h1

Well done to Nick Passing

June 21, 2009

A huge congrats to a friend of mine Nick Treasure in passing his CCIE R&S in Dubai last week. (CCIE #24561)

When I studied for the R&S I found that there was no material to bridge the gap between the theory books and the practical lab workbooks.  Once done with the theory, starting with practical labs you quickly realize that there is ample content the theory books doesn’t cover, and as a result it tends to take you longer going through the practice labs.

So I made notes in line with just that. Notes to cover the basic theory parts, but more  cover all the commands and configuration examples you need to know along with command defaults and command variations. At the end I used these notes the two days before my actual lab to review all the work, theory and practical. And I found it to be an absolute life saver, since it was so complete and detailed, yet a summarized version (200 pages) of everything studied up to that point.

After Nick sadly failed his first attempt I offered the use of my practical notes to him for review before his second attempt. He dubbed it the “holy grail” of networking and that became a standing jokes in the office.

lol,this is a IM log chatting to him earlier this week:

(1:10:07 PM) Nickt69: Sup Fellow Network God
(1:10:34 PM) Nickt69: CCIE 24561 at your service.
(1:10:45 PM) Wiggwire: lo
(1:10:59 PM) Wiggwire: huge congrats and well done buddy
(1:11:04 PM) Wiggwire: hoz it feels,
(1:11:25 PM) Nickt69: Awesome!
(1:12:15 PM) Wiggwire: how was the exam?
(1:12:46 PM) Nickt69: Exam was easy thanks to your notes..
(1:12:57 PM) Wiggwire: seriously?
(1:13:43 PM) Nickt69: Yes.. No bullshit.

h1

Load-Sharing on the SAME router

June 15, 2009

Load-balance-1router-2Assume you have either of the following setup’s. A single router (R3) with multiple links, either to the same upstream router (R2) or to 2 different upstream routers(R2+R4). And you want to load-share traffic across both links outbound (direction from left to right). Obviously the routing table needs multiple outgoing links as next-hops to perform the desired balancing. The command maximum-paths specifies how many paths or next hops are allowed per prefix in the routing table for a specific routing protocol, else default behavior dictates only the best route from each routing protocol are candidate for insertion into the routing table.

Since the links terminate on the same router (R3) you have the following options:

  1. Per-Destination Load-Sharing using Fast Switching
  2. Per-Source-Destination Load-Sharing using CEF
  3. Per-Packet Load-Balancing using Process Switching
  4. Per-Packet Load-Balancing using CEF

You need to be aware that IOS makes switching decisions based on the configuration of the inbound interface first. If CEF is configured on an inbound interface, the packets will be CEF switched regardless of the configuration on the outbound interface. CEF is ONLY used if  enabled on the inbound interface. If CEF is not configured on the inbound interface, the configuration of the exit interface determines the switching method. The following table illustrates the different behaviors:

Inbound Configuration Outbound Configuration Switching Method Used
CEF CEF CEF
CEF Process CEF
CEF Fast CEF
Fast Fast Fast
Fast CEF Fast
Fast Process Process
Process Process Process
Process CEF Fast
Process Fast Fast

Refer to the following article, for more info about the Switching Types and how to enable each.

Read the rest of this entry »

h1

Scott Morris becomes a 10-year CCIE

June 7, 2009

I actually forgot to post this on the day. But better late than never.

On the 18th May 2009, Mr Scott Morris became a 10-year CCIE.

scott morris

In 2003 upon passing hit 4th CCIE, Scott was one of only four people in the world who held four-CCIE certificates and the only non-Cisco employee among this elite group at the time. Not bad for someone who majored in Photojournalism.  Scott has since build a huge and well-respected reputation in the Networking World through consultancy and being involved with many training materials and books. Among his armory of knowledge, he also has a great sense of humor.

Scott is in my opinion one of the leaders in the CCIE industry,  his wealth of knowledge, understanding and experience is truly impressive. Right now I believe being a 10-year CCIE is just one extra thing to separate the old-school good guys from the new-school hord (me and many other followers).

I think this is well-done and a great achievement, congratulations :D

Read-More :
Cisco on Scott,
Scott’s Story,
Scott @INE

h1

Load-sharing vs Load-balancing

June 3, 2009

Load-sharing and Load-Balancing is easily one of the most misunderstood topics in networks.  Those of knowing usually understands the difference and is aware of the concept of load-sharing.

