Deep Diving on Internet Architechture, Traffic Engineering and Peerings

Hey Everyone,

I think I stumbled on the internet sometime in the year 2000 and I have been trying to figure it out ever since. Since my day job is quite dependent on the internet (more than I like to admit or acknowledge), I have learned to love the internet and the mysteries that come along with it.

In the last month or so, I attempted writing a series of posts on the intenseschool site to explain how the internet works from a super high level networking perspective. The first two articles in that series have been posted now. You can find them here: and here:


If you have a moment, please head over to the intesnse school site and have a look at the articles. And while you are at it, please click the FB like button too. Finally, if you are looking to take some classes for a certification. Be sure to ckeck out the intense school's CCNA classes.

About Firewalls and EIGRP

Hey guys, its been a while since I posted here despite all my attempts to post more frequently. I have been immensely busy with my day job. I have also been working on a lot of exciting projects on the side and I hope to share some more details as they start to gain some traction.

I still write for intenseschool as time permits, even though I cannot write as much as I would love to. This month, two of my articles were posted on the intense school site; the first is on the EIGRP best path selection and the second is on Firewall Redundancy. If you have some time, please head over there an read the articles. I thoroughly enjoyed writing them so I know you would enjoy reading them.

And if you are studying for Cisco exams in the US, you should check out their bootcamps here.

Active Standby Redundancy on ASAs

I have been so busy with my day job these past few weeks that I have not really had time to do (or write) anything else. But I was able to squeeze out time to write an article as part of my redundancy series over at Intense School site.

This one is on Active/Standby redundancy on ASAs. You can view the article here. I hope to get the concluding part of the article written in the next few days. As usual, I'd let you know when its up!

Also if you are planning to take professional bootcamps in the US, you can check out intense school CCNA classes here.

7 Random facts about 25!

1. It’s the mail number. The email protocol, SMTP, uses TCP port number 25
2. It’s the atomic number of Manganese.
3. It is a perfect square.
4. It’s the minimum age for election into the United States House of Representatives.
5. It’s the Silver number – 25 years anniversary is called a silver jubilee.
6. It is a popular motorway in London (M25).
7. That’s how old I turn today! Happy Birthday to me!!!

If you are curious about the number 25, there are more random facts here. These are just my favorites.

Load Balancing Articles

Hey Guys,

As I mentioned in my previous article, I am writing a series on Network Reliability over at intense school blog. Two articles on load balancing just got posted and you should head over there to have a read. You can view them here and here. I enjoyed writing them and I hope you enjoy reading them too.

Also, if you are planning to take a live CCNA class in the US, you should check out the Intense school bootcamps here.

Network Reliability Series

In the last post, I mentioned that I write technical posts for the Infosec Institute. In the last month I have been writing a series on Network Reliability. The series focuses on how to make a network more reliable by eliminating single points of failure and increasing redundancy. The latest posts were about L3 redundancy and you can view them here and here.

You can view most of my articles here. And if you want to take a live CCNA class in the US, you can also check out Intense school bootcamps here.

Cheers!

3 years, 2 months, 1 day later...

After abandoning this blog for so long, I've decided to give blogging a try again. The last 3-ish years have been exciting and I hope to share some of the details with you later. But since this is like a first post (again), I'd just give a summary here....

I have changed jobs - Many times. The last time I posted, I was working in Abuja, Nigeria's capital city. Since then, I have worked in Tunisia, Lagos, London and I'm now based in Dublin, working for a totally cool company.

I took a break - I took a break from Network Engineering. In 2012, I decided to take out a year to pursue a masters degree. So I went off to London to study Technology Entrepreneurship, and I absolutely LOVED it. Studying @ UCL was absolutely amazing. More details about that later.

I tried entrepreneurship - Yes, I started my own company. But I'd admit I was clueless. Lots of determination with absolutely no strategy. This was probably the reason I eventually took a break to study Technology Entrepreneurship. I have pursued some more ideas since then, but none of them have gained enough traction yet. I'd also be sharing more details about that later.

I developed my own course - I have been an absolute fan of CBT Trainers. The Brians from INE used to be my heroes back in 2008-2010 when I was studying for my CCIEs. And before them, there was Jeremy Cioara, my personal CCNA/CCNP tutor. Last year, I had an opportunity to develop my own CCNA videos and I totally jumped at it. I developed the video series for howtonetwork.com, and I had so much fun doing it. The editor had a voice over done because of my African accent, but the content is all mine :)

I have been writing - Yup. I haven't been blogging but I have been writing. I did a lot of academic writing during my MSc degree. Asides that, I have been writing technical articles for a the Infosec Institute on their new intenseschool site which was launched last year. You can find my articles here. I'd be reposting some of them on this blog from time to time.

So that's some of the stuff I've been  up to while I was away. I'd wrap up this post now before it gets too long (and boring). See y'all soon!

Time and Chance - Lessons from Outliers

Hi everyone, and Happy (kinda belated) new year.


The last few months on the previous year had me questioning my definition of personal and career success. At the beginning of the year, I tried to make a list of books (non-tech) I had to study in the first half of this year.


Blink - Malcolm Gladwell
Outliers - Malcolm Gladwell
The Tipping Point - Malcolm Gladwell
Freakonomics - Steve Levitt
Fooled by Randomness - Nassim Taleb
Good to Great - Jim Collins

I spent most of the last weekend reading outliers, where Malcolm Gladwell makes some salient points on the story of success.

While I am still considering making a detailed review of this book, I can summarize most of the book into the words of Solomon from the scriptures in Ecclesiastes chapter 9 vs 11

"I returned, and saw under the sun, that the race [is] not to the swift, nor the battle to the strong, neither yet bread to the wise, nor yet riches to men of understanding, nor yet favour to men of skill; but time and chance happeneth to them all."

The role opportunity (being at the right place at the right time) plays in success is too huge to be neglected.

Well, even at that I still believe success is not entirely a function of chance, we must be able to recognize the opportunities and adapt so we can take advantage of them. The ability to do this is an extremely crucial factor in determining if we would be successful.

I think Outliers was a good read. Up next is Blink.

On the techy note, I'm considering picking up Juniper skills as a form of horizontal development as opposed to studying for another CCIE. Lets see how that goes.

Cheers!
Amplebrain.

And its a wrap! Thank God for 2010

Its been a great year for me - I hope you had a great year too
To everyone that contributed in making my year awesome - