Cisco Network Engineer

CCIE Flyer Reader Exclusive Soup-To-Nuts for FREE! Why Pay More?

2009-10-08T13:22:00.001-03:00

The journey to become a CCIE is an expensive one and in my everyday interactions I always look out for bargains. Recently Micronics, Voice Boot Camp, Global Knowledge and SkylineATS all reduced rates or agreed to for their CCIE boot camps. I thought I had really done something for future CCIEs with those announcements. The ads for training companies in the CCIE Flyer for September made history as well. Come on, have you ever seen those training companies all advertised on the same page before?

Well now the CCIE Flyer has really done it. We are offering Narbik’s Soup-To-Nuts workbook for FREE in the October issue of the CCIE Flyer . Yes you can get the hottest deal on one of the industry’s best workbooks to use as a guide book for your journey to become a CCIE from the CCIE Flyer . So for all you who have been visiting the CCIE Flyer this is our way of saying thanks!

How can you go wrong with free?

How to order? Go to the CCIE Flyer www.ccieflyer.com October issue out around the 17^th and see.

Webinar: Official Update – CCIE R&S

2009-10-06T16:25:00.001-03:00

I´ve just attended the live Webinar with Brad Ellis (CCBOOTCAMP), Maurilio Gorito (Cisco) and many others, and some key points were discussed in there:

Open-Ended Questions:

No news here, just a heads-up, they´re looking for straight answers, few words, sometimes only one word to answer the question. Non english speakers (like me) can relax, they´re not looking at specific words or sentences, they´ll check each and every answer and grade it manually;

Troubleshooting Section:

- Troubleshooting section will be in a “virtual” enviroment (like Dynamips) not on real equipment;

- No switches, only routers, so any Layer 2 tickets will be related to WAN issues (Frame-Relay, PPP, etc);

- The number of Routers in the troubleshooting section can range all the way from 20 to 36, 37 routers, but, not all of them will be involved in the same ticket. They need this “high” number of equipments to keep one ticket independent from the other;

- The virtual enviroment will work just as if they are real equipments, all comands available (also show and debug) so don´t freak out, just think it as Cisco Official Dynamips enviroment! ;)

New topics on the V4 Blueprint:

Any topic just added to the V4 Blueprint will be non-core, you can even take a V4 CCIE R&S Exam and don´t have any MPLS tasks, those will be really basic (according to Maurilio).

Also, keep in mind that this event was recorded (sorry, I don´t have the link here, I´ll try to look out for it and post it back) so you can watch and see all the news yourself.

Keep you posted of any other news I have!

Cheers

Slowly coming back – So, what´s up!?

2009-09-27T19:14:00.001-03:00

After some personal issues, I´m slowly coming back to my normal routine of work, study, work, study, over and over again!

So, what changed so far in the CCIE World, in my preparation, in anything else regarding my studies?!

CCIE is now reaching version 4.0, with some news, good for some of us, bad for the others, anyway… Vendors are updating their products ASAP, and some of us finally discovered the small letters in the called “Investment Protection Program”, is it fair?! In my opinion it is, but for sure, if that was really explicit when I made my choice, I would NEVER (and let me say again NEVER) get it. It looks like the “Fantastic” workbook that expires after 12 months!

Their products are AWESOME, a “must have” but when I signed for it, I wanted to be updated to any changes for the CCIE, that´s why I bought an End-to-End solution, but, again… It´s fair, they´re spending time and efforts updating the materials, but please… be a bit more specific when describing the “Investment Protection” policy, stating that the “Products” inside the “End-to-End” program are protected and not the program itself… (and please, do not ask me which vendor it was, I can tell you which vendor it wasn´t if you ask me). Again, the products are great, but the self-called “investment protection” program wasn´t very clear. It´s fair to charge in my opinion, if that was explicit explained in the website… (Old stuff, but I still mad with it).

Internetwork Expert is updating their Volume I Workbook, they´ve also released the Volume IV (Troubleshooting) workbook, with just a few labs, but those look great!

Also, anyone checked IPExpert Volume I after the updates?! Very nice! I´m working on it right now, expect some reviews soon!

One thing that made me really happy was to see Joe Astorino joining IPExpert! He´s the man! An example to be followed! Few months of hard study and dedication, he got his digits and “upgraded” his career forever in my opinion! CONGRATULATIONS buddy! :)

It seens Narbik is also out with his new Workbook, another friend of mine (Nickelby Thane) is very excited with that! I may join him if I make up my mind and actually get Narbik´s workbook (it looks I´m going for it and with the new Cisco Press CCIE Certification Guide 4.0 those will be the last thing I´ll buy for my CCIE Preparation).

One thing I will try to do, I´ll keep most of my time on the Workbooks and Books, and less time on Videos, CoDs. Those are really nice, and I´ll use it as a reference, when I have some difficults, but not as my primary resource. I plan to study each topic, each protocol like this:

- Read about it (OSPF for example) in any Book (like Doyle);

- Watch the Video-on-Demand and listen to the MP3 files for the topic in question;

- Do the Volume I labs regarding this specific technology;

I think this is a good aproach, not all the time reading, not all the time on the workbooks and not all the time on the videos, just learning each topic at a time, with reading and hands-on.

Anyway! I´ll keep you posted of my progress, and also publish any reviews, tips and advices while I´m doing that! Just give me a couple days to organize everything!

Talk to you soon!

Cheers!

A CCIE Widow’s Request

2009-09-27T18:42:00.001-03:00

CCIE # 5804 was one of the very few CCIEs in Alaska. I met him at Networkers in 2008 the month before his death. I did not find out about his passing until March of 2009 when a friend and co-worker sent me a message about him after seeing his picture on my blog. I had exchanged emails with him prior to Cisco Live 2008 so when we met I was pleased to make the acquaintance of one of only 4 CCIEs in Alaska that I knew of. After Cisco shut down the NASCAR Grille CCIE party, I hosted a bunch of CCIEs at the Hard Rock Café near there at Universal Studios Orlando. The band Modest Mouse was just finishing their last set for the night and we had a few beers together along with seven or eight other CCIEs. The other guys were from Holland, Texas and a few other places. But Dave and I talked a lot that evening and I am happy now, looking back that I had that chance.

At the end of August 2009 I received this email from Lee Gahm, Dave’s wife;

Dear Eman,
My name is Lee, I am Dave's wife. Tonight I spoke with his parents and they told me about what you had written and I looked it up. I just wanted to say thank you for taking the time to share your kind words about Dave. The proudest day in his life was when he passed his CCIE test. Actually we were all very proud. Dave LOVED his job and by what I could tell he was very good at it. I miss the middle of the night calls from his work..I never understood a single word he said but I was always impressed. His trips to those conventions were always important to him. He was proud to be a "techno geek". He was looking forward to the next CCIE gathering as he was going to speak.
I am not ready yet but I will be putting together a memory book for Abby. I would be grateful if you and some of the others would share some of your memories or stories about Dave with me. If you have any other pictures too, I would love to have them. I know his parents would like to see them also.
He truly was doing something that he loved. I was so fortunate to speak to him the night before and could hear the happiness in his voice.
Sincerely,
Lee

So I am posting this so that anyone who knew CCIE # 5804, Dave Gahm will share in photos or in writing their experiences with Dave. CCIEs have a way of influencing others across borders so I am happy to help Mrs. Gahm and Dave’s parents in gathering what I can through this medium Dave loved so much.

If you have anything you would like to share about Dave Gahm please respond to eman@ccieflyer.com

Thanks

How about a CCIE R&S Bootcamp in Sao Paulo, Brazil ?!

2009-06-27T11:58:00.001-03:00

A good friend of mine just finished a CCIE Voice Bootcamp here in Sao Paulo, Brazil… This Bootcamp was conducted by the guys from CCBootcamp…

Well… I know CCIE Voice is not the most “famous” track… not even in a near future, I don´t see Voice beating up the CCIE R&S and that´s a fact… Just check how many R&S guys are getting their digits and how many Voice guys…

Oh yeah! I´m not saying that CCIE R&S is better or worse than CCIE Voice, not at all! I´m just saying that Voice is not so “famous” as the R&S track! ;)

Anyway… His class was full of engineers from all around Latin America, and the class was conducted in english… Everyone was happy and the price was fair!

Travelling costs are also cheaper for a travel to Brazil (if you´re in Latin America) than to go all the way to US (hotels are too expensive over there).

So my question is: WHY NOT A “DECENT” CCIE R&S BOOTCAMP in Sao Paulo, Brazil ?!

You can ask me… Why do I say “decent” ?! I say that because we do have some offerings down here that DO NOT ATTRACT me at all… I don´t know a single guy who attended one of those local bootcamps and passed the CCIE R&S Lab Exam in less than two attempts!

Anyone around here would be interested in a CCIE R&S Bootcamp here in Sao Paulo, Brazil ?! Maybe if we have a good number of students one of the vendors would be interested in come down…

I just know one thing… If it was possible to have a full class for the CCIE Voice, it´s possible to have a full class for CCIE R&S! That´s for sure!

Leave me your comments and thoughts!

Anyone ?! :)

Two new Cisco books on their way to my HOME! :)

2009-06-27T11:31:00.001-03:00

Just got two Cisco Press books, can´t wait to put my hands on those!

Everytime that I get something online, I look like a child in Christmas eve waiting for Santa to arrive! lol!

This time I got:

Cisco Express Forwarding (ISBN: 9781587056109)

and

Cisco LAN Switching Configuration Handbook, 2nd Edition
(ISBN: 9781587056109)

Many of you already have those books, many not… In my case, I was waiting for a while to buy the CEF book, and what a perfect time get it now that the new Lan Switching Handbook was realeased!

As soon as those arrives (it seens CEF is delayed, but Lan Switching Handbook is already on it´s way to my home) I´ll put a little review here! Just hang in there and wait with me! :) lol!

Cheers!

THE BEST OF THE BEST (Narbik on Steroids!) by Eman Conde – CCIE Agent™

2009-06-26T08:49:00.001-03:00

I just read through this wonderful interview from Mr. Eman Conde (the world famous CCIE Agent™ and owner of the CCIE Flyer) with the “amazing” mr. Narbik Kocharians (Micronics Training).

It´s a very interesting interview, it goes all the way from Workbooks, Bootcamps to Cisco 360 Program, just check it out:

---------------

The whole world is going nuts and the best way to distinguish yourself from the herd during this crazy time is by raising the bar on your own accomplishments every day. I do it and it keeps me fresh and in demand as the CCIE Agent™. Those around me that I associate professionally with do it too, like M and Jack Taylor my team. We hustle every day and try to take care of our network of clients and CCIEs as we navigate the muck and mire.

Training material for CCIEs is another area of distinction for some authors. I have personally seen some very good ones out there and distinguishing themselves becomes difficult for some of the authors. CCIE training material is written and published all the time by various sources and authors. I have heard of some plagiarized products out there from several of my network members. I speak with one author regularly, Narbik who recently called while I was in Jamaica (did you know only one CCIE lives in Jamaica?) talking to him about his new 2.0 Boot Camp. I get excited about CCIE stuff so I was excited to help spread the word about this news.

So when I landed back in the states I called Narbik back and asked him to answer a few questions about his latest work and activities on behalf of CCIEs around the world. What follows is my best effort to capture that call.

Q: Narbik why do I go on vacation to get away from work just to end up taking your calls? Is it the love of what we do or are we both nuts?

A: Eman I think we are both nuts driven by a passion that is based upon our love of helping others. What we do is not all for money we both spend so much time helping others and we are lucky we get paid for what we do and love. Vacation is for people who are stressed out every day and need a break. We are kindred spirits in that way and we don’t need a relief from stress, just more time with family that is less interrupted! I know you took my call because it was me. How many calls did you not take?

Q: Narbik I am asking the questions here. Yes I took your call because it was you but I also took a few others. I actually added two new clients while on vacation since they called out of the blue and rekindled an old relationship with another channel partner. The call from Dubai was a good one since some of my CCIE network will have a chance there to get submitted for new roles. But in all I did avoid a few callers and M was instrumental in keeping everyone happy for me.

Tell me what’s new with you? I know you have been working on new training materials and had a few calls with Cisco lately.

A: As of Aug, who ever attends my book camp, they will get “THE BEST OF THE BEST” the reason I call it the best of the best is because the students get my ALL NEW 2.0 boot camp which is by far the best, and they also get another best which is Cisco’s CCIE training called “The 360 program”.

Q: Whoa! You are now offering the 360⁰ Learning Program?

A: Only select Cisco Learning Partners are invited to deliver the Cisco 360 Learning Program, and I am proud to be a company that is recognized by Cisco. BTW, I am also a Master instructor.

Q: How did you come to the conclusion that combining your efforts with Cisco was a good idea?

A: I have been thinking about this for the longest time and I had to come up with a program that best serves MY students, a program that provides a passing rate of 80 percent, and I mean that, therefore, I wrote the all new foundation called “Foundation 2.0”, “Advanced CCIE R&S 2.0” and “The ALL NEW Boot Camp 2.0”. We are also coming up with an “Advanced Troubleshooting 2.0” which is 10 rigorous Mock labs, basically you load the initial configuration file and start going from task to task and resolve one problem after another, you see I never cared for 8 hour mock labs, NEVER, but this is very interesting and actually teaches the students to troubleshoot one task after another, and let me tell you, they are pretty tough, as a matter of fact very tough BUT RELEVENT.

Q: With all this did you feel you would be diluting your offerings?

A: The last thing that I wanted to add to this program was another program, and who better than CISCO or I should say who better than Bruce and Val’s program.

Q: Do you think this separates you from your competitors?

A: I don’t have to brag about our boot camps, but if you thought the old boot camp was great, you have not seen anything yet. Come and see the difference in philosophy. This program is what I had BUT on Steroids. I honestly believe that this is by far the BEST of the BEST.

Q: Ok. You are getting all worked up again and I can’t keep up. Give me a real run down.

A: Some of the new offerings are as follows:

Ciers-1 PLUS my 2.0 boot camp:

This providers 60 percent lecture and 40 percent hands on.

Ciers-2 PLUS my 2.0 boot camp material.

This provides 5 days of intense MOCK labs + lectures.

Once again, my retake policy is still in place, you can retake any one of these classes any number of times. As a matter of fact, I RECOMMEND it.

Micronics has a total of 24 R&S racks and these racks can be rented by our students for a price of $450 per month.

Soup-to-Nuts on special for $50

The new “Advanced CCIE R&S 2.0” for $395.

Q: Will this affect your delivery? I mean come on, the colored markers and white boards are a hallmark of your teaching style.

A: I will NEVER change the style of teaching, because if I do, I will be another vendor offering boot camps. When I tell everyone that my philosophy is different, some vendors get upset but, hey… my philosophy is different, my philosophy is to “TEACH” and NOT “LECTURE”. I have combined the two courses so my students get the BEST, I have added another 5 hours to my lectures, and if you have been to any of my boot camps you know that I DO NOT COVER FAT, I cover the MEAT of the subject.

Always remember it is NOT the company that the students should look for, it’s the instructor, I do not care if the company has been around since Rocky Marciano days, the company is NOT the one teaching the class, it’s the instructor. In real estate there is a saying and I quote “Location, Location, Location”, in CCIE or any training for that matter, the saying is “Instructor, Instructor, Instructor”.

CCIE R&S v4.0 – Your questions answered by Mauricio Gorito (from the CCIE Team at Cisco)

2009-06-01T16:48:00.001-03:00

Cisco is running a nice “Ask the Expert” with Maurilio Gorito (you can access it through this link) regarding the new CCIE R&S Exam v4.0. This section will end in June 05, 2009.

The Last day to take the CCIE R&S Lab Exam v3.0 is October 17, 2009. The new exam format – v4.0 starts on October 18, 2009.

Personaly I really like the troubleshooting idea! Ok, I´m not a big fan of the OEQ, but troubleshooting seens really nice!

Here are the answers from Maurilio Gorito that I consider to be the most important (at least to me) so far:

Exam Format:

--------------------------------------------------------------------------

1. Open Ended Questions: up to 30 minutes.

2. Troubleshooting: up to 2 hours.

3. Configuration: up to 5 1/2 hours.
--------------------------------------------------------------------------

The candidate will be graded only at the end of the day so even if the candidate fails in one of the sections he or she still going through all three sections.

There will be a big concern on integrity of the exams as all three sections are totally independent, per example the scenario or topology presented on the Troubleshooting section will be different from the configuration section.

--------------------------------------------------------------------------
The v3.0 lab exam has about 36 to 40 questions.

The configuration section on v4.0 will have something around 25 to 30 questions on 5.5 hours.
--------------------------------------------------------------------------

The Troubleshooting section will be independent from the Configuration section, i.e., it will be presented on a different scenario.

Once you finish the Troubleshooting you will move to the Configuration section that will be presented on a new scenario or topology.
--------------------------------------------------------------------------

The Troubleshooting section will have a maximum of 2 hours. The candidate will be presented a series of questions or 'trouble tickets' for a given scenario or topology. The referred topology will pre-configured.

Based on the information provided such as IP addressing diagrams, IGP routing diagrams, and so on you will work to identify and fix the issues. You will be given points for working scenarios.
--------------------------------------------------------------------------

1. The Open Ended Questions are 4 questions total and the candidate needs to get at least three out of four, and yes, usually 2 to 3 words are enough to answer them. During this section you can ask the proctor for clarification.

2. The total score of the CCIE lab exam still 100 points, now divided between the three sections. At this point I can't disclose the exact point allocation per section but you can expect the Configuration section to have between 25-30 questions and the Troubleshooting section to have between 10 to 15 trouble-tickets.

3. Regarding of MPLS we are planning to cover the basic configurations on label switching, VRFs and L3VPN. No advanced scenarios will be part of the exam.
--------------------------------------------------------------------------

OEQ:

--------------------------------------------------------------------------

One good way to prepare for the Core Knowledge questions is along with your preparation to the lab exam where you will be applying the overall concepts during your hands-on practice studying.

During that section you will be asked concept questions about technologies that are listed on the lab exam blueprint so while you are preparing to take the lab exam you are implementing all those concepts and then you will be well prepared for that.

There is no memorization type of questions, like to memorize RFCs (as someone asked before) or specific protocol timers.

You may find questions the will have an output command and / or a topology for your interpretation, but not memorization questions such RFC numbers.

--------------------------------------------------------------------------

The questions are suppose to be clear and direct so you should not need clarification, but if the candidate feel the need to clarify something on the question because per example English is not his or her first language proctors will help to clarify that.

Proctors will not go into technical discussions or possible directions on answering the questions, but still available to clarify the meaning of the question's wording.
--------------------------------------------------------------------------

We do not look on language specifics. Although the questions are written in English during grading we do not look for correct grammar or perfect phrases, rather we look for key words related to the technology involved in the questions. Proctors are very careful on it as well they are available during the exam for any clarification if needed. Here is a link where you can find a sample for the Open Ended questions: http://ciscocert.custhelp.com/app/answers/detail/a_id/4667/kw/short%20answer%20questions%20sample/r_id/166

--------------------------------------------------------------------------

The Open-Ended Questions are graded by the proctor, no by a script.
--------------------------------------------------------------------------

The only available tool during the Core Knowledge section is the Notepad. No calculator is available.
--------------------------------------------------------------------------

Troubleshooting Section:

--------------------------------------------------------------------------

A good way to prepare to the troubleshooting is when you are practicing on hands-on preparing to the lab exam try to change your scenarios, try different approaches when configuring routing protocols, different configuration on QoS, and so on. During your ‘experiments’ observe what happens, the changes on behaviors, and then record your finds. These will help you to understand how the technologies work at the same time how they behave during transitions, and then you will know how to deal when something is broken. Consider the following approach when analyzing a problem.

When analyzing a problem you should consider the following facts:

- Make sure you have a clear definition of the problem.

- Gather all the relevant facts and consider the likely possibilities.

- Create and implement an action plan and then observe the results.

- If the symptoms do not stop try another action plan and gather additional facts. If you try one thing and it doesn’t work you should take that configuration or feature off. In case you make the situation worse, always keep the basic and get back to a known position.

- If the symptoms do stop, document how you fixed the problem.
--------------------------------------------------------------------------

The Troubleshooting section will have a certain number of trouble tickets and points allocated to the section. You will receive credits for the points you get. Your score on this section will show as, 30%, or 50%, or 80%, and so on.
You will need to get a minimum of 80% on each section of the exam to pass on the CCIE lab exam.
Yes, we are planning to post a sample Troubleshooting questions/trouble ticket for study reference.
--------------------------------------------------------------------------

CCIE Lab Exam:

--------------------------------------------------------------------------

The main changes on the new CCIE R&S v4.0 are:

1. The addition of MPLS/VPN, EIGRPv6 and the emphasis on troubleshooting.

2. The addition of a separated 2 hours troubleshooting section to the exam.

No topics were removed from the syllabus and those topics (aka blueprint) will be covered through 3 sections:

1. Open Ended Questions: up to 30 minutes.

2. Troubleshooting: up to 2 hours.

3. Configuration: up to 5 1/2 hours.

You can find more detailed information on the CCIE R&S v4.0 at
https://cisco.hosted.jivesoftware.com/docs/DOC-4605

--------------------------------------------------------------------------

Yes, the v3.0 lab exam has about 36 to 40 questions.