So what is Load-Balancing?

Definition: Load balancing is mechanism that helps make networks more efficient. It distributes the processing of traffic evenly across a network with multiple-paths, in order to get optimal resource utilization, maximize throughput, and minimize response time.

In short Load-Balancing will split the traffic sent, in a equal fashion using multiple paths to a destination when forwarding packets. So if you have 2x 512k links, with 800k traffic at any point, conceptually with Load-Balancing each path should have 400k worth of traffic! Although that is the idea, in the networking world that is not always true or in some cases even possible.

How does Load-Sharing differ?

Definition: It is inherent to the forwarding process of a router to share the forwarding of traffic if the routing table has multiple paths to a destination. The traffic is distributed in inverse proportion to the cost of the routes. That is, paths with lower costs (metrics) are assigned more traffic, and paths with higher costs are assigned less traffic.

Load-Sharing is more realistic and technically more correct, in that you can always share traffic across multiple paths, even if in a unequal fashion. In layman’s terms, if you were to look a two comparing traffic graphs, with load-balancing the two graphs would be identical, but with load-sharing they might be similar but the traffic flow pattern would be different. But why the big deal in separating the two?

Them non-technical folks! Because to have multiple links sharing the exact same amount of bandwidth is only possible in very specific instances, where almost ALL other instances are load-sharing not load-balancing.

Another very important fact to keep in mind, is that any load-sharing/load-balancing configurations are UNI-directional, influencing traffic in one direction. If you want to balance the return traffic, you will have to configure it to be done as well.

So when is it load-sharing / load-balancing, and what are the different scenarios you can use them? How do you configure them?

The big deciding factor is, at the load sharing point in your network, are the multi-path links terminating on the same router or not?
- If NO, (sharing point spans multiple routers with their own link/s), then you only have one option, Load-Sharing.
- If YES, you have some options based on you IGP, and the Switching-Process in the router.

I will cover each of these, with the possible scenarios in more depth in articles to follow  :)

h1

Understanding CEF

June 2, 2009

What is CEF?

Definition from Cisco.com :

Cisco Express Forwarding (CEF) is advanced, Layer 3 IP switching technology. CEF optimizes network performance and scalability for networks with large and dynamic traffic patterns, such as the Internet, on networks characterized by intensive Web-based applications, or interactive sessions.

To understand this more you have to understand why and how CEF came about.  With Cisco IOS  there are different Switching Methods, that defines how packets are forwarded through a router. The first method, which happens to be the oldest and slowest is Process-Switching. Alternatively when  packets arrive, the interface processor can interrupt the central CPU and asks it to switch the packet according to a route cache or switching table. That cache or table can be built in several ways, the two of interest here is Fast-Switching and CEF.

Read the rest of this entry »

h1

R&S Short Notes – Security & IP Services

May 22, 2009

Security

  • Know how to use extended access-lists in distribute-lists, see Brian McGahan @INE article.
  • Know how to use extended access-lists instead of prefix-lists, see Brian Dennis @ INE article.
  • Know your binary voodoo as Scott Morris @ INE calls it,  Part I & Part II.
  • Dont forget to allow IGP’s, BGP, Multicast , IPv6 and any other needed protocols when adding ACL to a interface.
  • Know when to use the “established” keyword.
  • When matching Multicast traffic in a extended ACL, remember that Multicast traffic can NEVER be a source.
  • Allowing Telnet to a local router on a port other then 23: Option 1- Rotary command or Option 2- Port NAT.
  • NBAR can be used if you not forbidden from using ACL’s.  You can also map undefined custom ports with “ip nbar port-map custom”
  • Dynamic ACL time-outs specified in the acl:  “dynamic NAME timeout {x} permit tcp any any eq 80″.
  • When configuring SSH, don’t forget to specify a Domain-name and generate your RSA keys.

