Performance and Flexibility Trade-offs
This almost sounds too good to be true. Clearly, if hub-era technology were that good, there would have been no point to changing it – the whole industry cannot have been misguided.
Besides, it’s not like Ethernet networking equipment is a dying business. It forms the bulk of the revenue for established companies like Cisco, Juniper or Arista. Clearly, they couldn’t subsist on snake oil.
We weren’t misguided, and Cisco isn’t selling snake oil. PONs derive their better cost of ownership and reliability numbers from simplicity.
But this simplicity comes at the price of flexibility.
Traditional campus networks deal well with every kind of traffic (and, with minimal effort, can be adapted to situations where east-west traffic is abundant). Dealing with this kind of flexibility requires complex equipment, but it can cover all traffic profiles.
PONs cannot efficiently deal with any kind of traffic. They do happen to deal well with the type of traffic that campus and building networks are moving towards.
Historically, they only dealt well with FTTx traffic – but as companies in the UK and everywhere are moving towards cloud-driven working models, this traffic profile is becoming increasingly prevalent beyond the premises’ borders.
How Secure Are PONs?
You may have already noticed an interesting problem, which we alluded to, but never discussed in detail so far. Without the distribution-tier switches, all switching is done at the core tier.
But then the OLT broadcasts data to all equipment downstream – so, in effect, all clients get each other’s data. This can’t be good for security, can it?
That’s why, for security-critical applications, data can be encrypted at the ONT. In effect, this makes each link somewhat like a VPN to the core switch. The encryption technology is of the same type and calibre as in commercial-grade VPNs, it’s just that the network isn’t exactly virtual.
In some types of networks, it is enough if downstream traffic is encrypted, which is what GPON does. These are campus networks where ONTs bridge entire, self-contained networks to the core network (or the OLT has native support for network segregation).
It is hard to scale this type of network, but it may be a good trade-off under some circumstances, especially when legacy equipment is involved.
In other cases, both upstream and downstream traffic need to be encrypted. EPON natively supports this mode of operation, which also has the advantage that a malicious actor who intercepts traffic at the OLT cannot read any communication.
The introduction to this section makes it sound like PON security is somewhat of a trade-off, too, but that’s not the case. PONs can be a significantly more secure solution than other networking technologies.
Fibre optic cables do not leak radio or electrical signals like copper cables do and are harder to splice intrusively. Furthermore, the security model of ONTs was designed from the very beginning with the assumption that other ONTs on the network may be controlled by malicious users.
It would be too bold and too general a statement to say that the security model of PONs is superior to that of Ethernet networks. However, it has fewer edge cases to cover, and – assuming the hardware encryption at the ONTs isn’t broken – it is easier to implement a secure communication model over PON than over Ethernet, at least at the most basic level of the network stack.