The configuration section on v4.0 will have something around 25 to 30 questions on 5.5 hours.

--------------------------------------------------------------------------

Performance Routing will not be a big topic, and may not appear in all exams.

IOS IPS it is also a topic that will not appear in all exams and it will not require to know the signatures but the basic configuration.

The same applies to the IOS Zone Based Firewall. This is new to the blueprint and it will be basic in the exam and may not appear in all exams.

No Radius server will be part of the CCIE R&S exam scenarios, and initially no SDM software will be installed on the ISR routers.
--------------------------------------------------------------------------

Simply Amazing! Those guys do not mess around when it comes to study material!

2009-05-06T20:42:00.001-03:00

After the “Official” announcement from Cisco regarding the new blueprint for the CCIE R&S v4.0 (how nice, now they´re using versions) every vendor out there are making their moves, but I can´t believe that IPExpert will have their technology focused labs released THIS WEEK! Yeah! That´s right!

Also, their Audio on Demand will also be reworked and will cover both written and lab exam topics, and a huge bonus (Ask the Expert) which you must see for yourself at their blog, please follow this link to check in detail what I´m talking about (there are many other surprises in it): New Routing and Switching 4.0 – Simply Awesome

I will definitly need to go for the CCIE R&S v4.0, no time to finish all my studies and go for a try before the changes take effect, so I feel a bit better… I´ll have everything needed for a good preparation!

IE will also release their material really soon according to their CCIE Blog also, somewhere between May-June, you can check their blog post here: New CCIE R&S: Reload

Uh-oh! The rumours were right! CCIE R&S Exam Changes (Written and Lab) - Official!

2009-05-05T08:43:00.001-03:00

It seens Wayne (IPExpert president and owner) were right… Changes are “really” coming to the CCIE R&S Certification, either written and lab exams!

Just received an email from Cisco, with news regarding LAB (and Written) Exam changes!

Also, there´s a note on Cisco´s Website (CCIE R&S Section), which you can check below:

----

NEW: Cisco Revising CCIE R&S Certification

New lab requires hands-on troubleshooting; both exams cover MPLS and VPN

Cisco has revised the certification requirements for CCIE R&S and published the new v4.0 standards on the Cisco Learning Network. Exams based on the new requirements are scheduled for release on October 18, 2009 and will immediately replace the current exams. The Cisco 360 Learning Program will also be updated to support the new requirements.

----

Changes are good, changes are nice, I really like the troubleshooting idea, candidates MUST know how to approach an issue, how to solve it, how to document the solution, and others. This troubleshooting section can be a problem, because, you´ll troubleshoot a network you´re not familiar with, deal with problems created by high-skilled engineers, but, I really liked this new troubleshooting section, it´s a waaaay better idea than the open-ended questions!

Now… MPLS and VPN´s… it was about the time to come to the CCIE R&S Lab exam… I don´t deal as much as I like with both technologies in my daily activities, but now, will need to master those topics as well…

It seens my plan will change a bit for now… oh my… :S

IPExpert: “FREE!” CCIE R&S Core Knowledge Preparation Quizzer

2009-04-07T14:49:00.001-03:00

I know, I know… I´ve been away for a while now, but my life changed a lot after the world “recession”, too much to do, and no time to make everyone happy!

Anyway, I´m here, still focused in my preparation, I spend most of my free time, either at home or on the road, reading books, making a solid “foundation” to face the beast when the time comes, in my point of view, it´s insane to learn by doing, we need to understand the technology behind the IOS commands in order to be a “real” CCIE! And now, with the introduction of the Open Ended Questions, this makes all the difference!

I just received this month IPExpert Newsletter, there are some exciting news in there, but none is a match for their CCIE R&S Core Knowledge Preparation Quizzer! I just downloaded, installed, and played with it a little bit! Fantastic! :D

And guess what! IT´S FREE! Yeap! That´s right! FREE, $ 0.00, nothing, just download it and play! :)

You can check their Newsletter and find out what´s going on by clicking this link.

Exciting! Now both major vendors do have a product developed to help us with the CCIE R&S Open Ended Questions!

Go check it out yourself! ;)

FREE CCIE R&S Graded Lab Assessment at IPExpert ?! With Voucher codes ?! For real ?! :)

2009-02-19T14:28:00.001-03:00

Yep! That´s real! You´re not dreaming! :)

This morning I´ve received the latest IPExpert Newsletter (which, by the way can be accessed by clicking here) with some wonderful news! You must check it out!

But this particular one cautch my attention! They´re offering FREE CCIE R&S Graded Lab Assessment! That includes immediate access to the lab scenario, solution guide and configuration files!

Also, you´ll receive TWO VOUCHER codes to be used at their vRacks (Proctor Labs)! And the best part, at the end of the session you´ll receive a detailed grading report breaking down every section of the lab!

Now you can check your accuracy and while checking out IPExpert´s materials for free!

Check this screen from their site:

That is really a SWEET deal! :)

Christmas is over, but it seens that my “carnival” will be really busy next week! lol! :)

IPExpert is launching a new sister company for lower level certifications (CCNA, CCxP, etc)! COOL!

2009-02-05T19:23:00.001-02:00

It´s official! IPExpert is launching a sister company, called IPExpert Training, Inc. to offer lower level certifications like CompTia, VMWare, CCENT, CCNA, CCDA, CCNP, CCSP, CCVP and MCSE!

A great opportunity to anyone who wants to join the amazing “Network World”!

I remember my first “Cisco” training, I was so excited when received a call from my boss telling me that, something like: “Hey Caue! Next week you´re going to a CCNA class”! That made my day that time!

And the BEST thing is: Neither IPExpert and IPExpert Training, Inc. will be offering the Cisco 360 Program (also known as NetMasterClass – thank God I didn´t bought from them)! Blended Learning Solutions is 1000 times BETTER (and cheaper) than the Cisco 360 Program!

One other thing: the CCIE team at IPExpert will not be involved in the IPExpert Training, Inc. It´s a completely new company, different instructors, with a great material and the same philosophy, to help you achieve your dreams, improve your career, your knowledge and your lifestyle!

I know many guys who will get VERY EXCITED with this announcement!

Wish IPExpert Training, Inc. all the best, and hope you can help many engineers to achieve their goals, just like IPExpert is doing for years now!!!!

By the way, those lower-level trainings will NOT be Cisco Authorized! ;)

Check their official announcement clicking here!

CCIE Lab: Short Answer Questions – Q&A

2009-01-26T19:48:00.001-02:00

We all know that Cisco is introducing a new type of “exam” between the CCIE R&S Written and CCIE Lab Exams… The World Famous “Short Answer Questions”! It consists of a series of four or five questions asked to the candidate BEFORE the CCIE R&S Lab exam!

It started in Beijing, the candidates were interviewed and it was an “oral” exam! That was kind freaking me out!

BUT, this morning CCIE Pursuit solved the mistery! The new “Short Answer Questions” exam will not be oral, but it´ll be Computer Based! Check this part of his post:

-----

Cisco Announces Updates to the CCIE Lab and Written Exam

Dear Jehanzeb,

Thank you for contacting Certification Support.

They’re computer-base questions, and will be graded by the CCIE lab proctors.

If you have further questions regarding the CCIE Certification Program, please visit www.cisco.com/go/ccie or visit the CCIE Instant Answers at www.cisco.com/go/certsupport.

Kind regards,

Certification Support Center

-----

That is AWESOME! I was worried about the interview… but that doesn´t matter if the questions will be computer based, I will be able to read it, and I read MUCH better than I speak english! :) COOL! So no worries! Let the questions come! :)

You can find many other Q&A in the Cert Support Center, but those listed below are the ones I consider to be the most important (at least to me) regarding the Short Answer Questions exam:

Well… now it´s time to go back to my books! :)

Cheers!

IPExpert´s vClass 50% Off (JUST THIS WEEKEND)

2009-01-25T15:12:00.001-02:00

I don´t know how many of you are unable to travel to US to attend a "decent" bootcamp class just like me!

That´s why I love everything that´s either offered in "On Demand" and "Live, Online" , I can´t afford to go onsite for a class, the class needs to come to me! :)

Both major vendors (IPExpert and Internetwork Expert) offers those type of classes, but, during this weekend (and according to the newsletter this weekend only), if you register for a vClass at IPExpert you´ll receive a 50% discount! WoW!!!! That is nice!!!!

Just use the code "IPXvCLASS" at the checkout and get your vClass bootcamp for half of the price!!

There are 3 types of vClass available:

Option 1: CCIE 5-Day Instructor-Led Boot Camp vClass

Option 2: CCIE 5-Day Technology-Focused Lecture vClass

Option 3: CCIE 1-Week Lab Experience vClass

Those options are not available only to CCIE Rounting & Switching, but for other tracks too!

For those who still have some budget available, this is the time to use it! Hurry up, this promotion is valid for just this weekend!

Follows the original newsletter:

January 24, 2009

WEEKEND SPECIAL: 50% OFF Any Scheduled vClass

EXTRA Mock Labs ("Last Mile" Prep Kit) for Candidates Focused on CURRENT (v2) Voice or Security Lab Exams

Going for NEW CCIE Voice or Security (v3) Blueprint? We Have Materials and Racks Ready for You!

Twitter, LinkedIn, Facebook... Benefits for CCIE Candidates

It worths or not?!

2009-01-19T11:39:00.001-02:00

During this weekend I was asked by a friend if all the time studying, reading, watching CoD´s, labbing, and everything else, worths it or not!

He got my attention with this question... He went a little further with it, all around the world, with economy the way it is, companies are not willing to pay the way they were before the crises... Also, if you look at job postings nowadays, you´ll see job offerings asking for someone who knows R&S stuff, but also, needs to be specialist in Security, needs solid understanding of Voice, years of experience in Storage, Wireless, also needs to know how to handle projects (PMP), and ITIL... So, he asked... why wasting time doing such a "time consuming" certification, like the CCIE R&S, instead of lots of certifications in lower levels!

I stopped what I was doing... in fact, I don´t even remember what I was doing, probably was answering some emails... anyway... It took me at least a couple minutes to process his question before even think about an answer... Everything was really quiet for those couple minutes...

I asked him: So, you´re saying companies nowadays preffer to hire a "generalist" type of engineer than "specialists" ?!

He answered: No, I´m saying they want engineers who can handle everything, and not just a part of it! You know the potential of a CCIE, with all his dedication, and efforts along the way, but tell me, if you´re CCIE R&S, that doesn´t mean you know Security, Voice, and other technologies at the same level a CCSP, CCVP guy does... Also, consider a PMP guy, who is able to handle any type of project, no matter which one, he will be there to handle the project at all, puting all resources together and making it happen!

At this time I got his point of view... He´s right and wrong at the same time (at least to me)... Really... My answer was something like that to him (and please, do not take me wrong, I´m a generalist type of engineer nowadays too):

Ok buddy... Now tell me, when things starts to go wrong... who the companies will chase after for some "consulting" time to solve the problems?! A "specialist" or a "generalist" engineer?! They can have their teams full of engineers, but if they don´t have some specialists in their fields (R&S, Voice, Security, etc), well... soon of later things will start to go wrong! You can´t compare the experience of a CCIE Voice engineer, with years of field experience, working "only" with voice, and voice related issues, with a guy who needs to handle the "security, routing and switching, storage and voice"... It´s really nonsense! By the end of the project both guys can do a good job, but the specialist will do it with less impact, faster, with confidence, while the generalist engineer (like me), will need to do some "home work", pull out a few contacts to solve doubts, and for sure, it´ll take MUCH longer to do it! But both will do it at the end!

So... what´s the advantage?! Again... to manage a network, services and things like that, it´ll probably work... but not for new implementations, where everything starts from the scratch paper during a business meeting! Companies needs to have BOTH type of engineers! Specialists and Generalists! There´s place to everyone!

You need to love what you do to even think about getting CCIE Certified! If you don´t like, please, step away, think again about your career and choose something that pleases you most! I love it! I want to beat it! And that´s what I´m preparing myself to do!

If companies are hiring CCIEs or not it´s another history... but I want to be the type of guy who come up with solutions, and not doubts to solve! Come on! The economic crises will not be there forever, and also, it´s been used all around the world as an excuse to reduce staff, salaries, and everything else! I bet in a couple years everything will be back to normal... And when that time comes, I will be seating on top!

But, you´re right man! We need the best of both worlds... If during the way to achieve the CCIE, I can learn other technologies, it´ll be great! Thanks for the advice, I´ll work in more than one path during my studies! If possible I´ll get some CCxP level certifications (CCVP, CCSP, CCDP, CCIP)... anyway, that will help me to develop myself during my CCIE studies, and also, will make me more attractive to companies during this time!

In fact... my only concearn right now is to to be really attractive to the company I work for! It´s really a pleasure work where I do (Orange Business Services), and I love what I do... so... no worries about changes... :)

Changes in the CCIE R&S Written and Lab Exam formats!

2009-01-14T11:30:00.001-02:00

Well... it seens that all the hoaxes out there are finally becoming truth! Cisco is announcing changes in the CCIE R&S Exam formats!

Starting with the written, according to the newsletter we´ll not be able to skip a question and come back to answer it later in the exam! We´ll need to answer each and every question before moving to the next one! Just like CCNA/CCNP exams!

Now, the biggest change, prior to the LAB Exam we´ll have an "interview" were they´ll ask us 4 or 5 questions! Ok! I must agree that this is a good thing! BUT! In my opinion, there´s pressure enough over the candidate´s shoulder during the exam! This interview will just put more pressure!

In my opinion, this examination should be a 3 steps, like that:

CCIE Written --> CCIE Interview --> LAB Exam

So, passing the CCIE Written Exam would allow you to schedule the Interview, when you pass the interview you would be able to schedule the lab!

Come on! Questions will be in english (it´s really different to actually READ than LISTENING), that will be a difficult to me, or to anyone else who doesn´t have english as primary language!

Second... what happens if I suck in the interview, and ace the lab!? I can be nervous! That will make me a "cheater" ?!

They could charge like $100.00 for the interview, for sure that would relieve some of the pression over me, it´s better to fail just with $100.00 than $1,400.00!

I´m not against it! I just think it can be done in 3 steps!

Anyone agress ?!

Follows Cisco announcement:

----

Changes to CCIE Lab and Written Exam Question Format and Scoring

Effective February 1, 2009, Cisco will introduce a new type of question format to CCIE Routing and Switching lab exams. In addition to the live configuration scenarios, candidates will be asked a series of four or five open-ended questions, drawn from a pool of questions based on the material covered on the lab blueprint. No new topics are being added. The exams are not been increased in difficulty and the well-prepared candidate should have no trouble answering the questions. The length of the exam will remain eight hours. Candidates will need to achieve a passing score on both the open-ended questions and the lab portion in order to pass the lab and become certified. Other CCIE tracks will change over the next year, with exact dates announced in advance.

Effective February 17th, 2009, candidates will also see two other changes in CCIE written exams. First, candidates will now be required to answer each question before moving on to the next question; candidates will no longer be allowed to skip a question and come back to it at a later time. Second, there will be an update to the score report. The overall exam score and the exam passing score will now be reported as a scaled score, on a scale from 300-1000. This change will not affect the difficulty of the current set of exams and will assure CCIE written exams will be consistent with Cisco’s other career certification exams.

----

Santa arrived earlier this year! Merry Christmas!

2008-12-24T13:17:00.001-02:00

I just arrived from a long journey that took me almost 50 days away from everything (like home, you can see that by the few posts during the last 2, maybe 3 months), but, in the end, everything went well, I´ve implemented a new network for one of our customers, and all equipment (new and old) are up and running well, with no downtimes during the changes, and that´s what matters for me!

You can loose (in fact not loose, but, spend) countless hours working in an action plan, trying to figure out every situation that can arise, but in the end, the power of a plan careful created is priceless!

Anyway! Now I´m back, hungry and thirst for knowledge, specifically CCIE knowledge! lol! :)

Oh yeah! I was checking my emails, visiting my favorite websites, and found out that once again IPExpert and Internetwork Expert are playing Santa with HUGE discounts and End Year promotions under their websites! Go check it out! The AWESOME IPExpert CCIE Blended Learning Solutions for $999.00 (until Dec/31/2008) is a great deal, for sure!

I´ll spend some time with family, my wife (before she kills me), my cats during this christmas, and only after that (maybe next monday) get back to my studies, reading a book for hours, watch some Video on Demand Classes, do some labbing, all the fun stuff I need now!

So, I wish everybody a Merry Christmas and a Wonderful, Awesome, Incredible New Year, and I hope that all your dreams come true in 2009, were each of us will be able to make the difference in anything we choose to do!

Thank you all, and see you soon! Feel free to contact me any time!

Best Regards,

Caue Wailemann

OSPF: Peering Basics (IPExpert VoD) - Part I

2008-12-05T12:21:00.001-02:00

Ok, it has been a while I don´t post anything, but believe me, it´s not because I don´t want too... I´m really away from everything due to a huge project to implement before christmas, hopefully!

That means... I do have "ocasional" internet access (like, 1h every 5 days, can you believe that?! Me neither! It´s really difficult for a "Internet Addicted" guy like me)!!!

Anyway... That´s why I´m a bit away from all the news (I can see some exciting news regarding EverythingIE and Dynamips support from IPExpert), also a new online vClass from them, and a new introductory class from Internetwork Expert! Cool! As always, the most they try to be better than the other, we win! :) Wonderful man!

Also, Joe, I saw your email - sorry for taking so long to reply, but I´ll do it soon! Very NICE diagram and observations there! Sorry for taking too long to reply it to you, but I´ll do it soon! :S

So... let´s get a bit more technical, into OSPF, those are some notes, personal understandings and mostly the instructions, tips and advices from IPExpert VoD (awesome material). OSPF is splitted in several parts on those VoD starting with peering basics, which in my opinion, makes sense, why implement other features like security before having full reachability ?! Insane if you ask me! That means, when you get into the OSPF section, don´t worry about authentication, or area type, or things like that! Get the basics peering up and functional! Period!

That means, assign the correct router/interfaces in the correct areas, like area 0, area 1, and forget everything else, like stub, nssa, and others! Take one step at a time!

Look at your diagram and check the issues you could have to peer between the routers using OSPF... For sure the first thing that will cause us problems will be OSPF and Frame-Relay...

Oh yeah... just to remember, the Frame-Relay world has 3 different Frame-Relay interface types: Physical, Multipoint and point-to-point.

Now... as far as OSPF is concerned, we have 5 different network types. Out of that, either Multipoint and Physical Frame-Relay interfaces are both going to default to an OSPF Non-Broadcast Network Type.

On the other hand, the Point-to-Point Frame-Relay subinterface is going to default to a Point-to-Point Network Type in OSPF.

That can lead us to some mismatches, depending on the frame-relay network setup and topology. As Scott likes to say, little things to be looking at, but very important! :)

Match your network and interface types together! First of all, timers may not match if you try to mix different interface types!

There´s also the DR Router! We must take care to make our HUB router the DR! Also, if running over a Non-Broadcast link, don´t forget the broadcast parameter in the frame-relay maps, to have OSPF actually "working" on your network (even better, on your exam!). One piece of advice is, on a point-to-point subinterface this is enabled by default.

There are some tools (AKA debug) that we can use to check this "broadcast" issue, like debug ip packet, if you get encapsulation failed, that pretty much tells you that there´s something missing (that could be the broadcast parameter in your maps, or some other kind of little thing we usually forget about).

Also, keep in mind the neighbor command! They may forbidden you from changing the network types, and things like that, we can always use the neighbor command to try to achieve neighbor relationship.

You MUST read your exam carefully and understand how it´s worded! It might tell you: don´t change the network type on the spokes, or on the HUB change to a network type other than broadcast! At the VoD Scott suggest us to start looking at the details, looking at the things that match, looking at the things that NEEDS to match in order to perform peer! Start thinking and choosing how you´re going to do stuff! A great advice!

Any interface that is Point-to-Something does NOT elect a DR, keep that in mind! But, Broadcast and Non-Broadcast will!

Broadcast - Elects a DR, and it has what we call fast timers, 10/40 sec (hello/dead) timers.

Non-Broadcast - Elects a DR, but has slow timers, 30/120 sec! It also works in the unicast fashion, it "must" have the neighbor command! Very important! It MUST have it! In order to actually operate!

But the real question is: Can we mix and match those types?! If our spokes are Non-Broadcast, can we make the HUB Broadcast?! Sure! Absolutely! We´ll have to change timers, they need to match, either fast or slow, doesn´t matter, but they have to be the same at each end.