IP-Services

  • “no service config” – Disables the router from auto-answering for tftp config files
  • WCCP uses udp port 2048 and protcol 47-GRE
  • If talk about router discovery > IRDP
  • DNS server config : “ip dns server” & “ip host”
  • DNS client config : “ip domain-lookup” & “ip name-server”
  • DHCP stands for Dont Hit Computer People
  • DHCP option-82 = dhcp-relay.
  • DHCP option-66 = Hand out IP address off TFTP server
  • When configuring DHCP and earlier in the swithcing section you configured DHCP snooping you must enable the port connecting to the DHCP server as trusted.
  • Incase DHCP was configured you need either “no ip dhcp snooping info option” on the switch OR “ip dhcp relay information trust” on the dhcp router.
  • HSRP timers only need to be configure on one of the participating routers.
  • HSRP uses UDP port 1984.
  • When using HSRP with earlier configured port-security, you might need to allow you HSRP MAC 0000.0c07.acxx – where XX is the group number in hex.
h1

R&S Short Notes – QOS

May 21, 2009

QOS

  • Class class-default need “fair-queue” if “bandwidth” was not specified.
  • When using “ip rsvp bandwidth” on a sub-interfaces, it is also required to be configured on the main interface.
  • When using multiple sub-interfaces with “ip rsvp bandwidth”, the main interface should be configured to be the sum all sub-interfaces.
  • RSVP requires fair-queue to be enabled. With FRTS, WFQ is disabled by default, re-enable with “frame-relay fair-queue” in the map-class.
  • When doing MQC configurations using the bandwidth percent command, do not forget to change the “max-reserve-bandwidth %”.
  • Custom queueing defaults – Byte-count = 1500 bytes & Queue-limit = 20.
  • Know the NBAR mime categories: “image/*” or “audio/*”  or  “application/*”  or  “text/*”
  • Voice EF class = 46 decimal and 101110 in dscp-binary.
  • FRTS formulas:

Bc = CIR * Tc

Be = (CAR – CIR) * Tc

  • WRED formula:

= (1/MPD)

  • CAR (Police) formula:

Bc = CIR / 8 * Tc           (Default Tc = 1.5 seconds)

Be = 2 * Bc

h1

R&S Short Notes – Multicast & IPv6

May 20, 2009

Multicast

  • BSR is also commonly referred to as PIMv2.
  • Pay special attention to when using Frame-Relay non-broadcast types. Multicast will not work. Tunnels might be needed.
  • BSR – when multiple c-RP announces same groups, a longer match will be used to determine the RP, regardless of the RP priority set.
  • With TTL scoping, if the Packet TTL >= Interface TTL, then the packet is forwarded, else dropped.
  • GRE-tunnel -  If the unicast source is reachable via tunnel, a RPF failure will occur. Correct with Mroute.
  • Know how to spot RPF failures.
  • Multicast Filtering:

1. Q – Prevent PIM neighbor establishments, but allow IGMP  client joins?

A – On Central router : “ip pim neighbors filter” & the Stub router : “ip igmp helper-address”

2. Q – Filter specific multicast groups, while still allowing IGMP traffic?

A – “ip multicast boundary {acl}”

3. Q – Deny clients from joining specific multicast groups?

A – “ip igmp access-group {acl}”

4. Q – Statically filter RP requests and responses, (no Auto-RP, no BSR)?

A – “ip pim rp address {IP} {acl}”

5. Q – Client RP filtering, Limit join/prune messages for specific RP’s?

A – “ip pim accept-rp {RP-IP/auto-RP} {acl}”

6. Q – Auto-RP – Limit the Candidate-RP’s announcements?

A – “ip pim send-rp-announce {int} scope {no} group-list {acl}”

7. Q – Auto-RP – Limit what mgroups a MA accept from specific RP’s?

A – “ip pim rp-announce-filter rp-list {acl} group-list {acl}”

8. Q – Filter the BSR messages on a interface?

A – “ip pim bsr-border”

9. Q – Limit the amount of multicast routes in the mrouting table?

A – “ip multicast route-limit”

10. Q – Limit the rate a source can sent traffic to a group on a interface?

A – “ip multicast rate-limit group-list {acl} {kbps}”

IPv6

  • RIPng – “no ip split-horizon” in a process command not a interface command.
  • EIGRPv6 – Do not forget to enable eigrp under the process.
  • IPv6 tunnel method with least overhead : IPv6IP
  • Tunnel protocol numbers for ACL’s : IPv6IP = Protocol-41,  &  GRE IPv6 = Protocol-47
  • You can not redistribute a default static route(::/0) with ospfv3.
  • Dynamic information (ie IGP next-hops)  recurses to remote link-local address, not the global unicast interface.
h1

