled by a layer 3 switch.

The distribution layer, however, is where intelligent routing should occur. If I have a group of access switches, each accessing different VLANs, do I want that traffic to have to cross both a distribution switch and then hit a sub interface on the WAN router? No. Shortest, quickest path is from the Host to the Access Switch to the Distribution switch and then to whatever the traffic is bound on the LAN. Additional Reading

Not to throw a wrench in the above, but Collapsed Core configurations are becoming more and more common. In a collapsed core configuration, you combine both the Distribution layer and the Core layer into one. You will see this in small enterprises. Your WAN router is still a different device, but instead of having a "dumb" core, you have a core that runs EIGRP, and learns and shares the networks it "knows". Additional Reading

Answer 3

The 'Intelligence at the Edge' design is misleading in light of where the computer networking industry has evolved, and is evolving, to - SDN fashioned architectures where the intelligence is now centralized ¹ in the controllers. In a cloud networking, or SDN fashioned architecture, you find 'intelligent' controllers and separation of control and data planes.

The original idea behind 'Intelligence at the Edge' was that required deep packet inspection / manipulation would not be practical at the core where gazillions of pps are processed/forwarded.

Deep packet inspection/modification still occurs at the edge but the decision on what to inspect and what to do with the packets is made and pushed out to the edge from network 'controllers'.

¹ centralized controllers are likely physically distributed across data centers or physical locations for redundancy purposes.

Answer 4

You certainly can ask 10 people and get 10 different answers. Mainframe salesmen aside, you will probably find a majority who will favor something between balanced and fully distributed.

A defense of distributed processing

The key advantage that moving the processing away from the core creates is a more peer-oriented topology where outages do not affect entire services. If you put your firewalls at the edge of your network, and you have 5 peering points, then you have (ideally) 5 redundant points so losing one of them does not affect more than a small portion of your services, and ideally they are laid out so that a failure in one cause the others to automatically take over the traffic. In addition this scales gracefully because if you need to expand from 5 to 6 peering points, you will likely only need to invest in one small piece of equipment, vs outgrowing a single core device and having to scrap it in favor of one that offers a little more capacity. When dealing with intelligent devices, scale capability is often all-or-nothing.