Also... the neighbor command... where to put it on this situation?! On this "scenario" the neighbor command goes into the spokes, even knowing that we may normally have to put them on the hub! If your HUB is in Broadcast type, the neighbor command is not accepted!

As long as the timers match, and your choices about the DR, we´re good to go!

Point-to-Point and Point-to-Multipoint, same thing, you can mix and match those if I want too, just adjusting timers!

Point-to-Multipoint Non-Broadcast (Cisco Proprietary) It assumes the same type of idea the point-to-multipoint does, uses the same slow timers and stuff, but, it must use unicast packets, that means, it uses the neighbor command ...

Now, in order to form a peering relationshipe, there are a number of things that needs to match!

Timers for example, it needs to match! We can change it! Like the OSPF Hello Timer, if we change the Hello Timer, the Dead Timer automatically changes (by the way, the Dead Timer can also be changed independently, to achieve any weird task if needed)!

Other things that must match:

MTU Size must match!

Area ID must match! That makes sense! We can´t peer an Area 0 guy with an Area 1 guy! :)

Stub Flag must match! Now, this highlights a very important rule in OSPF, one of the OSPF rules is that everybody in an Area must have the same database information! Well... what the Stub flag does?! It says a variaty of things, but it´ll tell your router it can´t have external routes as an example, what about the other router in the area, if it "wants" to have external routes!? Things are not going to work very well in this situation! Everybody MUST agree about the Stub Flag!

The same applies to Netmask! It´s important to know "we´re" all in the same network in there! There are some exceptions with Virtual-Links and Point-to-Point interfaces, don´t need to worry about that part, but, as we go through, all of these things have to match!

One very important thing is missing out of this list! That will be the DR!

Technically you can peer "something" that requires a DR with "something" that doesn´t requires a DR. However, things will be all messed up if we do that! In the DR world, somebody believes they´re in charge, and they´re the ones who can announce the routes officially!

On the non-DR network everybody has the right to announce routes, and that will mess up all of your database and reachability.

So, even knowing the DR is not a poart of the list here, you do have to match and agree to who is or is not the DR!

The neighbor command (we´re talking about it very much, don´t you think?!), is basically used when I can´t use multicast in order to get to the other side!

Technically it´s only necessary in one side of the connection, so, in a Hub and Spoke network I would probably use my Hub to put this. One place, put all the neighbors, keep life simple! But, this is not necessary! You can do it in the spokes if you want! You can do in both if you want! No big deal! But you have to have the neighbor command some place in order to initiate the conversation!

So, in our example, making the HUB Broadcast, and the Spokes Non-Broadcast, the neighbor command HAS to go on the spokes, the broadcast guy (the HUB in this situation) won´t even accept the neighbor command!

Your HUB will be sending out it´s multicast frames, no one will be talking back to it, and them, it gets an unicast from one of the spokes and says "Oh, ok! This is how you wanna talk?! Not a problem" and it´ll respond to that spoke.

Back in our example scenario... the neighbor command MUST be used in every spoke in order to trully operate! Once each of them initiates the unicast conversation the HUB will reply just fine, and everything will be working great! It takes a while, like a couple minutes, but it´ll happen just fine!

And that´s just the neighbor command!

Next post we´ll talk about the other features presented in the VoD, like loopbacks, DR, and MTU... I really gotta go now!

Nice weekend to everybody, and don´t ever give up! Keep going on your studies (check this wonderful post from Ethan Banks about this).

Cheers!

IPExpert R&S Dynamips Support + Everything IE!It seems Santa Claus is coming earlier this year! :)

2008-11-28T09:29:00.001-02:00

IPExpert will be lauching Dynamips support to their R&S Track really soon! This is AWESOME news for anyone who doesn´t own a rack just like me! Follows the link for this post on their blog:

IPexpert to Announce Dynamips Support and "Everything IE” Private Beta Launch

Also, EverythingIE will be launch in the following days! I´ve heard about it a few months back, and I´m really anxious to check it out! An online community (like Facebook, Orkut and others) just for CCIEs! Really helpful! Check this comment from Wayne about this:

---

Wayne Lawson II says:

November 27th, 2008 at 1:41 pm

Caue - Thanks for the support - EIE will truly be an amazing resource and community for CCIE candidates. It’s essentially going to be Facebook, Linkedin, MySpace, Twitter, Meet up, Groupstudy, CCIEblog and Certification Talk / IEOC on steroids….Everything you need with a single login (and SPAM-free and heavily moderated so the community stays productive and valuable!) - many free resources, an “Ask the Expert” (online instructors), free labs, product giveaways, resume / job search (many recruiters assisting in placement), study groups (online) supported by the IPexpert team, etc - and we’re hoping that our competitors participate in this initiative so it’s truly a vendor-neutral meaningful community….more details to come soon!

---

Exciting, don´t you think?! I can´t wait to check it out!!!!!!!!!

Recomended CCIE Books from Jared Scrivener

2008-11-25T11:45:00.001-02:00

I just saw this post from Jared Scrivener at IPExpert CCIE Blog, he makes a very good point! Most candidates (including myself) get so anxious to solve some labs that we forget to make a solid foundation with some quality reading!

Of course, we all have our strong and weak areas, but his point is, most of our weak areas correlates to the books we haven´t read!

This is a very nice statement! That´s why a CCIE preparation is a 18, 24 months adventure! We must feed our brain with enough information about technologies and them put the theory in pratice on our labs to check HOW everything works together!

Want to check his list?! Just follow the link to the post:

http://ipexpert.ccieblog.com/2008/11/21/so-much-information-part-one/

I would add some more books, but, probably he will have those included in the next post! Wonderful reading! Enjoy!

PS: I´m actually working on a OSPF post from IPExpert VoD. These OSPF videos are AWESOME! I´m just a bit delayed due to the HEAVY end-year workload I do have right now! :(

CCIE Command Memorizer low price for the first 500 canditates who signup!

2008-11-07T10:12:00.001-02:00

I just received an email from ConfigureTerminal.com (Mr. David Bombal) with GREAT news! The CCIE Command Memorizer (and all other tools available at his website) will be available for USD 9.99/month for the first 500 people who signup (regular price after that will be USD 29.90/month)!

This is a GREAT opportunity for those who want to know the tool, and how it works! A very nice move! You can try it for a month, if you like, you renew your subscription, if you don´t just cancel it! :)

Let me say this... I loved! Very nice tool, and it´s helping me in my studies, in fact, the CCIE Command Memorizer is key in my strategy (specially on the road)!

Oh yeah... The signup will not only give you access to the CCIE Command Memorizer, but to many other tools also!

What a "nice" way to do business! Thank GOD I didn´t bought from NMC!

2008-11-05T10:19:00.001-02:00

To my surprise, this week while checking Sadikhov Forums (CCIE Other section), I saw many NetMasterClass customers complaining about their "products" being removed from their accounts! EVERYTHING, DOiTv2 Workbook, Video on Demand, Tech Library, everything!

WTH! Does the Cisco 360 Program gives the right to NMC to do that?! I would ask for my products back or a refund! I would NOT accept nothing less than that!

Oh my! Thank God I didn´t bought their Study Package (remember the slogan: This awesome study package will keep you busy enough bla bla bla...)... yeah! Right! It would keep me busy enough to try to have them back to my account!

So, if a company (NMC) sell their products to other company (Cisco), what happen to their customers?! Yeah... good question...

I wish more companies have the same police IPExpert and Internetwork Expert does regarding Investment Protection! That´s the way it should be!

You can check the original Sadikhov Topic by clicking here.

IPExpert Year End Special

2008-11-05T09:59:00.001-02:00

Yeah! Year End Special from IPExpert!

IPExpert Blended Learning Solutions is priced at USD 999.99 again! At least for a while! Wonderful study package!

Today IPExpert just released a new Newsletter with some promotions for this year!

I will hurry up to grabe some more Rack Rental hours! :)

How to check your Diagram for potential Routing Loops

2008-11-04T09:55:00.001-02:00

One of the most challenging tasks in the CCIE Lab is how to deal with routing loops, specially when dealing with redistribution. I still working my way through it and I still missing alot (any comments, thoughts, suggestions will be welcome!).

Anyway... I will not deal here (in this specific post of course) with the details about redistribution, and anything else. I will just check the topology for potential routing loops, and redistribution points! (and please, correct me if I´m wrong, ok?!).

Let´s check this diagram from IPExpert Workbook Vol. 3 - Lab. 1 (this Lab 1 is available for download at IPExpert Website, go get yours).

To keep things simple, forget that R4 Serial connection is also connected to R5 through Frame-Relay network, just pretend it is connected direct through Serial Interfaces, ok?!

So we have EIGRP, OSPF and RIP all over our topology, and guess which protocol was choosen to be in the Frame-Relay network?! Yes, you´re right! OSPF!

Anyway, checking it a little deeper, we can see that routers BB2, R4, R5 and R2 have direct connections and those routers are using RIP. Also, R1 and SW1 are using RIP between them! That should not take too long to be configured (depending on what is being asked), but probably not very challenge.

In the EIGRP "world" we have BB1, R6, R7 and R9 routers. Note that there are two interfaces between R6 and R9. Again, that also should not take too long to be configured depending on what the task is asking and the restrictions applied!

Now... OSPF! It´s being used between R2, R5 and R6 in the OSPF Area 256, and between R1 and R2 in OSPF Area 12.

Now that we checked the IPv4 IGP Routing Protocols in this diagram, we also need to verify it for potential Routing Loops. Check the bellow drawing:

Starting from BB2, to the top of the topology, we can see two loops in our network. One represented by the "ORANGE" arrows and the other by the "RED" arrows.

First, let´s analyze the loop in "ORANGE" between R6 and R9. It´s inside EIGRP AS679. So, this loop is "contained" inside one routing protocol. The routing protocol will deal with it. No worries!

Now... the loop between R2 and R5 (represented by the "RED" arrows). This one involves two distinct routing protocols! So we must take care when doing redistribution between those routing domains, either by using different Administrative Distance (AD), route-maps, access-list or any tool that we´re allowed to use to avoid it!

Regarding the redistribution points... we´ll need to redistribute routes in R2, R6 and "maybe" in R1, it´ll all depend on the connections!

Just keep in mind that, when dealing with routing loops we can have situations like:

Routing Loop with a single IGP: That kind of situation will not create a routing loop when redistribution is performed, because, it´ll be filtered by the IGP in use.

Routing Loops with two or more IGPs: In this situation we´ll need to take care off "manually", using filters, maps, access-lists, and other tools when dealing with redistribution, avoiding for example that RIP domain learn OSPF routes, and them send those routes back to the OSPF domain!

This analysis seens simple, but try to do it in some different diagrams on your own to get more practice, I´ll do the same!

Later we´ll discuss the details involving the redistribution and the IGPs!

Cheers!

The "War" Begins again! Internetwork Expert major announcement and IPExpert Answer

2008-10-31T16:28:00.001-02:00

Yesterday Internetwork Expert made their major announcement. You can check it out at their website. There are some very cool ideas over there. Here´s the direct link to the video:

http://www.internetworkexpert.com/news/corporate_announcement.htm

Today Mr. Matt Brooks from IPExpert just answered IE´s announcement, and I must agree with him in some points, some of the "new" stuff of Internetwork Expert are out there on market for a while at IPExpert... like the CCIE Blog... Well... IPExpert is announcing it for a while now, and since it´s launch it´s a huge success! Here follows the link to the IPExpert answer, I would check it out if I were you, very nice observations:

http://ipexpert.ccieblog.com/2008/10/31/ie_major_announcements/

Also, our biggest friend Mr. MIKE DOWN (yeah!) made a very nice post about this on his blog! By the way, sorry to hear that buddy! Didn´t knew about your house! :( I told you! Come down to Brazil! This is living! :) lol!

Anyway, Mike´s post (and blog) is a "must check out"! Here´s the link:

http://idontwannabeaccie.blogspot.com/2008/10/isnt-it-about-candidate.html

And... you know what?! Who wins at the end?! WE, Customers, Candidates! My wish is that IE, IPExpert, and others keeps on "war" making better products with lower prices! Just imagine if there were only 1 training company out there, what would happen?! Poor materials and high prices would be my guess...

So... watch out for the next events of this "Could War", at least, this one will bring only benefits to us all! :)

OH YEAH! Almost forgot about! Brian said something about Blogs that are not "neutral"... Well... I don´t think that there are blogs and/or bloggers actually bought by companies. I used to have IE´s banner over my blog, and now I do have IPExpert one, and NO ONE ever told me what to write about!

Maybe Brian just quick checked those blogs/bloggers he talked about, and had a feeling about it, I´m sure if he dig a little deeper he will change his opinion!

Tell me something... Who are the "EXPERTS" ?! I my opinion the EXPERTS are the vendors, better yet, the instructors who created the training material... Ok... So... They created the material in a way they know it´s good for us to learn! For instance, what´s the purpose of learning BGP before RIP?! Insane I would say! So... Probably those blogs/bloggers are in the same situation as I am! I really LOVED the Video on Demand from IPExpert (not only for it´s High Quality, but actually for the idea behind it, you, the instructor a few power point slides and HOURS of information, what else you need?!)

So... to conclude... I´ve chosen to start my preparation with IPExpert Video on Demand... And I´ll finish it before doing anything else. Maybe a couple labs. But, that´s not the point... If my preparation right now is the IPExpert Video on Demand, what else could I blog about?! My cats?! Of course I will blog about those videos I´m watching! I do have Internetwork Expert Class on Demand, Workbooks, and what will happen when I start to use their products and blog about it?! Will IPExpert thinks that IE is buying me up for a few posts?! I don´t think so!

Now you ask me, Brian is lying?! Not at all! This is possible, companies CAN pay people to blog about their products... but what happens to those that are really USING it and ENJOYING it?! What is expected for this guy?! This is something to think about.

Anyway... If I can have a blog at Internetwork Expert WERE I can blog about anything (and I mean, any other company) I want that would be cool! Otherwise, Blogspot and CCIE Blog are more than enough for me, because here, I´m free to talk about anything that I want! I feel just like in my home... FREE! ;)

PS: I know I´m away from the blog, but things are really CRAZY down here, I promisse I´ll take more time to blog things out! Sorry! :S

Is the new Cisco 360 Training Program a new label to NMC products?!

2008-10-23T10:03:00.001-02:00

That one sounded like a joke/hoax a while ago, but now that Cisco just announced the new Cisco 360 Learning Program for CCIE Routing and Switching it doesn´t sound like a hoax anymore!

Of course, until we actually see the Cisco 360 Training Program in action we can´t assure nothing, but a couple things makes me think they partnered with NMC (NetMasterClass) and NMC products will be re-labeled or re-created/re-written as Cisco Official.

My question is... Why NMC?! Why not IPExpert, why not Narbik, why not Internetwork Expert?!

You may ask me WHY do I think they partnered with NMC... well... easy... First, couple months ago, I just don´t remember where, maybe on Sadikhov Forums or GroupStudy, I´ve saw a post regarding NMC partnering with Cisco.

Second... go to NMC Website and try to buy their DoITv2 Workbook! The same Workbook Ethan Banks used, and many others! By the way, it seens to be a WONDERFUL resource, I´ve checked their sample lab, and i liked it very much!

Their VoD also seens to be very good, but, unlike IPExpert or Internetwork Expert, NMC doesn´t have a FULL end-to-end Video-on-Demand program, they do have for some topics, but not for all of them!

The only doubt is... How expensive the new Cisco Official Workbook will be?! Even better, will I be able to buy only the Workbook or I should get the FULL Training Program?!

By the way, the "old" NMC DoITv2 Workbook was priced at USD 300.00.

----

Available November 1^st: Cisco 360 Learning Program for CCIE Routing and Switching

Designed to help high potential network professionals transform into certified network experts, the Cisco 360 Learning Program for CCIE Routing and Switching is the first Cisco authorized learning program for expert training. The Cisco 360 Learning Program for CCIE Routing and Switching prepares networking professionals for the challenges of managing sophisticated networks as well as the configuration and troubleshooting scenarios found on CCIE examinations.

The Cisco 360 Learning Program is a six-month blended learning experience incorporating advanced skills assessments, targeted learning modules, instructor-led training, mentoring and hands-on practice and assessement labs to accelerate expert-level competency. The Cisco 360 Learning Program will be made available through select authorized Cisco Learning Partners.

For more information, visit Cisco 360 Learning Program for CCIE Routing and Switching.

----

OSPF Virtual-Links

2008-10-22T10:44:00.001-02:00

OSPF Virtual-Links are used to extend Area 0 to routers without direct connection to OSPF Area 0.

A diagram will help us to understand this requirement a bit better:

The link between R1 F0/0 and R2 F0/0 belongs to the Backbone Area, or Area 0. The Frame-Relay connection between R2 S0/0 and R3 S0/0 belongs to the OSPF Area 1. As far as R2 has a direct connection to Area 0 (through it´s F0/0 interface) no Virtual-Links are needed.

BUT, for example, if we create a Loopback Interface in R3, and place this Loopback Interface in OSPF Area 2, what will happen?!

R3 doesn´t have any connections to Area 0, it has connections to OSPF Areas 1 and 2, but not Area 0. Check this new diagram including the newly created Loopback Interface in R3:

Hmmm... This situation will require the use of Virtual-Links between R3 and R2 using Area 1 as a "connection" to Area 0. In situations like this, where the router (in our case R3) has two or more interfaces in different areas, and none of those interfaces belongs to Area 0, we´ll need to use an OSPF Virtual-Link.

You may ask yourself: why R3 S0/0 in Area 1 doesn´t need a Virtual-Link connection also?! It´s on the same router as the Area 2 Loopback Interface, so why R3´s Loopback in Area 2 need a Virtual-Link connection, but R3´s S0/0 interface in Area 1 doesn´t?!

The answer is simple, R3 is direct connected to R2 using Area 1, and R2 is connected to Area 0, so it´ll get advertised due to R2 connections! ;)

Without Virtual-Links Area 2 (in this situation) would never get advertised to either R2 and R1!

First, let´s go ahead and configure all routers according to our diagram (except by the Virtual-Links):

R1:

int f0/0
ip address 192.168.10.1 255.255.255.0
no shut
!
router ospf 1
router-id 1.1.1.1
network 192.168.10.0 0.0.0.255 area 0

R2:

int f0/0
ip address 192.168.10.2 255.255.255.0
no shut
!
int s0/0
encapsulation frame-relay
ip address 192.168.11.2 255.255.255.0
frame-relay map ip 192.168.11.3 203 broadcast
no shut
!
router ospf 1
router-id 2.2.2.2
network 192.168.10.0 0.0.0.255 area 0
network 192.168.11.0 0.0.0.255 area 1
neighbor 192.168.11.2

R3:

interface loopback 2
ip address 192.168.12.3 255.255.255.0
!
interface serial 0/0
encapsulation frame-relay
ip address 192.168.11.3 255.255.255.0
frame-relay map ip 192.168.11.2 302 broadcast
no shut
!
router ospf 1
router-id 3.3.3.3
network 192.168.11.0 0.0.0.255 area 1
network 192.168.12.0 0.0.0.255 area 2
neighbor 192.168.11.2

Ok! The above configuration is done, let´s check the OSPF Neighbor Relationship and the IP Routing Tables of our routers:

R1:

R1(config)#do sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i-IS-IS, su-IS-IS summary, L1-IS-IS level-1, L2-IS-IS level-2
ia-IS-IS inter area, *-candidate default,U-per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C 192.168.10.0/24 is directly connected, Ethernet0/0
O IA 192.168.11.0/24 [110/74] via 192.168.10.2, 00:00:00, Ethernet0/0

R1(config)#do sh ip ospf neig

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/DR 00:00:38 192.168.10.2 Ethernet0/0

=================================================================

R2:

R2(config)#do sh ip route

Gateway of last resort is not set

C 192.168.10.0/24 is directly connected, Ethernet0/0
C 192.168.11.0/24 is directly connected, Serial1/0

R2(config)#do sh ip ospf neig

Neighbor ID Pri State    Dead Time Address        Interface
1.1.1.1       1 FULL/BDR 00:00:30   192.168.10.1   Ethernet0/0
3.3.3.3       1 FULL/DR 00:01:43   192.168.11.3   Serial1/0

=================================================================

R3:

R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i-IS-IS, su-IS-IS summary, L1-IS-IS level-1, L2-IS-IS level-2
ia-IS-IS inter area, *-candidate default,U-per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C 192.168.12.0/24 is directly connected, Loopback2
O IA 192.168.10.0/24 [110/74]via 192.168.11.2,00:00:24,Serial1/0
C 192.168.11.0/24 is directly connected, Serial1/0

R3#sh ip ospf neig

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/DROTHER 00:01:56 192.168.11.2 Serial1/0

See?! Neither R1 and R2 have the 192.168.12.0/24 Network from Area 2! That´s because R3 is not directly connected to Area 0! To solve that, we´ll need to configure a Virtual-Link between R2 and R3 using Area 1 as a "connection" to Area 0.