R&S Short Notes – BGP

May 19, 2009

BGP

  • When using Communities, don’t forget “neighbor send-community”
  • Know your attributes and the direction which applied, when to used what.
  • “aggregate address” needs a more specific prefix in the BGP table for aggregate to be advertised.
  • Synchronization issue has 3 solutions, 1- Load BGP on all transit routers, 2- GRE tunnel, 3- Redistribution BGP>IGP.
  • “no bgp nexthop trigger” – Disables next-hop tracking between scanner intervals.
  • “no bgp fast-ext-fallover” – Force the router to wait for the dead-timer to expire, before generating notification messages , when a connected peer goes down.
  • “neighbor fall-over” – Will check neighbor connenctivity between scanner intervals, aka BGP Fast Peering.
  • Only the Holdtime is sent in update-msg. Two neighbors will use the lowest holdtime and then calculate the keepalive from that.
  • Know your Regular Expressions
  • Know the difference between Peer-Groups and Peer-Templates
h1

R&S Short Notes – IGP’s

May 18, 2009

RIP

  • Know your filters: Offset-list, Distribute-lists, distance command.
  • With filters read carefully: “between 25 & 45″ or “from 25 to 45″.
  • Know your prefix-lists or alternatively using ACL’s instead.
  • “passive interface” command, ONLY stops the sending of updates out the interface. Interface will still receive and process those updates. Passive interfaces will still be advertised in other updates.

EIGRP

  • Advertising a default route out one interface: “ip summary-address eigrp [AD] 0.0.0.0 0.0.0.0″
  • To see if a neighbor is configured as STUB, “show ip eigrp neighbors [detail]” as look for ‘CONNECTED SUMMARY’
  • On frame-relay multipoint interfaces, don’t forget to disable split-horizon.
  • External EIGRP routes AD (admin distance = 170) can NOT be changed on per prefix basis.
  • Metric weight values:
    1 0 1 0 0 = Default
    0 0 1 0 0 = Only DLY
    1 0 0 0 0 = Only BW
    3 0 1 0 0 = BW has 3 times more weight reference than DLY
  • Metric formula:

Metric = ((107 / BW) + (DLY/10) ) * 256

OSPF

  • The Neighbor IP used with OSPF distance command is the Neighbors Router-ID.
  • “area range” summarize type 3 LSA’.
  • “summary-address” summarize type 5 & 7 LSA’s.
  • Auto-cost reference BW (Default = 100mb), formula = Ref-BW/Int-Bw.
  • Switches do no support the interface command “ip ospf {pid} area {area-id}” .
  • OSPF path selection: O > O*IA > O*E1 > O*E2.
  • Using E1 metric type : Packets will be routed out the closest exit point of the network.
  • Using E2 metric type : If you want packets to exit your network at the closest point to their external destination.
  • Don’t forget with hub and spoke topology, “ip ospf priority 0″.
  • PITFALL, when forbid to use RID, Loopbacks created later on might change the DR on you network after a reload.
  • PITFALL, when forbid to use RID, Later requested to configure the same loopback on two routers, could break your adjacencies, as two router cant peer with the same RID.
  • “no capability transit” – Mimics OSPFv1 behaviour for all data traffic to pass through Area-0.
  • “max-metric” – Configures OSPF stub configurations
  • “max-lsa” – Limit amount of non-local LSA’s
  • “timers throttle lsa all” – Slow down update rate.
  • “timers pacing lsa-group” – Group more LSA’s together in updates.
  • “no ip ospf flood-reduction” – Disables every 30-min LSA DB refresh.
  • “ip ospf database filter all out” – Breaks RFC, Stop sending LSA’s, but still receive LSA’s

h1

R&S Short Notes – Frame-Relay/PPP

May 18, 2009

Frame-Relay

  • DHCP on a frame interface : “frame-relay interface-dlci 555 protocol ip 166.166.166.2″
  • When asked to disable INARP, be sure to do so on physical interfaces any multipoint sub-interfaces.
  • If you see 0.0.0.0 frame mappings, save your config and reload.
  • The backup command can NOT be used on FR physical interfaces. (no way to detect when back up)
  • Back-to-Back frame connections, disable keepalives with “no keep”
  • LMI keepalives sent every 10 seconds. This interval can NOT be changed.
  • LMI Full Status Updates are requested every 60 seconds. CAN be changed with “frame lmi-n391dte”.
  • To ping local interface IP, add a mapping for local IP with any valid DLCI.

PPP

  • To do “?” in authentication password, use either ESC-Q or CRTL-V.
  • If two routers both using CHAP has the same hostname “no ppp chap ignoreus” is required.
  • “ppp authentication eap” can be used as alternative to chap when md5 needed.
  • “ppp link minimum” – amount of links required for a MLP bundle to up.
  • With CHAP and PAP, know which side is the client and who is authenticating who!
  • Know PPPoFR, MLP, and the mix combination formats
h1

R&S Short Notes – Switching

May 18, 2009

With the insane amount of theory to go through before the big day comes, it is only normal for a couple of items to get lost in the masses. On top of that, regardless of the material you used to study, you are bound to come across a couple small things that you have not seen before. Apart from my 400 pages of summarized notes, I made short notes on the fly while labbing of anything I have not seen before or any beeg gothas to look out for.

Hope these help some of you :)

Switching Notes

  • If different VTP domain names between 2 switches, you cant use DTP. Must use manual trunking.
  • When configuring 802.1x, DO NOT forget to add “aaa authentication login default none”, else you might lock the router and forfeit any points related to that switch.
  • Always confirm your MD5 to be same when configuring VTP PASSWORDS, with “sh vtp status”
  • To enable WCCP on a 3550, you have to change the SDM template to ‘extended-match’
  • STP Timers question-1: Change the STP timers when a port initially comes up to 44 sec.  Answer: Blocking is always 20 sec, (44-20 = 24/2) each listening and learning timers should be configured at 12 sec.
  • STP Timers question-2: Change the STP timers, that in the event of convergence, delay should be no more than 20 sec. Answer: (20/2) each listening and learning timers should be configured at 10 sec.
  • MAC-ACL’s will only match NON-IP traffic. 3560 sees IPv6 traffic as IP-traffic, but 3550 sees IPv6 traffic as NON-IP-traffic, so a 3550 can use a MAC-ACL for IPv6 traffic.
  • Ethertypes used with MAC-ACL’s not on DOC-CD/CMD-Help :

- 0×0806 : IP ARP
- 0×0800 : IPv4
- 0×86DD : IPv6
- 0×4242 : CST (Common Spanning Tree)
- 0xAAAA : All Cisco proprietary (VTP, STP, CDP, DTP, UDLD, PAgP)
- 0xFFFF : all NON-IP

  • VLAN-ACL’s: ONLY a ACL-Permit performs the “forward”/”drop” function in the access-map. A ACL-deny will be ignored. So to deny traffic with VLAN ACL’s, permit the traffic and use a “drop” action in the access-map.
  • Storm-Control: Multicast amount must be equal or greater that the broadcast amount.
  • Uplinkfast used when a direct link failure is detected.
  • Backbonefast – used to determine indirect link failure.
  • Root Bridge Election: 1-Lowest Bridge-ID (Priority [32768 ] + Sys-Id-Ext[=vlan]) & 2-Lowest MAC
  • Root Port Election: 1-Lowest cost to Root, 2-Lowest upstream Bridge-ID, 3-Lowest Port-ID (Port Priority + Port Number)
  • Influencing local Root Port election – change the Port Cost.
  • Influencing the Root Port of directly connected downstream switch – change the Port Priority.
h1

Cisco CCIE R&S Lab Blueprint v4

May 14, 2009

A couple days off and so much has happened in the industry.

As most are aware the R&S track is set to change from the 17th October 2009, with some interesting but controversial changes. Some that I personally agree with, some I don’t. But these changes has come about due to public demand, and as with many things in life, majority rules.

Mr Scott Morris wrote a brilliant article in his usual humorous way, about the upcoming changes to the existing Routing and Switching version3.  Source

The proposed changes to the layout are as follow:

- The Open-Ended-Questions are here to stay. (no surprise)
- A NEW 2-hour troubleshooting section will be introduced.
- Then the remaining 6 hours will be the normal configuration section.