The command to do that is: area <area-id> virtual-link <rid of the router in the other end>, for example: R3 will have the following command added to it´s configuration: area 1 virtual-link 2.2.2.2 . The same command (just changing R2´s rid by R3´s rid) needs to be configured in R2. To make things a little bit easier, here follows the configuration:

R2:

router ospf 1
area 1 virtual-link 3.3.3.3

R3:

router ospf 1
area 1 virtual-link 2.2.2.2

Oh yeah! If you´re unsure about the Router ID (rid) of the router, just issue a show ip ospf command and it´ll show you the Router ID, see below:

R3(config)#do sh ip ospf
Routing Process "ospf 1" with ID 3.3.3.3
Supports only single TOS(TOS0) routes
Supports opaque LSA
Supports Link-local Signaling (LLS)
Supports area transit capability
Initial SPF schedule delay 5000 msecs

Now, with the virtual-link configured between R2 and R3, let´s check again the OSPF Neighbor Relationship and the IP Routing Table of all our three routers:

R1:

R1(config)#do sh ip route

Gateway of last resort is not set

     192.168.12.0/32 is subnetted, 1 subnets
O IA    192.168.12.3 [110/75] via 192.168.10.2, 00:00:01, Ethernet0/0
C    192.168.10.0/24 is directly connected, Ethernet0/0
O IA 192.168.11.0/24 [110/74] via 192.168.10.2, 00:01:00, Ethernet0/0

R1(config)#do sh ip ospf neig

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/DR 00:00:38 192.168.10.2 Ethernet0/0

=================================================================

R2:

R2(config-router)#do sh ip route

Gateway of last resort is not set

     192.168.12.0/32 is subnetted, 1 subnets
O IA    192.168.12.3 [110/65] via 192.168.11.3, 00:00:10, Serial1/0
C    192.168.10.0/24 is directly connected, Ethernet0/0
C    192.168.11.0/24 is directly connected, Serial1/0

R2(config-router)#do sh ip ospf neig

Neighbor ID Pri State     Dead Time Address       Interface
3.3.3.3       0   FULL/-   00:00:33   192.168.11.3 OSPF_VL0
1.1.1.1       1   FULL/BDR 00:00:39   192.168.10.1 Ethernet0/0
3.3.3.3       1   FULL/DR 00:01:56   192.168.11.3 Serial1/0

=================================================================

R3:

R3(config-router)#do sh ip route

Gateway of last resort is not set

C    192.168.12.0/24 is directly connected, Loopback2
O    192.168.10.0/24 [110/74] via 192.168.11.2, 00:01:41, Serial1/0
C    192.168.11.0/24 is directly connected, Serial1/0

R3(config-router)#do sh ip ospf nei

Neighbor ID Pri State    Dead Time Address       Interface
2.2.2.2       0   FULL/-   00:00:19   192.168.11.2 OSPF_VL1
2.2.2.2       1   FULL/BDR 00:01:47   192.168.11.2 Serial1/0

AH! Much better! Now ALL routers have ALL OSPF Routes in their IP Routing Tables! Our "hero" Virtual-Link solved our problem!

Another really usefull tip is... sometimes when you issue a show ip ospf virtual-link the output shows that the Virtual-Link is UP, but you see no communication going on, neither a OSPF Relationship established... well... sometimes that happens, to make sure that the Virtual-Link is "really" working, issue a show ip ospf virtual-link command and see if the output is just a portion of what it´s supposed to be (that will indicate a not working virtual-link) or if you have the full output. That can also be a temporary situation (while the link gets up). See the example of a BAD and a GOOD Virtual-Link output:

Virtual-Link with Problems (BAD):

=================================================================

Working Virtual-Link (Good):

R2(config-router)#do sh ip ospf virtual-link
Virtual Link OSPF_VL0 to router 3.3.3.3 is up
Run as demand circuit
DoNotAge LSA allowed.
Transit area 1, via interface Serial1/0, Cost of using 64
Transmit Delay is 1 sec, State POINT_TO_POINT,
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:08
    Adjacency State FULL (Hello suppressed)
    Index 2/3, retransmission queue length 1, number of retransmission 1
    First 0x65593B80(11)/0x0(0) Next 0x65593B80(11)/0x0(0)
    Last retransmission scan length is 1, maximum is 1
    Last retransmission scan time is 0 msec, maximum is 0 msec
    Link State retransmission due in 2986 msec

To finish, another useful command (not only to Virtual-Links, but to OSPF), is the show ip ospf interface brief. This command will show you a brief of all OSPF configured interfaces, with some other nice things to know!

R2#sh ip ospf interface brief
Interface   PID   Area IP Address/Mask Cost State Nbrs F/C
Et0/0        1     0    192.168.10.2/24   10    DR    1/1
Se1/0        1     1    192.168.11.2/24   64    BDR   1/1

Seens a bit easier now, don´t you think?! :) I do!

IPExpert BIG Announcements! (With nice opportunities!)

2008-10-20T21:30:00.001-02:00

Hmmm... I´ve stepped away for a couple weeks due to a very critical project to take care off and in my return we do have some big news!

The long awaited CCIE Blog from IPExpert was finally released! So cool man! Not a blogspot, wordpress or something like that! It´s a sacred place for CCIE´s and CCIE Candidates! You can create a blog, add your existing one, read, comment, everything related to the CCIE and technical topics you may want to!

There´s also some GREAT opportunities in this newsletter which you must check it out!

-- IPExpert October Newsletter --

October 20, 2008

IPexpert is a BETTER VALUE than Internetwork Expert... from the IT Industry's Leading Provider of Third-Party Validation

LAUNCHED: CCIEblog.com: Create Your CCIE Blog or Add Your Existing Blog to the Directory for Great Visibility

OCTOBER SPECIALS... Two Weeks Left! Courses, Products and Rack Time

COMING 2009: IPexpert University -- Apply to Join Our Team!

2009 Public Course Schedule Released, Private On-Sites Available

IPexpert's Self-Study Workbooks are a MUST HAVE for CCIE Prep

Are You Located in Europe, Asia or Australia? Read This...

Exhaust Your 2008 Training Budget Before It's Too Late

CCIE Security Blended Learning Solution Now Shipping

Aggressive Discounts for Proctor Labs Rack Sessions -- ONLY 2 Weeks Left!

NEW: CCIE Voice Video on Demand Boot Camp (High-Definition!)

FREE Upgrade: CCIE Voice Audio Lecture on Demand (20 HOURS, iPod-Ready)

IPexpert-Sponsored Study Groups (all CCIE tracks)

Words from Your Peers: Actual CCIEs Tell You What Worked for Them

Developers Needed for CCDE and CCIE Wireless

Free Online vLectures -- Register Now!

Cisco CCIE "360 Degree" Program Announced

CCIE Security: Lab Blueprint Change Announced

IPExpert Special, must hurry up!

2008-10-10T15:58:00.001-03:00

IPExpert is doing a wonderful job helping candidates to achieve their goal, get CCIE Certified! Blended Learning Solutions is a POWERFUL tool to that (I really loved the approach IPExpert used, man, really, you don´t feel sleepy, or get bored, it´s like a regular bootcamp class, you must check it out), and for this week (and this week only), they do have this VERY NICE Special offer for their "Social Friends"!

Right now I can´t attend a bootcamp (for two main reasons, 1 - I´m not ready yet, even knowing I can buy it now, but attend it at a later date, and 2 - A travel to USA is not in my "budget" right now), but the price is great! I paid more for my last CCNP course than they´re charging for this awesome bootcamp.

BUT! I´ll be able to enjoy the Proctor Labs promotion! That is making all the difference in my studies! Hands on, is exactly what I need right now!

In fact, you all know that I´m a bit "away" from the blog for the last couple weeks, but be cool, next week will be way better for me. Too many projects to implement at the same time, consuming all my energy right now (I´m working almost 18hours/day for the last couple weeks), but that will end by next wednesday for sure, and I´ll back to my normal study/blogging routine! Thanks GOD!

I still amazed of how my wife still recognizing me! I´m spending more time at office than at home! If I keep doing that, eventualy she´ll lock me out! lol! :)

Anyway, you´ll be redirect to this IPExpert Promotion by Clicking Here. Act now and save HUGE $$! :) I will!

---

Special Offers for our "Social Network" Friends

Here are 1-Week ONLY specials (valid now through next Friday, Oct. 17) for our followers on Twitter, LinkedIn, OSL and the Training Advisor Blog...

Boot Camp Special:

ONLY $2,999 for any 2008 5-Day Boot Camp (R&S, Voice, Security, Service Provider)
To take advantage of this special pricing, email Amy (ahelton@ipexpert.com) for instructions.

Self-Study Product Special:

50% OFF the Blended Learning Solution (R&S and Voice)... a $1,000 savings!
10% OFF any other IPexpert product, any track!
To take advantage of this offer, email sales@ipexpert.com for instructions.

Proctor Labs Rack Rental Special:

DOUBLE YOUR MONEY on Proctor Labs online rack rental (R&S, Voice, Security, Service Provider). When you purchase a 10, 25, 50 or 100 session bundle, you will get twice as many at the same price!
To take advantage of this offer, email sales@proctorlabs.com for instructions.

* Notices:

Cannot be combined with any other discounts / promotions.
New registrations / purchases only.
Valid for IPexpert-delivered publicly-offered courses only.
All orders and registrations must be received with payment in full by 5:00pm Eastern, October 17, 2008.

---

SDM - Switch Database Modifier

2008-09-29T15:20:00.001-03:00

SDM is used for memory management on your switches. Anytime you hear the "Memory Management" keyword that means SDM in your switches.

Switches comes with a finite amount of memory, and, you may need to optimize your switch to support all L2/L3 memory requirements for a specific type of traffic.

It brings us many possibilities of how we´re going to use the switch memory! But, the real question is... how to do it?!

We got default profiles, just keep in mind, no matter which profile you choose, it won´t break your lab, on the other hand, it can bring serious damages to a real network! So, always, plan before configuring anything!

The SDM Templates are used to optimize the switch for specific features, for IPv4 we have:

Access — The access template maximizes system resources for access control lists (ACLs) to accommodate a large number of ACLs.

Default — The default template gives balance to all functions.

Routing — The routing template maximizes system resources for unicast routing, typically required for a router or aggregator in the center of a network.

VLANs — The VLAN template disables routing and supports the maximum number of unicast MAC addresses. It would typically be selected for a Layer 2 switch.

So, anytime we change the SDM, which by the way, it´s the only command about Memory Management, we MUST reload the switch in order for to take effect! This is very important! If you do not reload the switch, and the proctor issue a show sdm and it shows it´ll be "routing" on next reload, you lost your section points!

The configuration is pretty straight-forward, for example, to optimize routing, we use the global configuration command sdm prefer routing and that´s it, check this example:

Switch(config)# sdm prefer vlan
Switch(config)# end
Switch# reload
Proceed with reload? [confirm]

DO NOT forget to reload! Otherwise it won´t take effect! If you issue a show sdm before the reload, your output will look pretty much like this one:

Switch# show sdm prefer
The current template is "desktop routing" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses:            3K
number of igmp groups + multicast routes:   1K
number of unicast routes:                   11K
    number of directly connected hosts:       3K
    number of indirect routes:                8K
number of qos aces:                         512
number of security aces:                    1K
On next reload, template will be "desktop vlan" template.

Not difficult at all right?! More information can be found at:

http://cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_46_se/configuration/guide/swsdm.html

He´s back ladies and gentleman!

2008-09-24T08:50:00.001-03:00

Our friend, Mr. Mike Down, is back with his new blog I Don't Wanna Be a CCIE! Most of you had the chance to speak with him before, some of you don´t, but know that: HE´S THE MAN!

As usual he knows what he´s talking about, and how to do it!

I would follow his posts closely, as he knows everything inside out from the "backstages" of the CCIE and the CCIE Training World! And that´s cool!

Brother, welcome back, and count with me for anything you ever need! I´m here, no matter where you are, or to who you work, I´m your fan! ;)

Don´t believe "only" in the show run (in my case, in the show conf)

2008-09-23T11:56:00.001-03:00

Hmm... buddy! Let me tell you something... don´t believe only in the show run, always check every parameter involved using other show commands...

Why do I say that?! Last weekend, during a new WS-3750 installation for user access, I faced a little problem... Two core´s, and my new access switch, with links to both Core Switches. Trunk was limitted only to the management vlan to avoid any problems during the intervation.

In order to avoid any other problems, I´ve increased to Spanning-Tree cost to 25 in both uplinks (1Gbps) from the access switch to the cores.

So far so good! Installation done with the first core, ok, let´s connect the second! Hmmm... lost access, let me try again, ok, accessing normal, so what happened?! Root Port from Core 1 changed to the Access Switch?! Why?!

That´s when I´ve found that one of the Core Switches had spanning-tree costs of 3004, 3019... WTH! Quick show conf (yes, it is CatOS), the Core was configured with UpLinkFast...

No biggie, changed spanning-tree cost, path went back to normal, and everything else was good! Customer will check how and when to remove the UpLinkFast configuration.

If at any time, I´ve checked the spanning-tree with show commands (not the show conf), I would see that, but... living and learning, right?!

Now I do know why some guys don´t like to do a show run, they preffer to check with other commands, I think they´re right... ;)

September edition of the CCIE Flyer just released!

2008-09-21T12:11:00.001-03:00

The wonderful CCIE Flyer from Emmanuel Conde (CCIE Agent) was just released!

Man, I must say, they know what they´re talking about! I almost cried reading the article "Build a CCIE Workshop" from Emmanuel, I must agree with him that everything in there is TRUE!

Also, mr. Scott Morris wrote a fantastic article called "CCIE Training - First Day Preparations", a must read!

Plus many others! You must check it out! I just finished reading through everything, and I loved! Well... who will expect less than a AWESOME job from Emmanuel, right?! Emam, YOU´RE THE MAN!

-- Click here to be redirected to the CCIE Flyer --

Storm-Control everything you need to know

2008-09-19T11:05:00.001-03:00

Another part of the IPExpert Security Video-on-Demand, Storm-Control!

Storm-Control can be used to limit, or to set thresholds for different types of traffic (Broadcast, Multicast and Unicast) on a specific interface you choose (or that you´re asked for). ;)

You can set your threshold to whatever the top level that you want, and the traffic will be limit to that. Also, on 3560 Switches you can set falling thresholds too! Basically it is telling the switch how much traffic do I want (or don´t I want) through that interface.

Now... to the tricky part... just suppose you want to limit the broadcast/multicast traffic in a specific interface... how would you set?! Would you allow more Broadcast traffic than Multicast?!

Hmm... good question, let´s step back for a while... What´s a Layer 3 Broadcast?!

A Layer 3 Broadcast can be the "All Hosts" which is the 255.255.255.255, or it can be a "Subnet Brodcast", for example 172.168.10.255 is the broadcast IP of the /24 subnet; just keep in mind that if the actual subnet mask change, the Broadcast IP will also change too!

Now... how about Layer 3 Multicasts?! What those guys are?

Layer 3 Multicasts, known as Class D also, begin with the binary value of 1110 in the first octet. It goes from 224.x.x.x to 239.x.x.x. Also, at Class D we don´t have concept of subnetting of or broadcast reachability! So Broadcasts and Multicasts at "Layer 3" have nothing to do with each other.

Ok! With all that in mind, can you make a decision on how to configure the Storm-Control in one of your switch ports to limit the Broadcast / Multicast traffic?! Not that fast right?! There´s another wonderful world outside "Layer 3" it´s called "Layer 2" ! :)

At Layer 2, Broadcasts are know as "All F´s" FF-FF-FF-FF-FF-FF, this address represents all devices in a Layer 2 network, we all know that since the CCNA days, so, no big deal!

Now... The Layer 2 representation of IP Multicasts all begin with 01-00-5E. And there´s one specific bit in the MAC Address that defines whether or not it´s a Multicast, the I/G bit!

Take a look at the MAC Address format:

So, like our friend Scott Morris likes to say, the least significant bit of the most significant byte is the I/G bit! And looking at our Multicast Address 01-00-5E (in binary 0000 0001-0000 0000-0101 1110) we can see that this I/G bit is set to 1 in EVERY Multicast!

In that case, the I/G bit defines a Multicast when it´s set to 1, but, how about the Broadcasts?! All bits in a Layer 2 Broadcast are set to 1 (including the I/G bit), so, Layer 2 Broadcasts, in fact, ARE a subset of Layer 2 Multicasts.

All Layer 2 Broadcasts are Multicasts.

All Layer 2 Multicasts are not Broadcasts.

With that in mind, when configuring Storm-Control in a switch port, and, if you´re setting limits to both Multicast and Broadcast, you should set Multicast limit HIGHER than the Broadcast limit (at least set they equal, but never set the Multicast level to be less than the Broadcast level, otherwise, either Broadcasts and Multicasts will be limited by the Multicast level, making pointless the Storm-Control configuration for the Broadcast!).

It´s configured on a per-interface basis, here´s the command list:

(config-if)#storm-control broadcast level (#)[.(#)]
(config-if)#storm-control multicast level (#)[.(#)]
(config-if)#storm-control unicast level (#)[.(#)]

Level is % of line as maximum threshold
Level 100 would permit everything
Level 0.0 would disable the frame type

The following example will enable Unicast Storm-Control on a switch port with an 89% rising suppression level and a 67% falling suppression (remember, falling suppression can only be configured in 3560). It´ll also enable Broadcast Storm-Control on a port to a level of 20%. When the Broadcast exceeds the configured level of 20% of the total available bandwidth of the port within the traffic-storm-control interval, the switch drops all broadcast traffic until the end of the traffic-storm-control interval:

interface gigabitethernet0/1
storm-control unicast level 89 67
storm-control broadcast level 20

Just remember, Multicast levels (which includes more things) must be higher, or at least equal, to the Broadcast levels when configuring Storm-Control!

You can use the show storm-control command to verify the operation!

Nice! :)

More information available in do following Websites:

http://tcpmag.com/qanda/article.asp?EditorialsID=317

http://www.synapse.de/ban/HTML/P_LAYER2/Eng/P_lay207.html

http://www.faqs.org/rfcs/rfc1469.html

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_46_se/configuration/guide/swtrafc.html

Virtual Tour - CCIE Lab: A "must" see video!

2008-09-17T09:13:00.001-03:00

I was checking one of my favorite CCIE resource on the Web, Sadikhov Forums -> CCIE Other, a very nice section to be checked once and a while! In there I´ve found a post from our friend Stacky about a very nice video in Cisco Website: Virtual Tour - CCIE Lab!

The video is 3 min long, but it´s AWESOME! At least you´ll get to know what you´ll face in the lab day, and how it looks like!

I do recomend to everybody, if you have a chance, check it out!

Here´s the link, it´s the third video in this page:

Certifications Connect - Becoming a CCIE

IPExpert Blended Learning Solutions - Promotional Price ending soon!

2008-09-11T14:43:00.001-03:00

For those who wants to get the awesome IPExpert CCIE R&S Blended Learning Solutions, I advise to act now! The price will increase soon, it´ll still the lowest price on the market, but why pay more, if you can have it now for USD 999.99 ?!

Talk to sales guys, they will clear any doubt you have, and there are many reviews about it over the internet! Just check it out!

I must say, the product is fantastic! Nothing like that! They use a different approach, not slide after slide, but a full motion movie, you, and the instructor! Very informative!

----

LAST MONTH for Blended Learning Solution Giveaway Pricing -- BUY NOW

The past two months has been an exciting time. Since we began our promotion offering our newly-created, ground-breaking Blended Learning Solution™ products for only $999, we have shipped nearly 1,000 of them to CCIE candidates around the world!

However, there are less than 2 WEEKS LEFT of this rock-bottom pricing for this unmatched level of training materials! On Monday, September 22, the prices for the Blended Learning Solution products will double, rising back to the level representative of the massive amount of quality materials delivered in this offering.

The message is, if you were planning to buy CCIE training materials, DO IT NOW and take advantage of a value unseen before anywhere.

http://www.imakenews.com/ipexpert/e_article001198618.cfm?x=bdlpKmg,bb3NCpTF

----

802.1x, Guest VLAN and Auth-Fail VLAN

2008-09-10T10:58:00.001-03:00

Another security topic from IPExpert videos: 802.1x, nice, not too long, and easy to understand.

Dot1x is a specification for port based authentication, most of the time we hear about 802.1x is when somebody is talking about Wireless (hi Shiraishi). Basically it uses the same concept there, but it was originally created to be a switch based authentication mechanism.

By default, 802.1x uses RADIUS. This is where RADIUS, TACACS and AAA comes on the LAB, and that´s why they´re on the blueprint.

Also, keep in mind that there´s no RADIUS server on the CCIE R&S Lab Exam. So take a look at your diagram, check where the RADIUS server is "pretended" to be connected, and at the details they´re giving to us before stressing too much over it!

So, until the device is authenticated, 802.1x access control allows only Extensible Authentication Protocol (EAP) over LAN (EAPOL) traffic through the port to which the device is connected. After authentication is successful, normal traffic can pass through the port.

If the switch receives EAPOL packets in a port that is not configured for 802.1x authentication or if the switch does not support 802.1x authentication, then the EAPOL packets are dropped and are not forwarded to any upstream devices.

802.1x needs to be turned on globally and configured at each interface you actually want it:

To turn dot1x on:

(config)#dot1x system-auth-control

And at the interface:

(config-if)#dot1x port-control <type>

The type can be:

Auto - If this particular interface doesn´t receive a response from the host, the port will be disabled. It´ll send out the EAPOL packets (Extensible Authentication Protocol), those EAPOL packets are basically saying: "Hey! Who are you?!" And hopefuly the switch gets a response! If it doesn´t get a response, by default, the port is not enabled. The users will not be able to access the network without authentication;

Force-authorized - No authentication is performed, it just pretend that the authentication just happened. It´s normally used for routers;

Force-unauthorized - Similar to shutdown. It pretends that this port wasn´t authorized.

802.1x, Radius and AAA works really close to each other! 802.1x will send EAPOL packets and control the access, AAA will tell the Router/Switch "HOW" to authenticate, and Radius will authenticate the requesting host if configured to do so.

Be careful when doing AAA, otherwise you may get locked out of your switch, and that will force you take your lab again, with better lucky (or better prepared) next time!

Fortunately there are some technics to avoid locking yourself out of the switch! I´ve talked about that before (click here if you want to check that post), but, I consider it so important, that I´ll copy the contents here:

-> Turning 802.1x on in your system (also enabling RADIUS):

dot1x system-auth-control
aaa new-model
aaa authentication dot1x default group radius
radius-server host 150.100.220.100 key ipexpert

-> To avoid further complications with any port using "login" you´ll want to create a workaround. The Proctor will NOT do password recovery for grading you! So, we need to create a workaround for this:

aaa authentication login MyVTY line
aaa authentication login MyCon none
!
line con 0
login authentication MyCon
!
line vty 0 4
login authentication MyVTY

-> That way, Console will have no password, and the VTY will use the configured line password.

-> The bottom line is that while it is very irritating to lock yourself out of a switch it is MUCH better than locking the Proctor out!

-> Another thing you may do is "reload in 10" on the switch. If you haven´t validated your config and cancelled the reload, then at least you will fix things yourself!

-> (Do NOT save unvalidated configurations!!!)

As we go through we´re only going to do AAA authentication login, that´s the type of authentication we´re going to do.

But now, if someone responds to the EAPOL packets with incorrect credentials, or even worse, if someone doesn´t have a computer that supports 802.1x and don´t know how to respond to it?! What happen to those guys?! By default, the switch will keep sending EAPOL packets until it receives the correct credentials.

And that´s it?! Those guys will not be able to access the network?! Well, if we want yes, they´ll be out, but, we´re not that mean, right?! We can configure a "guest" VLAN, with limited access to the network, so those guys will be placed there!

With guest-vlan information (or with auth-fail vlan information) we have ways to setting up some options. The port needs to be at mode access (can´t be dynamic in dot1x):

int fa0/10
switchport mode access
dot1x port-control auto
dot1x guest-vlan 100
dot1x auth-fail vlan 100
dot1x host-mode multi-host

That way, if the guy doesn´t support 802.1x authentication (or, if it´s not configured to do so), it´ll be allowed to use the configured guest-vlan (in our case VLAN100).

Also, if the guy use incorrect credentials (like wrong username/password), it´ll be allowed to use the auth-fail vlan (in this particular case, VLAN100 also).

But, how about that dot1x host-mode multi-host command, what´s that?! That will do 802.1x authentication for EVERY MAC Address using this link.

On the other hand, if we use the command dot1x host-mode single-host as long as one MAC Address is validate, every MAC Address in this single link is allowed to go through!

Cool!

You can find more information at this link if you want:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a00801d11a4.shtml

Switchport port-security - what we MUST know

2008-09-08T14:43:00.001-03:00

Continuing with the IPExpert CCIE R&S BLS Security section, it´s a short video (40min), but, with a lot of good information! Security has always been one of my biggest weakness, so that´s why I´m depicting it topic by topic, that helps me to either learn it better, and, if I ever need to review my notes, I´ll have everything splited to it´s own topic here! So that´s good! Hope that helps you too!

To begin with... how do we enable the port-security in a switch port?! That´s easy to answer, using the interface command: switchport port-security. But, what will be actually configured in this specific switch port if we just type this command and nothing else?! It´ll set the switchport to allow only "one" MAC Address and the Violation mode will be set to Shutdown.

Probably the LAB will ask you something more specific, that´s where you have to know a few things... The violation mode for example, we have three violation modes availabe:

Protected - When a violation occurs, it´ll simple ignore any exceeding MAC Addresses, according to your configuration (if you allow only one MAC Address, it´ll permit the first MAC Address to transmit, and drop everything else for any new MAC Address trying to transmit to this port).

Restrict - Does exactly the same thing as Protected mode, but will also send a SNMP Trap regarding the violation.

Shutdown - When a violation occurs in the shutdown mode, it sets the port to ERRDISABLE state. The port will stop transmitting anything in the ERRDISABLE state, also, the port LED will turn off. It sends out a SNMP Trap about this.

When a port enters in the ERRDISABLE state you can do a shut and no shut to recover it! That can be a boring task, if you have many "smart users" in your network. Fortunately, there´s another way to do that, you can also set it to "autorecovery" using the feature errdisable recovery (global configuration mode), the commands for this are:

errdisable recovery cause <violation cause>
errdisable recovery interval <#seconds>

For example, if the Port-Security placed a port in ERRDISABLE state, you can set your switch to recovery it like that:

errdisable recovery cause psecure-violation
errdisable recovery interval 1800

That will recover the port 30min (1800sec) after the violation event! Cool! :)

Another thing to keep in mind is: the command switchport port-security mac-address <MAC> by itself will not get the configured MAC Address into the running-configuration of your switch. If you issue a show switchport port-security you´ll see the configured MAC there, but not in the show run!

In order to have it in your running configuration, you have to use the STICKY keyword: switchport port-security mac-address sticky <MAC> that way, the configured MAC Address will appear at the running-configuration, and of course, you´ll be able to save it! If you do not specify any MAC Addresses after the STICKY keyword, the switch will dynamically learn the attached MAC Address and place it into your running-configuration.

So, for example, to allow two MAC Addresses (1111.1111.1111 and 2222.2222.2222) at FastEthernet 0/6 (configured as an access-port), and, if any violation to that rule occurs, the port should be placed in ERRDISABLE state, recovering itself after 1hour without any intervation. The MAC Address MUST appear in the running-configuration.

How can we solve that!? Not that difficult, right!? Here´s the answer:

conf t
!
errdisable recovery cause psecure-violation
errdisable recovery interval 3600
!
interface fastethernet 0/6
switchport mode access
switchport port-security violation shutdown
switchport port-security maximum 2
switchport port-security mac-address sticky 1111.1111.1111
switchport port-security mac-address sticky 2222.2222.2222
exit

That will meet the requirements of our question!

Also, if you issue a switchport port-security ? under the interface configuration mode you´ll have all available options for this command (in fact, there are just a few options).

Is it difficult?! Not at all, but, there are some things to keep in mind to be used either in the exam and in real-life networks!

You can find more information at the following link from Cisco Website:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_46_se/command/reference/cli3.html#wp1948361

Sometimes it´s just too difficult

2008-09-06T16:07:00.001-03:00

Man... why it has too be so difficult?! Sometimes I feel like throwing everything away and start a new business: sell coconut water at the beach!

Lol! Just kidding! I just had a "BUSY" week (almost 18hrs a day), but I´ll get back to my routine starting tonight. I´ll arrive home (yep, I´m out in a business travel), and I have some plans already, watch a couple Videos from IPExpert BLS. In fact, I´m moving slower than what I really wanted, but, at least, I´m still moving! Better than just leave all my CCIE Materials in top of my desk! :D

The good thing about it is: I´m taking too many notes from all Videos that I watch (like, a 1hour video takes me at least 3 or 4 hours to finish! I keep moving back and forward to get EVERYTHING), and that is helping me a lot! For sure my technical skills are better now than before! I used to have some doubts, but I´m clearing them all during the studies. And you know what?! All of them were really simple! That´s great!

CCIE study is hard, lonely, and time consuming, I must say, BUT I get so happy each time I learn a new trick, technology, or clear that doubt that bothered me for so many years, and that makes all the hard work WORTH IT!

Not that the coconut water is a bad idea, but I´ll stick to my original plan and dedicate myself to achieve my goal: to be better than yesterday (and of course, get my numbers if possible). ;)

Anyone wanna join me?! :) I´ll try to finish my security notes by monday if possible!

If anybody needs a little help, or just talk, let me know! ;)

CCIE Command Memorizer - Q&A - Updated Sep/04/2008

2008-09-03T14:39:00.001-03:00

Here follows a quick Q&A about CCIE Command Memorizer, hope it helps! Please, feel free to ask any questions about the eBook, I´m using it, and I´m enjoying! Of course, this is just a review, and I may not be able to answer all questions (remember, I´m not the vendor, I´m just a customer of www.configureterminal.com).

All comments are welcome, specially if you have a copy of the eBook, so others can enjoy your point of view!

1-) What is the CCIE Command Memorizer?!

It´s a study tool, an eBook, just like any Workbook, with questions and tasks related to the CCIE Topics, where you also get a prompt (after each question/task) to enter the configuration commands.

2-) There´s explanations for each question?!

No. There are for some, but not all! You have the correct answer for each question, but no explanations about it for all tasks.

3-) Is it bad?!

In my opinion?! Not at all. CCIE Command Memorizer is a study tool, that will help you to actually practice with the configuration commands, work on your speed, and check how to configure many tasks. You can use the Cisco Documentation to find the answers, that will improve your navigation skills at the Cisco Documentation.

4-) Can you use abbreviated commands?!

No! Some tasks you can, but not all. Again, in my opinion, that doesn´t matter! If I know the full command I know the abbreviated version also! For me, it doesn´t make any difference. It still the same powerful tool as before!

I know that Mr. David Bombal and his team are adding abbreviated command support to the product, so you should expect news regarding this in a near future!

5-) Is it possible to pass the CCIE Lab using only the CCIE Command Memorizer?!

Well... Hard to say, it´s a good idea to have at least a two vendor approach, and Video-on-Demand classes (so you can watch it, go back, and check again and again, until you understand the topic). It´s a great tool to be combined with other existent CCIE Training Materials, due to its portability, really good questions, and the way you get to use it, just jump in and start configuring! In my opinion?! It´s great!

6-) Do you recommend it?!

Yes I do! I bought it, and I´m very happy, it´s becoming part of my daily study strategy! Even if I have just a few minutes, I can try to solve some tasks in there, practice with the Cisco Documentation, and everything I would do with a workbook, with the advantage of having the command prompt just after each question.

7-) Any sample questions?!

Well... I´ll add a couple here (if anyone wants to solve, feel free, I´ll add the answers by the end of the week).

Frame-Relay:

OSPF:

Spanning-Tree:

----- UPDATED September, 04 2008 -----

As requested, I´ve added some more questions which I consider to be a CCIE Exam Level questions, some I consider easy, some I consider hard, but maybe what is hard to me, is easy for many of you, and vice-versa, we all have our strengths and weakness, and those are different for everyone, well... not that different, right?! :)

Also, I´ve answered some more questions about the product in the end of this post, so don´t forget to check it up!

Switching:

Security:

QoS:

Multicast:

IPv6:

Frame-Relay:

EIGRP:

BGP:

8-) Is it cost effective?!

Well... that depends on your point of view... I´m at the beginning of my jorney, I´ve much work to do before even think about a CCIE Lab attemp, and all resources are welcome at this stage for me!

The CCIE Command Memorizer is not a Workbook with solutions guide, that will take you by hand telling: hey, do this on the exam and you´re good, no, don´t do that, OSPF works that way, and blablabla... You can find this in many Workbooks out there, which I consider my primary source for the CCIE Studies! And I don´t even think that this is the purpose of the CCIE Command Memorizer! In my opinion, it´s a preparation tool that looks like a combination of a Workbook + Dynamips, where you can just open and start answering configuration tasks, ideal for anyone who lacks time during day, but wish to do something else other than step away for 5min to talk a while, get a smoke, drink coffee, or anything else you could do before one job task and another! But, it must be combined with other CCIE Training Materials out there, and, right now, there´s no other tool that do the same for you! It´s unique.

I´ve learned A LOT from it already, and I do consider the CCIE Command Memorizer very helpful!!!

Right now, my resources are:

- Video on Demand Classes from IPExpert;

- IPExpert Workbooks;

- CCIE Command Memorizer;

- Internetwork Expert Workbooks;

I´m finding the CCIE Command Memorizer very useful, really, at home I usually watch Videos on Demand, and during the day, before work, during breaks, and before leaving I´m using the CCIE Command Memorizer. Also, I´m using it with Cisco Documentation to get used to it! I´m still finding my way through the documents, but I can honestly say, 3 months ago, it was taking me about 20min average to find any answer in the Cisco Documentation, but now, after using it for EVERY and EACH task that I try to solve, I´m taking between 6 to 8 min, when I get to 2 or 3 min I´ll feel really good about it!

But anyway, to conclude... Everything CCIE Related is expensive, and for USD99.99, you get a very good product in my opinion! Of course, my opinion could be different than yours, if so, I please ask you to express your feelings in a comment, so others can check your point of view (again, I´m just a customer, and not the vendor, so don´t worry if you have anything to say, please, please, please, do it here!). ;)

CCIE Command Memorizer - First Impressions

2008-09-01T15:52:00.001-03:00

Yesterday and today I was able to play a while with the CCIE Command Memorizer... It´s really a powerful tool to the studies! I´ve checked the RIP Section (not all tasks) and some Frame-Relay also. Do not consider this a full review of the tool, I´ll use it a little more before that, but, here are my first impressions:

Topics are organized by categories, like BGP, QoS, Frame-Relay, under each you´ll find the associated tasks. First you got the questions, and right before that, the prompt to enter the commands. Really useful on the job, on the road, where you have little time to study, and need to do it fast! Everything is ready just waiting for you! Open the eBook, choose a topic, and start configuring it!

As said before, the each task commands are limited to the task commands itself. And you have to enter it right, following the order of the question. After each command, you get the OK or WRONG, so you can go back and fix it (also, if you want, the eBook can give you the correct answer).

And before you ask, there´s no question mark "?" to get help about the commands, you must know what you´re doing! This is GREAT! You know in what that will help me?! No?! It´ll help me to improve my way at the Cisco Documentation! Many times doing something, I keep typing "?" over and over, until figure it out, but the best thing in the study stage that I´m right now, is to go to the Cisco Documentation and find my path there! That´s really good! I´ll not be tempted to type "?"! Either I know how to solve the task, or I´ll need to navigate through the Documentation and find the answer! Cool!

At the top and the botton of the page you´ll find the RESET button, so you can reset all your work and start over!

The questions are the best of the CCIE Command Memorizer in my opinion, I really liked the way the questions are presented to us, direct and to the point. Some are tricky, but, if you read it carefully you´ll understand exactly what is being asked. A great tool to learn not only the commands, but how to do it!

Check this RIP task for example:

Configure RIP version 2 md5 authentication with chain named "pass" and password "cisco" using key 1. Put 10.1.1.1/24 on serial 0/0. Enable authentication on Serial 0/0. Enable rip version 2. Advertise 10.0.0.0

This is only one out of 16! And by the way, it´s the first RIP task! Anyone want to try to solve it?! I´ll post the answer latter this week!

It covers pretty much ALL topics in the CCIE Lab Blueprint (if not all, really close to it).

The best thing about CCIE Command Memorizer is that´s so easy to use... You just start the eBook and you´re ready to go! Good for anyone who have little breaks to study, and want to enjoy it at all! Of course, the tool by itself will not make you a CCIE, but when used in conjunction with other CCIE Training Materials seens to be a POWERFUL combination!

I´ll get back with some more in-depth review!

Just got the CCIE Command Memorizer, SWEET!

2008-08-30T19:52:00.001-03:00

Today, following a friend´s advice, and my feeling also, I got the CCIE Command Memorizer from ConfigureTerminal.com

I do receive Mr. David Bombal newsletter monthly (you can apply to it at his site - www.configureterminal.com). The newsletter is very nice, with tons of tips, good advices and examples. I specially like the "hands-on" examples! Those are little movies of how to achieve or correctly configure a specific task! I would sign-up for that, there are some really good tips and tricks in it! Anyway... back to the subject...

The CCIE Command Memorizer was created by him, during his studies to the CCIE so it must be a good product! The guy knows what he´s talking about in the newsletter, the product must be good too! ;)

I haven´t tried it that much yet (too busy this weekend), but the quick "tour" I took at it was sweet! I tried some tasks from Switching, and also some for OSPF... Man... you know what it looks like?! It´s like a mix of a Workbook plus Dynamips! Of course, each task commands are limited to the task commands itself, BUT, it´s a WORKBOOK with a prompt to enter the configuration commands right away! No need to wait to get back home, or setup a Dynamips Topology, or even to wait for my Rack Rental time! It´s there, for you! Just type the commands and see if you get it right or not! So cool!

Another great thing I liked (didn´t knew about that) the CCIE Command Memorizer license allows for 2 simultaneous copies to be installed under 1 license. That way, I´ll be able to have it at my home computer, and also in my Laptop at work! So, anywhere I go, I´ll have it available! Good police! No more wasted time between one call and another at my job! :)

If the rest of the eBook looks like those few tasks I tried, it´s a MUST HAVE product! I´m so glad I finally took the decision to get it!

I just need to handle some issues, and I´ll be able to start using it! When that happens, I´ll write up a few posts, so you can check it yourself! Oh yeah... I´ll ask permission to add some screenshots to the posts! Let´s see!

Oh yeah, the price (USD 99.99) is not high for what you actually get! A Workbook (just like any other vendor workbook) with command prompt to enter the correct configuration lines right away! For sure it´ll become part of my daily study routine. Maybe a section by day, or 10, 20 configuration tasks, it´ll all depend of my available time! But anyway, another powerful tool to help me with my studies! AWESOME!!!! :)

Wow! Two days out, and now candidates are interviewed before the CCIE Labs?!

2008-08-28T22:08:00.001-03:00

That one was fast! I stepped away for a couple days to take care of some personal stuff, and now there´s this msg at Groupstudy regarding interviews before the CCIE Lab in Beijing China!

Is it a "hoax" ?! Is it true?! I don´t know... I know that when Cisco changed their rules for exams in China, Pakistan and India I´ve received an email (and I´m from Brazil). Now this msg... My mailbox is empty (well... not empty, but there are no msgs regarding this)...

In my opinion, if they want to interview a guy, that´s ok, but Cisco should change a bit their strategy, why not interview the guy a few months prior to his Lab, and if he pass the interview, he´s allowed to take the CCIE Lab?! Like a 3 steps for the Certification! That would be nice! Probably the pass rate would increase also, that way, Cisco would better select the engineers who will be allowed to take the test, not forgetting that it is kind difficult to cheat an interview! The guy in front of you asking questions will be a high qualified engineer, and he could change the questions according to his feelings!

But well... who knows... maybe one day, in the mean time, anybody can confirm if this is true?!

Read the full msg from Groupstudy bellow:

-----

Dear Candidate:

On August 27, Cisco will introduce a pilot for the CCIE Routing and Switching lab exam in Beijing, China. The pilot will add a 10-minute interview that will assess the candidate's ability to apply expert-level networking skills and knowledge to networking problems that are encountered on the job. After the lab orientation, a panel of three experts will conduct a verbal interview with each candidate, asking a series of expert-level
networking questions (questions and answers will be in English).

The ability to correctly answer these questions will affect the exam score. After completing the interview, the candidate will have the entire 8 hours to complete the lab portion of the exam. These scores will then be calculated and then combined for a total score which will decide a pass or a fail.

Our goal with this email is to let you know that your day will extend beyond the normal testing day by approximately one hour. The additional hour will be at the end of the day. We hope you find this interview process enlightening and helpful as we continue to strive for the standard the world has come to expect from CCIE.

-----

Private VLANs (PVLANs)

2008-08-26T19:07:00.001-03:00

Until now, I thought PVLANs were a bit difficult to understand and to implement, like when studying to CCNP that took me a while to digest, and I had some doubts about it, till today! Man... how simple it is, and there´s no much "magic" in that (like our friend Scott Morris usually says)! Pretty straight-forward and no big deals! The Security Video from IPExpert is AWESOME. It´s short, informative, to the point, and solved MANY questions I´ve for a while in minutes! Man! What a nice way to do it!