I’m currently working in a support environment, so I personally can not imagine the troubleshooting sections being that hard. But that really depends on your background. The troubleshooting section entails a candidate troubleshooting given problems on a pre-configured network. Once done the config on the routers will be wiped and the initial configs for the configuration section will be loaded.

The proposed changes to the hardware and software:

- IOS 12.4 to be replaced with more recent 12.4T versions
- All switches available will be 3560’s
- 3725s Routers to be changed with 1841s and 3825s.

Then the proposed changes to the exam topics in short format are as follow:

- PPPoE (PPP over Ethernet)
- OER (Cisco Optimized Edge Routing)
- PFR (Performance Routing)
- EIGRPv6 (EIGRP version 6)
- IPv6 Multicast
- MSDP – Implement Interdomain Multicast Routing
- MPLS Overview
- Layer 3 VPNs
- VRF-Lite (Multi-VRF Customer Edge)
- MPBGP (Multi-Protocol BGP)
- Cisco AutoQoS
- Zone Based Firewall
- IPS (Intrusion Prevention System)
- NetFlow
- RITE (Router IP traffic export)
- EEM (Cisco IOS Embedded Event Manager)
- SCP (Switch-module Configuration Protocol)

I have created a new R&S version 4 blueprint with the new topics above based on my original version 3, along with a more detailed breakdown of  the new topics. Its listed on the right.

In all honestly, I hear most are worried about MPLS and the L3 VPN’s, but trust me when I say there is nothing difficult about this. Basic MPLS has so much theory but 3-4 command to configure. VRF’s are really nothing difficult if you have never worked on it before. In my humble opinion this will really be free points :) since Cell-Mode MPLS, L2 VPN’s, and TE-Tunnels are not included.

h1

Cisco CCIE R&S Lab Blueprint v3

May 2, 2009

Wow, what a wonderful time and experience I’ve had the last two weeks. Family, friends and co-workers has been so complimentary, thanks :)

Before starting studying for my SP track in 2 weeks time, I would like to share some of my notes that I used for the R&S. It helped me, so there is no reason it can’t assist a fellow candidate.

Firstly I created my own Blueprint and I believe it is the most granular list available.
Listed under PAGES section on the right or use the following link:
http://blog.ru.co.za/ccie-rs-lab-blueprint-v3/

Why is it version 3?
On Cisco’s website there is the official, very ambiguous and short list of what they expect you to know, version 1. Then Anthony Sequeira at Internetwork Expert created a expanded version of Cisco blueprint, ie version 2. I used Anthony’s blueprint as a basis and expanded it by adding all possible topics that you might encounter in the actual lab. I did this using all the different theory books, and while doing workbook/mock Labs. In my lab there was one single topic that I had not seen before, but was able to find it quickly enough on the DOC-CD.

The obvious question a new candidate would likely ask, OMG do I have to know all of those topics??? The answer YEAH KINDA.
Obviously CORE topics, you should know off by heart! That, IMO that would includes all categories from 01-08.
The NONE-CORE topics (09-15), you should know at least 80% off by heart, but at the very least be aware of each topic, and where to find it on the DOC-CD.

Using the DOC-CD is a great help and you should be familiar with the location of the various topics, but depending on your speed, relying on the DOC-CD to much, could greatly affect how long your 8-hours on the day might be. Last thing you need is to run out of time, as a result of referencing the DOC-CD to often.

h1

Cisco Mobile Lab – PASS

April 21, 2009

It is with great pleasure, pride and excitement that I am typing this, despite the painful agony of waiting a whole weekend for the result.
(My advice, NEVER do your lab on a Friday)

On Friday the 17th April, I passed the R&S Lab Exam on my 1st attempt with the Cisco Mobile-Lab in Bryanston SA.
It was an experience unlike anything I have had before, the build-up, the exam, the agony of waiting, then the result and now the afterglow.
My biggest fear was the possibility of becoming a statistic that most candidates only pass on the 2nd /3rd attempt.
But despite the natural fear and anxiety, Friday belonged to me,  it was my day to earn my number:

ccierouting_and_switching_colour

#24163

Now that I have taken the LAB I can really share my comments and views regarding the structure/experience.

Read the rest of this entry »