So, let´s get into that:

There are tree type of Private VLANs Ports:

Promiscuous (P) - talk to everyone (usually connected to the exit Router, DNS, DHCP Server, NTP Server);
Isolated (I) - only talk to Promiscuous ports;
Community (C) - talk to others in the same Community & Promiscuous ports.

To have PVLANs configure the Switch MUST be in Transparent VTP mode, otherwise, it´ll not work.

Just keep in mind that when you configure your switch to VTP Transparent mode, you do not loose what you´ve learned so far, you´re just not gaining anything new about the changes from now on!

Hosts in different PVLANs are all in the same IP Subnet, BUT, they´re not able to talk to others in different community or isolated VLANs! That´s the main goal of a PVLAN, to split the VLAN domain into multiple isolated broadcast subdomains. But if one Community VLAN needs to talk to other Community VLAN?! Well... that can be done through a Router or L3 Switch. Also, you can apply some access-lists and other security features to permit only the things you want to pass through!

The best way to explain this is using an example, so check our topology, we´ll concentrate on the PVLAN ports:

There are three Community VLANs (there can be more if you want) so you put every client inside it´s own Community VLAN, avoiding that one client talk to another. That means Customer A could have a WebServer, and some other application server inside it´s own Community VLAN, and those equipments will be able to talk to each other, but they´ll NOT be able to talk to equipments in other Community or Isolated VLANs.

But, wait a minute, we´ve created one Community VLAN for each customer, and only one Isolated VLAN?! If we have more customers needing Isolated ports?! Should we create more Isolated VLANs?! The answer is NO. Isolated Ports only talks to the Promiscuous Ports and not to each other. So each customer inside an Isolated Port will be confined to this port only plus the Promiscuous Port.

First, lets go ahead and create our VLANs:

SW1 and SW2:

vlan 10
private-vlan primary
exit
!
vlan 101
private-vlan isolated
exit
!
vlan 102
private-vlan community
exit
!
vlan 103
private-vlan community
exit
!
vlan 104
private-vlan community
exit
!
vlan 10
private-vlan association add 101-104
exit

So, VLAN10 is our Promiscous VLAN, and it´s associated to ALL other VLANs (101, 102, 103 and 104).

Now, we´ll associate each port to it´s VLAN, check it out:

SW1:

interface fa0/3
switchport mode private-vlan host
switchport private-vlan host-association 10 104
!
interface fa0/4
switchport mode private-vlan host
switchport private-vlan host-association 10 104
!
interface fa0/7
switchport mode private-vlan host
switchport private-vlan host-association 10 102
!
interface fa0/8
switchport mode private-vlan host
switchport private-vlan host-association 10 102

SW2:

interface fa0/3
switchport mode private-vlan host
switchport private-vlan host-association 10 101
!
interface fa0/4
switchport mode private-vlan host
switchport private-vlan host-association 10 103
!
interface fa0/5
switchport mode private-vlan host
switchport private-vlan host-association 10 103
!
interface fa0/2
switchport mode private-vlan promiscuous
switchport private-vlan mapping 10 add 101-104

Every device MUST be associated with the promiscuous VLAN (in our case VLAN10)! Beyond that they´ll be associated with the non-promiscuous (the isolated or community VLANs) in order to specify how those ports will behave! That´s why ALL ports are associated with VLAN10 + it´s own VLAN.

So, what can be connected in the Promiscuous VLAN?! Normally the devices that are common to everybody, and needs to talk to all VLANs, like Routers, DNS Servers, NTP Servers, DHCP Servers, and many others!

You can verify your configuration using the "show vlan" command. The info regarding PVLANs will be at the end of the output of this command.

A good advice from the IPExpert Video is that the current IOS on the LAB (12.2.25) doesn´t allow us to use switchport port-security commands and private-vlans at the same port at the same time! Once it hits a newer version (12.2.40) (that can happen anyday Cisco wants) we´ll be able to do that!

Ok! But... do you know that 3550 doesn´t support PVLANs?! Yep.., me neither! They´ve a feature named Switchport Protected for that, it´s really simple, and for example, if we have 15 devices in a vlan, but, only two of them are protected (with the interface command switchport protected), they can talk to everybody else, but not to each other!

So one protected device will not talk to other protected device! It works just like an isolated vlan. No unicast, multicasts, broadcasts between protected ports!

Not that difficult, right?!

CCIE Lab Changes! Bye bye UniversCD! Hello Cisco Documentation

2008-08-24T20:44:00.001-03:00

Just saw it on the internet! It seens that after Sep 24 2008 no one will be able to use the www.cisco.com/univercd as documentation reference! As far as the announcement goes it´ll be replaced by Cisco Documentation, but so far, no links were posted!

I think they´ll be using their "new layout", but, until Cisco´s officially announce the new start page for the documentation we can´t be sure about anything!

Just have that in mind if you´ll have your lab soon!

-----

CCIE labs changing from UniversCD to Cisco Documentation

22 AUG 2008: On Sept 24 2008 CCIE labs will no longer support using the UniversCD documentation for the lab exam.

All labs are migrating to Cisco Documentation only. For those scheduled to take the CCIE lab prior to Sept 24 access will still be available for UniversCD.

The Cisco Documentation pages have the same information that currently resides on UniversCD, please refer to the links on the CCIE web pages to view these pages and become familiar with the new format.

After Sept 24 2008 only the Cisco Documentation web pages will be available for CCIE labs.

-----

Here follows the link to this information at Cisco´s Website:

http://www.cisco.com/web/learning/le3/ccie/rs/index.html

VACL, VLAN Maps & MAC ACL

2008-08-23T12:59:00.001-03:00

A while back, more specific in July/14 we talked briefly about VACLs. That was when I took the IPExpert Volume 1 - Section 2: Quad Catalyst (PVST+) Switch Configuration. It´s not a very difficult task to be achieved, but TRICKY!

A friend from India (yeah Vipul, it´s you buddy!) asked me some things about it. So I´ll just elaborate it a while more. Also, at IPExpert CCIE R&S BLS you´ll find more info regarding that in the Security Section. It´s really well explained there! I would take sometime and review it with attention. The first time I watched it, I was like moving back and forward all the time to take notes, and to really stick the info in my head!

So, starting with the basics... In a L2/L3 switch (like the ones in the CCIE Lab), where we can implement security?! Well, we can do it at the:

Port Level - We can implement an Access-List in a particular port, and that will affect the traffic coming and going out of it (normally, it´ll affect only one host traffic). But imagine to implement that solution in many ports, over several equipment. Not very nice, right?!
SVI - We can also implement an Access-List at the SVI Port! It´ll work everytime your switch is routing traffic between this particular VLAN and some other! Essentially, it´ll filter the traffic passing through the SVI.

Ok! So... Port-Level filters only that particular port.... SVI the routed traffic... and how about the INTRA-VLAN Traffic?! None of them will filter that!

VLAN Access-Lists (or VACL) works exactly there! At the Intra-VLAN Traffic! So everytime you need to filter internal traffic for a particular VLAN, VACL is your choice!

Just a couple more things to have in mind before getting into an example.

IP Packets can only be processed by IP Access-Lists;
Non-IP Packets like ARP, MAC-Addresses, and others can only be processed by MAC Access-Lists.

The MAC Access-Lists will bring all the interesting issues to the table... just check it out!

Let´s suppose for example you have two computers one with MAC Address 000b.dc24.ca47 and the second with the MAC Address 000b.dc25.cb51, both connected to VLAN7, and you want to allow all "non-IP" frames sourced from those two MAC Addresses to be forward anywhere, and also allowing only ICMP for example, denying everything else!

So, we have two different requirements there...

Forward all "non-IP" frames sourced from those two specific MAC Addresses; That requires a MAC Access-List.
Permit only ICMP, denying everyting else. That requires an IP Access-List (the one we´re all used to).

Ok, so let´s create our MAC Access-List:

mac access-list extended AllowThose
permit 000b.dc24.ca47 any
permit 000b.dc25.cb51 any

That will handle the first requirement.

Now the second one IP Access-List allowing ICMP and denying everything else:

access-list 101 permit icmp any any

Ok! Now, we need to create the VACL (or VLAN Maps, which one you preffer to call it) applying those rules:

vlan access-map Filter-VL7 10
action forward
match mac address AllowThose
!
vlan access-map Filter-VL7 20
action forward
match ip address 101
!
vlan access-map Filter-VL7 30
action drop

Now it looks ok, right?! Time to apply it to VLAN7 ?! What do you think about?! Let´s try?!

vlan filter Filter-VL7 vlan-list 7

Now testing! See if you can ping! Not working?! Hmmm... interesting... but why?! Well... I told... The MAC Access-List would bring all the interesting issues to the table! And, in fact, it did! It´s allowing only those two MAC Address and nothing else! How about ARP?! Do we need it to make things work?! Of course we do! And that´s where we have most confusion! Just keep in mind, the end of an Access-List is always deny any any! So if there are no matching instances for ARP in the MAC Access-List, it´ll be dropped!

How to fix it?! Simple, allow it in the MAC Access-List:

permit any any 0x0806 0x0000
permit any any lsap 0xAAAA 0x0000

But wait a minute! What´s that 0x0806 and lsap 0xAAAA ?! That´s the Ethertypes we´re allowing in our MAC Access-List, first one (0x806) is ARP, and the second one (lsap 0xAAAA) is PVST+. You do not want your switch running unprotected from loops right?! So it´s better to allow it!

For the sake of simplicity, the full configuration would be this one:

mac access-list extended AllowThose
permit 000b.dc24.ca47 any
permit 000b.dc25.cb51 any
permit any any 0x0806 0x0000
permit any any lsap 0xAAAA 0x0000
!
access-list 101 permit icmp any any
!
vlan access-map Filter-VL7 10
action forward
match mac address AllowThose
!
vlan access-map Filter-VL7 20
action forward
match ip address 101
!
vlan access-map Filter-VL7 30
action drop
!
vlan filter Filter-VL7 vlan-list 7

The most common Ethertypes are: (and probably the ones asked in the LAB)

0x0806 = ARP
lsap 0xAAAA = PVST+
0x4242 = STP and PVST
0x86DD = IPv6

Again... we need to understand all the little pieces involved in a particular task, and remember about the basics, OSI Model, ARP, and so on! It´s not difficult, but it´s a little confusing at the first time! Just go ahead, drink some watter (I did it several times) come back again, read over, and try some scenarios yourself, don´t have equipment?! Try it on Notepad, just try some, compare with the example, and you´ll see how easy it can be! The best way to learn is trying it yourself! ;)

You can also find a nice explanation about that in the wonderful Arden Packeer´s Blog, just click here and it´ll direct you to the post.

Mike Down departure...

2008-08-21T21:38:00.001-03:00

I´m kind of sad today... Mr. Mike Down just left IPExpert! He was a CCIE Training Advisor, and for the last couple months he was working closely with us "bloggers"!

I still remember the very first messages we exchanged, very nice guy! Full of energy and always with the best intentions!

No matter to were have you left man, consider me a friend, a partner, a brother, a family! You´re the MAN! :D

I just ask you to not disappear! Just let us know about your new email/skype id as soon as you set it!

Oh yeah, if you want to set a statement or something it´ll be a pleasure to have it done here in my small blog!

Also, if you ever need anything, just let me know brother, it´ll be a pleasure!

All the best and lucky on your new jorney! Hope to hear from you soon!

Cheers!

You can check the Original Post on Mike´s Blog by Clicking here

Yahoo! talking about CCIE Training?! Yeah! That´s true! So cool!

2008-08-21T14:12:00.001-03:00

I was just surfing the internet, like I usually do, and take a look on what I´ve found at Yahoo! website:

-----

CHINA, Mich., Aug. 21 /PRNewswire/ -- Less than 20,000 individuals worldwide currently hold the CCIE (Cisco Certified Internetworking Expert) certification, which places them among the elite computer networking experts anywhere. This distinction also demands a six-figure annual salary in America, according to recent national surveys.

To become CCIE-certified, an engineer must pass a grueling 8-hour-long hands-on "lab" exam conducted by Cisco (http://www.cisco.com), the global leader in computer network solutions. IPexpert (http://www.ipexpert.com) is a primary training organization, focused solely on preparing seasoned computer network engineers for the coveted CCIE certification exams, through various learning solutions.

-----

So cool! That just show how hard work + a great product makes all the difference! How many times Yahoo! have talked about any CCIE Training Company?! Congratulations to everybody that puts it´s efforts to help us to achieve the CCIE Certification!

That´s also good for us CCIE Candidates or CCIE´s around the world, companies will know how hard it is to achieve the CCIE Certification, and respect it more than they actually do! :)

Hope things stay hot as they are last couple months! :)

You can read the full text at Yahoo! by clicking here.

RIP

2008-08-20T20:39:00.001-03:00

Continuing on IPExpert CCIE R&S BLS Video-on-Demand, by the way, very cool videos, tons of tips! So, today I choose to check RIP. For two particular reasons... First it´s pretty easy to understand, and we´re all facing it since CCNA days, and even with new features and tricks in the video, we´re probably able to get it fast, and second, I´m with a terrible headache, so I need something simple today! :D In fact, after finishing the video, my headache was over, maybe I was too stressed or something and that relieved me! Cool! Another good useful use to the BLS, everytime you´re stressed, just jump in, watch a couple videos, and you´ll feel more relaxed! lol! ;)

In fact, the lab exam only cares about have RIP version 2, so, keep in mind that, everytime they ask you to configure it, use the version 2, like this:

router rip
version 2
no auto-summary

RIP is the simplest Routing Protocol we´re going to face in the exam (ODR doesn´t count!), and probably, just in the exam... Have anybody checked any RIP networks?! I haven´t so far!

There aren´t much things to play around, but, one of them are timers. If we ever need to change it, the "timers basic" command comes to the rescue! Also, there´s no rule saying that everybody needs to have the same timers, unlike OSPF, there are no "peering" in RIP, it´s only sending routes out, so timers will not have the same effect as it does in other Routing Protocols!

Of course, it´s a good idea to set everybody the same timers (or at least close to it) to avoid routes going occasionally inaccessible for no particular reason!

The default RIP Timers are:

Update - 30 seconds;
Invalid - 180 seconds;
Hold - 180 seconds;
Flush - 240 seconds.

That means you can get up to 4 minutes to make a route go away! That´s a lot of time! :)

Oh yeah... everytime you change the timers at RIP, you can check it with the "show ip protocol" command! For example:

router rip
timers basic 5 15 15 30

That set´s the Update to 5 seconds, Invalid to 15, Hold to 15 and Flush to 30! Keep in mind that the HOLD Timer is "Cisco Proprietary" so if they ever ask you to get rid of it, set it´s timer to 0 and you´re good!

Another good one is the "neighbor" command, it changes the routing updates from broadcast to unicast packets. As we don´t have peering with RIP, we do not need to do it on both sides! It´s useful for non-broadcast links such as Frame-relay. Example:

router rip
neighbor 172.17.155.15

Also, we can use the "passive-interface" command with it, otherwise, the router at the other end of the link will receive the "Unicast" information plus the "Broadcast" information, and that´s kind of odd thing! Just do it, otherwise, if you feel in doubt, just go ahead and ask the proctor for clarification, asking questions to the proctor is always a good thing to do, and keeps you in the safe side!

Offset list, which is an aditive to an metric, like if you receive routes with values 1, 2, 3, and you want that to show up in your rounting table as 4, 5, 6, you simple do an offset list of 3! So it´s going to add it to the routes as it comes in! Unfortunatelly there are no negative values! It´s used with access-list that will actually tells which routes to be affected!

router rip
offset-list 21 out 10

That will take the routes in access-list 21, and add a metric of 10 to the outgoing metric. (to incoming metrics use "offset-list 21 in 10" for example).

The "ip rip triggered" command only works on point-to-point links. It´ll make RIP "behave" more like Link State Protocols. It´ll only send updates something when it actually changes! Enabling it or disabling is pretty straight-forward, and I would actually use it if I was asked in the LAB, no where else!

To enable RIP authentication we use the command "ip rip authentication key-chain <name-of-chain>" it´s done on per interface basis, BUT... for that happen, you need to configure the key-chain first, and maybe some of you have never done that before (I haven´t), not difficult, but, we need to keep somethings in mind, check this example configuration:

interface Fastethernet 0/0
ip rip authentication key-chain trees
ip rip authentication mode md5
exit
!
router rip
network 172.19.0.0
version 2
exit
!
key chain trees
key 1
key-string chestnut
accept-lifetime 00:00:00 Aug 20 2008 23:59:59 Aug 20 2009
send-lifetime 06:00:00 Aug 20 2008 18:00:00 Aug 20 2009
exit

After you can issue a "show key chain" command to check if everything is ok, and apply it to RIP.

Keep in mind to use the accept-lifetime and send-lifetime command under IOS 12.4, otherwise, it´ll not work!

Follows two useful documents regarding RIP Authentication at Cisco´s Website:

http://www.cisco.com/en/US/docs/ios/iproute/configuration/guide/irp_ip_prot_indep.html#wp1056961

http://www.cisco.com/en/US/docs/ios/iproute/configuration/guide/irp_ip_prot_indep.html#wp1057700

The "ip summary-address rip <summary-address>" command is also used on a per interface basis. And guess what it does?! :)

So, to finish, RIP works only on metrics, values of 1 to 15 and if there´s a tie between to routes, the first route advertised wins. There are no external or internal routes, everything is pretty much the same!

Oh yeah! If you issue a "network 0.0.0.0" it´ll add every active IP interface in the RIP Routing proccess!

You can find more on IPExpert CCIE R&S BLS Video-on-Demand and also, follows a good document for RIP at Cisco´s Website:

http://www.cisco.com/en/US/docs/ios/iproute/command/reference/irp_rip.html

CCIE Command Memorizer?!

2008-08-19T21:35:00.001-03:00

It looks that I´ve a lot of doubts today!

I know Ethan asked already in his blog a while ago... But does anyone have tried the CCIE Command Memorizer ?!

It looks a pretty nice tool to use on the road, at the office, when you have no real equipment or computer power and time to run Dynamips!

It seens pretty cool! I´m thinking in buying it, but not now, maybe in a couple months! Just wonder to see if anyone have tried, and what do you think about it!

Cheers!

Web Hosting?! Is it better?!

2008-08-19T17:32:00.001-03:00

Does anybody knows or uses any kind of Web Hosting Service?! It really worth?! I mean... Blogspot is nice and everything else, but, sometimes I would like to have more "flexibility" to the posts, and I think a Web Hosting would fit that need!

I know Ethan uses some kind of service like that, just cannot say which type or even, which provider.

Anybody can recommend me a good one?!

I saw the Dream Host Web Service, seens nice, lots of features, and not too expensive. Blue Host is not an option, I had some issues trying to log in, so I´ll not consider it!

Oh yeah... those services works with Windows Live Writer?!

Moving to a Web Hosting means moving away from Blogspot, and start with Wordpress... is it better?! What´s your opinion?!

Or should I stay with Blogspot and that´s it?! I´m a bit confused right now!? Even more with the latest facts that happened this week in the CCIE Training World... Let´s see what will happen (I´m waiting)!

Any help would be appreciated!

Thanks!

CCIE without Experience

2008-08-18T17:28:00.001-03:00

A nice topic from Sadikhov Forums, CCIE without experience...

I agree in some parts and not that much in others... I think there are guys, 19, 20 year old who are facing the LAB with a knife in their teeth! If they´re studying, working on Dynamips or real equipment, following a structured approach from any vendor, and things like that, if this kind of guy passes the LAB exam, he will lack some field experience, I agree, but he knows his stuff already!!!! This is the type of guy I would like to work for me, dedication is priceless!

On the other hand, a very experienced engineer, that takes the "easy" way out, this is the kind of guy who needs to be banished from the business! We all here have a friend, who knows a guy, who did this in the easy way and ACED the exam with a 1000/1000! WoW! What a nice score! Yeah... tell me about it! I doubt this type guy can answer 3 basic questions right! Not saying that take 1000/1000 is impossible, not at all! It´s possible, and how much it is! Questions are not that hard in the CCxP field, they´re a bit tricky, but, if you study well, and understand what is being asked you can do it easily! Otherwise, a guy that take a CCxP certification in 2, 3 months, that´s the one I doubt! He must be a genious, have A LOT of experience, know the stuff already, or well... you know! Any of these options would work, but only the first 3 are valid! Cheating is not cool! Not cool at all!

So, to conclude... in my opinion it doesn´t matter how old the guy is or if he has field experience or not, if he did the right way, sweating blood, studying, missing parties, and everything like that he deserves respect! Otherwise... I would ask him 3 questions (no I´m not a genious, but most guys can´t answer really basic questions) to check his accuracy! ;)

That´s it! Any thoughts, opinions?!

You can read the full Sadikhov Topic clicking here

General Routing Overview

2008-08-16T12:43:00.001-03:00

Finally I´m back at home, things are getting better, these cool pills they gave me will probably end next week (those little things are really getting me down, you have no idea of how much I´ve been sleeping last couple days because of it, I look like one of my cats now!) But that´s ok! :)

Well... today besides some house keeping and a little shopping at the supermarket, I was able to rest a while more, and watch the General Routing Video-on-Demand from IPExpert CCIE R&S Blended Learning Solutions.

Very informative. Everytime you see a guy saying: Ah... I don´t need general or basic concepts, I do know it already... well... ok, he may know his stuff really good, but you can ALWAYS learn a new trick, or finally put an end to that doubt that´s bothering you for so many years!

And of course! Those videos are the real concept of " State of Art" Class on Demand!

Enough on that... let´s get into the part that really pays for the product, the technical details...

The Network Command:

It starts with our friend the network command... As we all learned back in the CCNA days (on the CCNP, specially in the OSPF part of it, we start change our mind) the network command is used to advertise networks... we can´t say that´s incorrect, but there´s not the full true either! The network command actually enables an interface to participate in the Routing Protocol, thus this interface will advertise it´s network, and the Routing Protocol brings it to the RIB.

Check the example (exactly the same one on the video):

- F0/0 IP Address: 10.1.1.1/24

network 10.0.0.0 0.255.255.255
network 10.1.0.0 0.0.255.255
network 10.1.1.0 0.0.0.255
network 10.1.1.1 0.0.0.0

Regarding only this interface F0/0, no matter which of the above network statements you choose, they all do the same thing! It´ll bring the F0/0 (10.1.1.1) interface into the Routing Protocol. The network command only tells which interface will be participating in the Routing Protocol, not how the network is going to be advertised, advertising actually is a secondary reaction of it!

Secondary Address:

Also, there is a really nice explanation on the video about Secondary Addresses! Follows some concepts learned from it:

You can´t just advertise the secondary address, you need to advertise the primary first, than, the secondary if you want to. Also you can´t do passive-interface on your primary address and still send things out with your secondary address! A general rule for that is: when you send any packet out of an interface (keep in mind that routing updates are packets too) ALWAYS the source IP Address for that packest will be the Primary IP Address of that interface!

Check this example for RIP (it works for EIGRP too):

Ok, so, everyone is on the same ethernet segment... and everyone will hear about each others Broadcast and Multicast packets which is good in our scenario. When R3 sends Routing Updates to R2, R1 will listen to this too, but it´ll treat it as invalid, because, it´s not on the same subnet as R3. The same happens when R1 sends it´s Routing Updates to R2.

So... how to make this happen?! Hmmm... R2 has both networks, so if we disable the split-horizon in it´s F0/0 we´re good?! Not exact like that... Remember... R2 Packets will ALWAYS use the Primary Address (in this case 10.1.1.2) as the source, so R3 will still having problems, it works for R1, but not for R3.

The solution would be (in this particular RIP example) to use the no validate-update-source command under the Router RIP, that will tell your router to not validate the source IP Address of the routing updates when they´re received, just allow they to come in! So, to solve the problem, we can do that on both R1 and R3 of the example. Other solution would be disable split-horizon on R2 and use the no validate-update-source under Router RIP of R3, that work as well, but, doesn´t look "clean" if you know what I mean! ;)

That basically says "I don´t care from who you learned, go ahead and allowed it to come in!"

IP Unnumbered:

Another topic brought up on this video regards IP Unnumbered!

The IP unnumbered interface configuration allows you to enable IP processing on an interface without assigning it an explicit IP Address. The IP unnumbered interface can "borrow" the IP Address from another interface that is already configured on the local Router, or Layer 3 equipment, thereby conserving network and address space.

Check out this topology:

So how can we get this topology to work?! One side of the link is 10.1.1.0/24, the other end is using 11.1.1.0/24... How can that work?! Well... if you´re allowed to use PPP we´re good! PPP has a feature called "peer neighbor-route", that will get the exact IP Address of the router on the other end of the link, and show it as connected in our local router!

Take a look at the Routing Table with this setup:

R1(config-if)#do sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS,su- IS-IS summary,L1-IS-IS level-1,L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Loopback0
     11.0.0.0/32 is subnetted, 1 subnets
C       11.1.1.2 is directly connected, Serial0/0

R2(config-if)#do sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS,su- IS-IS summary,L1-IS-IS level-1,L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     10.0.0.0/32 is subnetted, 1 subnets
C       10.1.1.1 is directly connected, Serial0/0
     11.0.0.0/24 is subnetted, 1 subnets
C       11.1.1.0 is directly connected, Loopback0

Of course, we may not be able to use PPP over this link, they may ask for GRE Tunnels or something else, if so, another solution that meets their requirements would need to be implemented, like static routes or something like that!

Administrative Distance:

I thought I knew almost everything about Administrative Distance... again... I was wrong... the Master Jedis showed me once again, that, there´s ALWAYS something to learn.

Lets check some examples, like RIP and OSPF (the ones in the video) :

If you want to change the administrative distance for RIP, you´ll just change it for RIP at all, I mean, there´s no internal, external routes or anything else in it! So you just change the Administrative Distance for RIP. Example:

router RIP
distance 140

After that, all RIP learned routes in the Routing Table will have the Administrative Distance of 140!

Things get a little more complicated with OSPF... In OSPF we have intra-area, inter-area and external routes! Check this example:

router OSPF 1
distance ospf intra-area 110 inter-area 110 external 80

So, what that means, External Routes in OSPF will be preferred over Intra-Area routes?! Hmmm... not so fast buddy! That command does NOT change how the OSPF makes it´s decisions! It´ll always preffer intra-area routes first, than inter-area routes, and just after that the external routes!

The command only says if an external LSA wins the OSPF RIB election, than give it the administrative distance of 80, so it will be preferred over EIGRP for example! But, if it doesn´t win the election, if you get the same route announced internally from OSPF, the internal one will be used with the administrative distance of 110 and that´s it! The distance command only works if the routes gets handled to the Routing Table, that´s the order of operation!

As said earlier, it´ll NOT affect HOW OSPF makes it´s decisions!

Cool, isn´t it?! :)

Now, to manipulate distance for specific routes, we first need to create an access-list with the routes you want to change the Administrative Distance, the diagram bellow will give you all the reference you need specially for OSPF:

Or... instead of that, you can use 0.0.0.0 255.255.255.255 and that will tell the router to really don´t care from who it learned the route from, just change the Administrative Distance on it!

So, the command now will look like:

router ospf 1
distance 190 0.0.0.0 255.255.255.255 20

Much easier, don´t you think?!

ODR:

On Demand Routing, or ODR, it´s normally used in the Frame-Relay HUB Router. It is a feature that provides IP Routing for Stub Sites, with minimum overhead!

ODR uses CDP (Cisco Discovery Protocol) to carry the "routing" information between the hub and stub routers. The stub routers send IP Prefixes to the hub router via CDP, and the hub router will send a default-route to the stub also, via CDP. Oh yeah, almost forgot, ODR supports VLSM!

It is a nice solution to be used in a HUB and Spoke topology, if your Spoke is also a Stub Router.

The only thing you need to do is: start the ODR proccess in the HUB Router, nothing else, considering that your network is already configured. The command to achieve this is: router odr.

Don´t forget...ODR uses CDP, so in our frame-relay example, we´ll need to allow broadcasts in the map statements, and also, enable CDP in the frame-relay interface (you can check in CDP is already enabled or not with the command show cdp interface, if it is not you can enable it with the command cdp enable).

So what will happen now?! The HUB Router will send a default-route to the Spoke (that will set up the gateway of last resort to the ODR hub router), and the Spoke will send it´s IP Prefixes to the HUB Router, check the diagram below, you´ll get the idea:

Check the Routing Table for R1 (HUB) and R2 (Spoke):

R1(config-router)#do sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS,su- IS-IS summary,L1-IS-IS level-1,L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     15.0.0.0/24 is subnetted, 1 subnets
o       15.5.5.0 [160/1] via 10.1.1.2, 00:00:20, Serial1/0
     16.0.0.0/24 is subnetted, 1 subnets
o       16.6.6.0 [160/1] via 10.1.1.2, 00:00:18, Serial1/0
     17.0.0.0/24 is subnetted, 1 subnets
o       17.7.7.0 [160/1] via 10.1.1.2, 00:00:18, Serial1/0
     18.0.0.0/24 is subnetted, 1 subnets
o       18.8.8.0 [160/1] via 10.1.1.2, 00:00:18, Serial1/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Serial1/0
     11.0.0.0/24 is subnetted, 1 subnets
C       11.1.1.0 is directly connected, Loopback0
     12.0.0.0/24 is subnetted, 1 subnets
C       12.2.2.0 is directly connected, Loopback1
     13.0.0.0/24 is subnetted, 1 subnets
C       13.3.3.0 is directly connected, Loopback2
     14.0.0.0/24 is subnetted, 1 subnets
C       14.4.4.0 is directly connected, Loopback3

R2(config-if)#do sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS,su- IS-IS summary,L1-IS-IS level-1,L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

     17.0.0.0/24 is subnetted, 1 subnets
C       17.7.7.0 is directly connected, Loopback2
     16.0.0.0/24 is subnetted, 1 subnets
C       16.6.6.0 is directly connected, Loopback1
     18.0.0.0/24 is subnetted, 1 subnets
C       18.8.8.0 is directly connected, Loopback3
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Serial1/0
     15.0.0.0/24 is subnetted, 1 subnets
C       15.5.5.0 is directly connected, Loopback0
o*   0.0.0.0/0 [160/1] via 10.1.1.1, 00:00:16, Serial1/0

Also, keep in mind that as soon as you enable any other Routing Protocol in the Spoke, that ceases to work. The Spoke will still learne the 0.0.0.0/0 default-route, but it´ll no longer send up to the HUB any detailed information about it´s networks, that will be done by the Routing Protocol if you configure it to do so!

So, to summarize:

HUB --> Spoke = 0.0.0.0/0
Spoke --> HUB = advertise it´s connected networks.

One more piece of advice... this may be a way to get a default-route without using any static route or default-information originate in the exam!

You can find more information about ODR either on IPExpert CCIE R&S Blended Learning Solutions or in Cisco´s Website, the following link is a good start:

http://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a0080093fde.shtml#t7

Last thing... those Videos from IPExpert ROCKS man! If you´re following my posts till now, you now that already! It really looks like I´m attending a "on-site" bootcamp! I´m loving it!

ARP, RARP, Proxy ARP, Gratuitous ARP and IP Redirect

2008-08-14T17:29:00.001-03:00

Well... after a while away from my computer (in fact, away from any computer) due to some medical issues I´m back! Don´t worry, nothing bad, it was scheduled already, and I had the company of my wife, and guess who?! Yeah! Him! Mr. Jeff Doyle, not in person, but in his book version!

Books like TCP/IP Vol. 1 and 2 MUST be read from cover to cover! Always a good thing to learn!

Some of you may think, ARP, too basic... Yeah, I think too, but there were more than 10, 20 times that people who were supposed to know this asked me HOW it works... so here (with mr. Doyle´s help) you´ll find ARP some variations of it.

ARP

Address Resolution Protocol (ARP) is used to map a known IP Address to a unkown data-link identifier (for example MAC Address). The ARP Request will contain:

Source IPv4 Address;
Source data-link identifier address (MAC Address for example);
Destination IPv4 Address;
Destination data-link identifier (MAC Address in our example) will be set to 00:00:00:00:00:00.

Check this ARP Request capture:

Ethernet II, Src: 00:30:b8:83:cb:40, Dst: ff:ff:ff:ff:ff:ff
    Destination: ff:ff:ff:ff:ff:ff (Broadcast)
    Source: 00:30:b8:83:cb:40 (00:30:b8:83:cb:40 )
    Type: ARP (0x0806)
    Trailer: FFE000200020003035800000FFE000100030               Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: 00:30:b8:83:cb:40 (00:30:b8:83:cb:40)
    Sender IP address: 201.6.115.1 (201.6.115.1)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 201.6.115.254 (201.6.115.254)

By default Cisco Routers holds the ARP entries for 4 hours. You can change this value per interface basis with the command: arp timeout <value in seconds>. Example:

interface fastethernet 0/0
arp timeout 3600

RARP

RARP is the opposite of ARP, it maps an IPv4 Address to a know MAC Address, for example, old workstations (dumb terminals) could have it´s firmware programmed to send a RARP request as soon as it was powered up, and a RARP Server would answer this RARP request with the workstation´s IP Address (Airline Companies used it ALOT in the past). Hmmm.. looks like DHCP right?! Yeah.. it looks, but it ISN´T ok?! ;)

RARP Request will contain:

Source and Destination data-link identifier (MAC Address in this example) will be the local host MAC Address;
Source and Destination IP Address will be set to 0.0.0.0.

Check this example capture of a RARP Traffic:

Ethernet II, Src: Marquett_12:dd:88, Dst: ff:ff:ff:ff:ff:ff
    Destination: ff:ff:ff:ff:ff:ff (Broadcast)
    Source: Marquett_12:dd:88 (00:00:a1:12:dd:88)
    Type: ARP (0x0806)
    Trailer: FFE000200020003035800000FFE000100030               Address Resolution Protocol (reverse request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: reverse request (0x0003)
    Sender MAC address: Marquett_12:dd:88 (00:00:a1:12:dd:88)
    Sender IP address: 0.0.0.0 (0.0.0.0)
    Target MAC address: Marquett_12:dd:88 (00:00:a1:12:dd:88)
    Target IP address: 0.0.0.0 (0.0.0.0)

---> EXAMPLE TOOK FROM Wireshark Wiki <---

Proxy ARP

A Proxy ARP enabled Router answers ARP requests intended for another machine, it does that by making the local host believe that the Router is the "owner" of that IP Address, local host will forward the traffic to the Router and the Router will be responsible to "route" the packets to the real destination.

For example, a Host in Subnet A wants to send traffic to Host in Subnet B, Host A and Host B are in the same subnet, but in different broadcast domains. Host A will send an ARP Request with Host B IP Address, the Router connected to both subnets will answer to Host A request using it´s own MAC Address instead of Host B MAC Address.

Now when Host A wants to transmit traffic to Host B, it´ll send to the Router MAC Address and the Router will just forward the traffic to Host B. That´s why "Proxy ARP".

It´s used on networks where the hosts are not configured with a default-gateway.

Oh yeah... it´s enabled by default in the Cisco IOS, and you can disable it on a per-interface basis with the command: no ip proxy- arp

Gratuitous ARP

In some circunstances a Host (Router, Switch, Computer, etc) might send an ARP Request with it´s own address as the target address... But, to his own address?! Why a host would do that!?

Well... there are some reasons... for example:

It´s use to update other devices ARP Table (when a device receives an ARP Request with an IP that it´s already in it´s cache, the cache will be updated with the new information;
HSRP Routers that takes over the control will send Gratuitous ARP out the network to update the cache table of other devices ;
To check for duplicate addresses (if the host receives a response, it´ll know that somebody is using the same IP Address).

You can check this Gratuitous ARP traffic captured with Wireshark (the best opensource sniffer out there):

Ethernet II, Src: 02:02:02:02:02:02, Dst: ff:ff:ff:ff:ff:ff
    Destination: ff:ff:ff:ff:ff:ff (Broadcast)
    Source: 02:02:02:02:02:02 (02:02:02:02:02:02)
    Type: ARP (0x0806)
    Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (request/gratuitous ARP)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: 02:02:02:02:02:02 (02:02:02:02:02:02)
    Sender IP address: 192.168.1.1 (192.168.1.1)
    Target MAC address: ff:ff:ff:ff:ff:ff (Broadcast)
    Target IP address: 192.168.1.1 (192.168.1.1)

---> EXAMPLE TOOK FROM Wireshark Wiki <---

IP Redirect:

IP Redirect is used by routers to notify hosts of another router on the data link that should be used for a particular destination.

For example, Router A and Router B are connected to the same Ethernet Segment, so as Host C. Host C has Router A set as default-gateway, Host C will send the packets to Router A, and Router A sees that the destination address of the packet is reachable via Router B, so Router A must forward the packets out the same interface it has received to Router B. Router A does that, and also, sends an ICMP Redirect to Host C informing to use Router B to reach this particular destination next time.

IP Redirect is enable by default in IOS Routers and can be disabled on a per interface basis with the command: no ip redirects.

That´s it! I´ll lie down a while, my head is a little fuzzy right now!

CCIE FLYER.COM - Great Resource for CCIE´s!

2008-08-08T17:00:00.001-03:00

That´s interesting! For the last couple months I´ve been receiving the CCIE FLYER from the greatest (if not the only) CCIE AGENT , Mr. Emmanuel "Eman" Conde. He was conducting the CCIE Salary Survey some time ago (you can see this post here in the Blog), and helping many, many companies and CCIEs around the world!

I´ve exchanged a couple emails with him, but due to my calendar I wasn´t able to talk to Eman yet, this is one thing I´ll try to fix ASAP! He seens to be a very nice guy, and I can´t wait to get to know him better!

Check this post from Mike Down:

----

Hey everyone! So, I have been chatting with the ever famous "CCIE AGENT" Emmanual "Eman" Conde over the past several weeks and he mentioned his CCIE FLYER that he has been putting out. Eman also just released the CCIE Salary Survey which you probably have seen on many other blogs. I surfed on over to www.ccieflyer.com to check it out.

Eman has developed a way to keep his clients updated on his activities while still dispensing advice about some of their career and professional concerns. His third issue of the CCIE Flyer is devoted to the economy. The September issue has the perspective of 3 educators from grade school through university level. In this issue he will be reviewing training companies and sharing his findings with his readers. Yes, this does include IPexpert.

Eman stops by IPexpert next week, which he will be meeting up with IPexpert Vice President Matt Brooks and IPexpert Instructors Vik Mahli and Jared Scrivener, along with dozens of aspirin CCIE's who will be attending class at our San Jose, California location.

So, shoot over to CCIEFLYER and check it out! Bookmark it! It is a monthly update with tons of great articles!!!

----

Fantastic news to the CCIE Community!

Getting ready for my Vacations

2008-08-08T09:07:00.001-03:00

Well... My vacations will start next monday! I´ll have some time to do what I want and need to do! Rest a while and Study a LOT!

I´ll be at home for 20 days (sweet!), and during this time I want to finish watching IPExpert Video-on-Demand, and complete at least until IPExpert Workbook Vol. 1 Lab 10. No need to rush, if I can get this done, great, otherwise, I preffer to slow down a little to REALLY understand things than to speed up just to say to everybody: "Yeah, look at me! I can do many labs, tasks, I´m the man!", that´s just not me! I don´t care if I´m giving baby steps, but at least I´m sticking the information in my head, and this new stuff I´ve learned while studying for CCIE Exam are already helping me out in my work!

That´s why work has been so hard last couple weeks, I´m finishing everything I´ve pending on my desk, so I can enjoy my free days without any interruption!

The beginning of next week (Monday, Tuesday, Wednesday) will be a little complicated to me, so don´t expect to see me online, or too much blog notes, I´ll not have time to that! Have some personal stuff to take care off! In fact, I´ll not be able to touch a computer, but, I´ll be able to read books... TCP/IP Vol. 1 will be my best friend during this time.

At thursday I think I´ll be able to get back "online" and watch some Videos, Blog, and start my study regimen the way I want!Study during day, take wife out at night, enjoy the time with my cats, relax, study a while more, sleep, just the life any CCIE Candidate wants! lol! :D

That´s it guys! Hope everyone is enjoying the studies as much as I am! :)

Cheers!

IPExpert + Narbik Bootcamps for $4000.00 ?!

2008-08-07T08:17:00.001-03:00

This morning I was checking my emails, and received the latest IPExpert Newsletter, great news inside, but this one particularly called my attention:

Attend IPexpert's CCIE R&S Boot Camp -AND- Narbik's Boot Camp for ONLY $4000 (limited availability)

----

Here comes another unique opportunity...

During the week of August 25, Australia's own Jared Scrivener will be conducting IPExpert's CCIE R&S 5-Day Boot Camp in Sydney.
One month later, Narbik Kocharians will deliver his CCIE R&S 5-Day Boot Camp during the week of September 29.

You can attend BOTH of these courses for only $4000 - TOTAL. Now, think of this amazing opportunity...

Spend the first week with Jared in our industry-recognized Boot Camp.
Spend three weeks of continued preparation while also exploring Australia (additional costs, of course).
Spend week 5 with Narbik rounding out your preparation.
Pass your lab exam at Cisco's testing facility in Sydney and return home as a CCIE (hopefully!).

Give yourself six weeks to change your life. Think of the experiences you will have for so little cost.

----

I just wonder WHY don´t I live in Australia?! :)

Also, IPExpert just released the CCIE R&S Power Pack, that includes IPExpert CCIE R&S Blended Learning Solutions + CCIE R&S Technology Focused Workbook by Narbik Kocharians + A 10-Session of online rack time for use at Proctor Labs.

And much more! You must check this Newsletter!

--> IPExpert August Newsletter <--

WCCP - Web Cache Communication Protocol

2008-08-05T11:54:00.001-03:00

Following with the notes/reviews from IPExpert CCIE R&S Blended Learning Solutions Video-on-Demand, we´re today presented with WCCP! :)

WCCP is used between Routers, Layer3 Switches and Web-Caches. It´s used to optimize resource utilization, and lower response times, when a user make a web request, for example, that´s the kind of traffic you want to redirect to the Web-Cache, hopefully you (better, your Web-Cache) have some information cached locally and that will decrease the response time.

As far as the exam is concearned, there´s no real Web-Cache on the LAB. Well... at least for now there isn´t! The "goal" would be setup the routers to talk with it, and that´s pretty much what we can be asked to do!

We´ll have no other way to test it than just a few show commands.

To enable your router (or layer 3 device) to talk to the Web-Cache, you need to enable WCCP with the global configuration command:

ip wccp web-cache

After that, we need to choose the traffic to send to the Web-Cache, it can be either the outside interface where requests goes out:

ip wccp web-cache redirect out

OR, the incoming interface as requests comes in:

ip wccp web-cache redirect in

Choose one (not both) that fits the best what was requested in your lab!

Just a few commands to do that, right?! Not too bad! But... which interface is supposed to be configured as "redirect in" and which interface is "redirect out" ?!

It´ll be easier to undesrtand checking the diagram bellow:

If you want to send the traffic coming from users connected in SW1 to the Web-Cache, you need to configure the interface F0/0 as ip wccp web-cache redirect in.

Now, if you want to send the traffic going out S0/0 to the internet, you need to configure the S0/0 as ip wccp web-cache redirect out. Don´t use both (redirect in and redirect out) choose the one that best fits the task requirements.

Remember, the redirect perspective is "router centric", so traffic coming from your network are IN and traffic going out to the internet from your network are OUT, just keeping this in mind, you´ll never have problems to figure which type of redirect to use when configuring WCCP.

Now, if for example, both user traffic to be sent to the Web-Cache, and the Web-Cache itself are connected to the same router interface (for example F0/0) we need to use the command: ip route-cache same-interface, this will "hairpin" the traffic coming from users in this interface to the Web-Cache. Off course, this solution is not the most efficient and it consumes the most resources (CPU, Interface bandwidth, etc), but, keep in mind that CCIE Lab is not graded on performance, it´s graded on achieving the results that the task is asking for!

Again, checking our diagram, if you want to send traffic from users either in F0/0 and F0/1 to the Web-Cache, we can do a ip wccp web-cache redirect in at F0/0 and F0/1 OR we can configure ip wccp web-cache redirect out at S0/0, both will attend the request! Select the best option, and use it!

Also you can apply a "Redirect Filter" (an access-list) filtering just the traffic you want, that is done with some optional parameters in the global configuration command ip wccp web-cache:

ip wccp web-cache redirect-list <ACL#> --> used to select which user traffic to send / not to send to the Web-Cache;

ip wccp web-cache group-list <ACL#> --> used to select which Web-Cache to use;

ip wccp web-cache password <password> --> used to configure a password to authenticate with the Web-Cache.

UDP port 2048 is the port used between the Router and the Web-Cache to communicate, and GRE is the tunnel method used. There´s nothing more to do at the routers than to say YES, I want to talk with the Web-Cache, and HOW to do the redirections, all other configurations goes in the Web-Cache itself.

As far as the CCIE Lab Exam will not include any real Web-Cache, we can only use the command show ip wccp web-cache detail to check some generic information and also if WCCP is enable and which interfaces are participating in the WCCP process!

Some examples:

access-list 10 permit host 10.1.1.1
access-list 10 permit host 10.1.1.2
ip wccp web-cache group-list 10

This will "notify" the router that only IP Addresses 10.1.1.1 and 10.1.1.2 are valid Web-Caches to register with!

Another one:

access-list 110 deny ip any host 200.207.108.2
access-list 110 permit ip any any
!
ip wccp web-cache redirect-list 100
!
interface FastEthernet 0/0
ip wccp web-cache redirect in

This example will configure the router to redirect web-related packets received via interface fastethernet 0/0, destined to any host except 200.207.108.2 to the Web-Cache.

And many others included in the IPExpert Video-on-Demand! You can also check Cisco´s DocCD to find some useful information and examples.

WCCP can be located at Cisco IOS IP Application Services Configuration Guide, Release 12.4

Mike Down - Rack Rental Deal!!!

2008-08-04T13:17:00.001-03:00

That´s interesting! Mike Down -- CCIE Training Advisor at IPExpert -- just "blogged" a nice promotion about rack rentals! You must check it out!!! :)

-----

I will match your purchase of rack sessions at www.proctorlabs.com. What does that mean? You buy 5 sessions, I give you 5 free. You buy 100, you get 100 free (and probably something else too!)

Another little freebie - If you purchase the bundle of 10 or more, I will provide you with the Proctor Labs eBook for FREE! ($199 value) - The Proctor Labs eBook consists of 5 full mock lab scenarios delivered in a .pdf format. So, you purchase the 10 session bundle, you get 20 sessions + the eBook. That is a STEAL...

There stipulations are this...You MUST CONTACT ME DIRECTLY at mdown@proctorlabs.com and in the subject field write I READ YOUR BLOG - I WANT THE DEAL!

This DOES NOT include past purchases. This is for new purchases only.

Don't forget, this will end Friday, August 8, 2008. To take advantage, please email me at MDOWN@PROCTORLABS.COM --

Mike

-> Read the Full Post here <-

-----

What does that mean?! Well, for me it means STOP playing with "NOTEPAD" and "DYNAMIPS" for a while, if you don´t have a rack to play with (like myself), this is really a HUGE deal!

Just a quick thought, if I buy 10 sessions, I get 10 more sessions, that is USD 1.92 / rack hour + you get the eBook for free, depending on how much sessions you order!! No one has this low price!!! :D

I´m in! Free Sessions (when you buy some) + eBook ?! Just show me where do I have to sign?! lol!

Also, if you check, you´ll find that´s not the only promotion at his blog, but there´s also a few other great deals! For example, you can check this one also:

http://mdownipexpert.blogspot.com/2008/02/huge-savings.html

This is AWESOME! CCIE materials are too expensive, promotions like that are always welcome!!!!

I suggest you to keep checking Mike´s blog for upcoming promotions and deals!!! I do it, daily!

L2-Tunnels

2008-08-04T09:50:00.001-03:00

This weekend was a bit more productive than last one! I was able to finish Day 1 of IPExpert CCIE R&S Blended Learning Solutions, plus, I got time to do some reading through Doyle´s TCP/IP Book! That was cool! I just need to keep my notes all together, and made that "understandable" to blog it!

Let´s start with L2-Tunnels, I still having some Switching notes I want to blog about, but, I´ll work a little more on them before it! In the mean time, L2-Tunneling, that was kind of "unknown" topic for me, seens quite simple now, as usual, there are some tricks to be aware about (like looping in our topology) and everything else like that!

Let say you want (or even better, your lab task want) you to have R1 and R2 showing each other as neighbors in CDP, without any action, using our topology above, if I type show cdp neighbors in R1, it´ll show me SW1 as a neighbor, same goes to R2, that will show SW2 as neighbor...

So, how to accomplish?! Using L2-Tunnels. L2-Tunnels are used to get the switches in the middle (in our case SW1 and SW2) to tunnel L2 information and passes it to the other device (R1 and R2), even if we know the normal behavior of a switch is to process CDP, PaGP, STP packets locally, they´ll tunnel it (according to what we actually configure in the switch), and just forward to the other end.

Keep in mind that switch ports cannot be in "dynamic" mode, they must be in "access" or "dot1q-tunnel". Otherwise our L2-Tunnel will not work.

Configuration to complete this task is really straight-forward (those commands apply to both switches SW1 and SW2 edge ports - connected to the routers R1 and R2 in this case):

int f0/5
switchport mode access
switchport access vlan 12
no cdp enable
L2protocol-tunnel cdp

Now, VLAN 12 is "trunked" through switches! All switches in the middle are just "L2 Trunks" that will carry information normally from one side to another.

Another thing to keep in mind is: Multicast (and broadcasts) are flooded to all available ports, so make sure VLAN 12 (in our case) used for carrying L2 Tunnel does not come back to original end switches, because Loopguard will disable ports if so. Use switchport trunk allowed to filter it. This is very important!!!!

If, you want that R1 shows SW1 and R2 as CDP Neighbors, just enable CDP in the switch fastethernet port (cdp enable), and that´s it!

Things are crazy down here

2008-07-31T08:16:00.001-03:00

Man... things are "really" crazy down here! Too many projects to delivery in a short time! I´m actually working on 3 projects right now to replace old switches from customers networks by new 3750 (for Access) and 6509 (Core)!

All three projects are very similar, in fact, I finished the first one yesterday, I´ve created the scripts to be applied, the topology, and a few guidelines for the Field Engineer that´s going over there to actually "implement" the solution.

For sure, I should be prepared to support the Field Engineer for any "unknown" thing that can happen, you know... Like Murphy says, if anything can go wrong, IT WILL GO WRONG! hahahaha! But, I actually don´t believe that much on Murphy laws, so, I expect that everything goes really smoothly! ;)

Today I´ll prepare the second customer´s topology, scripts, and tomorrow the third one! That will consume all my time (including much of my "supposed" free time), so, it´s a little difficult to keep following with my Video-on-Demand regime today! Oh boy, how much I miss it! :) But I still reading my Doyle´s Book (right now almost finishing OSPF and IS-IS).

Also, my vacations are coming soon, so I´ll be able to catch everything up, but, if I really want my vacations, I need to finish everything that´s assigned to me right now! Not too much, but´s really time consuming!

If possible, and I arrive early at home tonight (yesterday I´ve arrived after 11:00pm), I´ll finish IPExpert CCIE R&S BLS Video-on-Demand Day 1! I´ll try to finish it at least by the end of the week, to not be too far from my schedule! As soons as I finish will publish my notes here in the blog!

Well... that´s it right now! Oh yes... If anybody is interested in those switch scripts I´ve created just let me know... They are not "perfect", but an example doesn´t hurt, right?! One thing, the comments are in portuguese, but I can quickly translate them to english! Just let me know!

Up the Irons! :)

Switch Macros

2008-07-29T13:01:00.001-03:00

Take a look at this examples of Switch Macros available at the Switching Video-on-Demand from IPExpert, just a few, but, the possibilities for it are huge!

First one... Create a Macro to configure our "Access-Ports", this will include the VLAN, Portfast, BPDUGuard and Storm-Control... Seens simple... but how the assign the correct VLAN to each port?! Using variables! Take a look:

macro name Port
switchport mode access
switchport access vlan $V
spanning-tree portfast
spanning-tree bpduguard enable
storm-control $T level $L
@

Now, apply this to port FastEthernet 0/10 for example, and assign it to VLAN 10, Storm-Control Type Broadcast and Level 20:

int fa0/10
macro trace Port $V 10 $T broadcast $L 20

See?! Easy! One line, instead of 5!

In the show run, the field macro description Port | Port will show us how many times this macro "Port" (the one we created earlier) was applied to this interface (in this specific case, 2 times!).

Another example, a macro to create some VLANs:

macro name MakeVlan
vlan 101
name My101
vlan 102
name My102
vlan103
name My103
exit
@

Just be careful, after the last VLAN (in our case vlan103) we need to type exit, if you don´t, this VLAN will not be created!

We can double check if everything is ok with the command: sh vlan brief

Another tip in this Video is if you get asked to assign a data VLAN, Voice VLAN and Portsecure allowing 2 Mac-Addresses in this port using just one command line (I talked briefly about it yesterday), how to do it?!

Seens a bit strange, but possible, first, check the Macros "pre-defined" in your switch using the command: show parser macro , your output will look much similar to this one:

Now that we found our macro, apply it to the desired interface:

int f0/16
macro apply cisco-phone $access_vlan 10 $voice_vlan 20

And finally, take a look at the configuration:

You may ask yourself, how the proctor is going to grade that?! How he´s going to know that I actually used a Macro, or even better, how he´s going to know that I didn´t created a Macro to do it, and just deleted from the Switch after that?!

Well... the answer is simple... first, take a look at the line: macro description cisco-phone this description is telling us that this specific macro (cisco-phone in this case) was applied to this interface. Also, the macro configured the VLANs (Data and Voice) and Portsecure as asked, but it also configured some extra stuff (QoS, Portfast, etc), and that tells the Proctor that you actually used this macro! So, be cool, just understand exactly what the question is asking, and you´ll be fine!

To apply a macro we can use the commands:

macro apply <macro-name>
macro trace <macro-name> -> if you want to see it going through the commands.
macro global apply <macro-name>
macro global trace <macro-name> -> if you want to see it going through the commands.

Dead Weekend + Switching Video

2008-07-28T16:20:00.001-03:00

Last weekend was not very "usefull" to study... I´ve started working on friday at 08:00am, till saturday 09:00am, that plus travel time from home-work, work-home is more than 28hours straight! So I pretty much spent my saturday sleeping... When I finally woke up, with a terrible headache (anyone want to guess why?!), my wife had this "dinner" plan with a couple friends, so, well... I couldn´t say no... We went out. It was fun... but we came back home a little late, so I woke up late on sunday (again)!

Couple house things to solve, shower to replace, get something to eat, and that´s it, almost 07:00pm, and no study! Oh my! So I sit in front of my computer and started watching IPExpert CCIE R&S BLS Switching Videos. As usual I got impressed! The quality of the material is unquestionable, those videos are AWESOME!!!! Again, you feel like you´re in class! Cool! :)

Very good stuff in the video, one point was, a lab tip, for instance if you need to configure something that will take a few lines to do it, but the lab asks you to configure it using JUST ONE command, well, it seens weird, but possible if you have a pre-defined macro in the switch (that is already there, not one that you create!), use the command show parser macro to check if there are any pre-defined macros in the switch, so, you may be able to do it just applying the macro itself!

Also, anytime you see a topology with a Switch in VTP Transparent mode in the middle (like VTP Server <--> VTP Transparent <--> VTP Server) be affraid. The VTP Transparent Switch will forward the updates between the other two switches, but, if, for instance you "prune" a vlan, that can cause us some problems! If the VTP Transparent switch doesn´t have this VLAN (or, if the VLAN is inactive) no matter if your VTP Server switches are using it or not, this VLAN will get pruned (in the VTP Transparent switch), and that can create some issues in our lab. Off course, we can solve this issue in a couple different ways, like removing those specific VLANs from the "pruning", for this use the command switchport trunk pruning vlan remove <VLAN List>

Another way to solve this is just create the VLANs in the VTP Transparent Switch, and activate them! Use the command vlan <vlan number> state active if you want to active the VLAN with no ports assigned! It´ll all depend on your lab restrictions and requirements!

It also talk about MST, and give us some good "insights" to avoid problems in the LAB itself, check this example configuration:

Enable MST

(config)#spanning-tree mode mst

Configure MST

(config)#spanning-tree mst configuration

Name (tree-name)
Instance 1 vlan (#-#-#)
Instance 2 vlan (#-#-#)
etc

This example is creating 2 MST instances, but, in fact your switch will be running 3 MST instances (do not forget about the MST Instance 0, it´s always there), so if your lab asks to have just 2 instances in your switch, well, that will force us to create just one new MST Instance and put all VLANs inside it! ;)

There are many, many other really usefull stuff and explanations! I´ll try to work on some really nice examples regarding Macros that is also in the Video!!! Wait and see!

Our friend Suresh Mishra just passed his CCIE Lab Exam!

2008-07-25T17:45:00.001-03:00

Our friend Suresh Mishra from Online Study List just passed his CCIE Lab Exam today!

Here follows his original message:

------

Hello all,

I passed CCIE LAB today. My ID is 21577. I would like to say thank you to all the people at IPEXPERT for their help. I used ipexpert as the only source for the preparation of my LAB exam and was able to pass within six months in my first attempt.

Thanks to all of you who help me in getting my ID.

Thanks
Suresh

------

That shows us Hard Work + Great Study Material = Success!

If you can, stop by to congrat him!

http://www.onlinestudylist.com/pipermail/ccie_rs/2008-July/001704.html

Well done buddy! Congratullations!!!!

TCL Script

2008-07-24T13:26:00.001-03:00

This Video is included in IPExpert CCIE R&S BLS as one of the last things... but I couldn´t just hold to check it, and see if there´s any tips, advices, or anything else that could help in the exam! And what do I have discovered?! Yes, there is a few things I didn´t knew! COOL!

First thing... in order to mount your TCL Script you´ll need to get all IP Addresses from your devices, but, there´s this easy way showed in the Video-on-Demand, just follow those steps:

First, log into each device, and type the command:

sh ip int brief | ex una

Second, and most important (that´s the part I didn´t knew!), in SecureCRT, if you hold the ALT key, and use your mouse to mark the text to be copied, you can select just what you want, in this case, just the IP Addresses from the command output! Take a look at this screenshot:

So easy! I used to copy the full line, cut off what I didn´t want, and use the IP Address! Now you just have to past it into the Notepad:

You´ll need to log in each device, and build a list of ALL IP Addresses in order to create your TCL Script, that shouldn´t take more than 05, maybe 10min, and in the end you´ll have everything at your disposal! :)

Another good advice in there regards WHEN to do TCL ping testing. We all know that we need to check connectivity several times a day, but, most important after the:

IGP section;
Redistribution section;
BGP section;
Security section;
Last thing of the day (if you got time to fix any issues that may find).

And any other time you think you need to check it!

Always keep your diagram updated, with all information you judge as usefull, so if you have any failures you should be able to quickly identify why and determine if this makes any difference! In case of any doubts, proctor is always there for us!

Also, if you have any "Backbone" IP Addresses that should be reachable, add it to your TCL Script manually, and that´s it!

To exit the TCL Shell just type: tclquit

Remember, 3550 switches doesn´t support TCL, we can create some Global Macros to achieve the same results.

A "typical" day in my life

2008-07-23T09:51:00.001-03:00

05:15am - Wake up.

05:20am - Take a Shower.

05:30am - Dress-up, get ready to work.

05:35am - Say hello to my cats! Wife still sleeping.

05:50am - Take the bus to the subway.

06:15am - Take the subway to come to work, during the travel, I usually read a book (right now I´m reading Doyle´s OSPF and ISIS book).

07:05am - Stop at Coffee Shop, get something to eat.

07:20am - Seat in front of my computer and quick lookup my emails, to discover what is waiting for me today, normally a new problem at any of our customer´s network. Why all kind of strange things happens at night?! Go figure! :)

07:30am - Find something usefull in the DocCD and read it! Yesterday I finished reading through IRB.

08:00am - Start working, and quickly answer to all my emails.

08:30am - Call to my wife, check if everything is ok!

08:40am - Call to the customer and check the status of it´s network issue, and gather more data about it.

09:30am - Work a solution for the problem.

11:30am - Everything is fine. No more issues so far, so back to the Doyle´s Book.

12:45pm - Receive a call, to check a new issue at another network.

01:00pm - Call customer, gather more data, and start all over again! :)

02:30pm - Everything is ok, so quickly go downstairs to lunch.

03:00pm - Back from lunch, still having 30min so, mine the DocCD for more documents to read at night.

03:30pm - Check my emails, no nothing new so far. Check the internet, blogs, everything CCIE related.

03:45pm - A buddy call me asking for help to handle a switch that is not syncronizing the configuration between the supervisors.

04:05pm - Everything is ok with the switch, just a config register problem, no big deal.

04:10pm - Check emails, answer them.

04:30pm - Emails answered, back to Doyle´s book.

05:00pm - Check emails, nothing new! Time to go home!

05:10pm - Take the subway, continue to read Doyle´s book.

06:20pm - Take the bus back home.

06:45pm - Arrive at home, say hello to my wife, my cats! Everything is ok!

07:00pm - Take a shower, order something to eat.

07:30pm - Talk to my wife about the day.

08:00pm - Dinner time!!!!

08:30pm - Wash the dish.

08:45pm - DocCD, read the document I found earlier (03:00pm).

09:15pm - View a new module of IPExpert CCIE R&S BLS Video on Demand. Take a LOT of notes while doing that. Those videos are very nice! Seens like I´m attending a live class, with the advantage that I can go back at any time!

10:30pm - Finish, exhausted, go to bed, watch some TV, talk to my wife.

11:00pm - Sleep, to begin everything again the next day!

Well... that covers pretty much it, off course, each day is different from the other, but that´s how I normally handle my days! Weekends are a different story, but, leave that for latter!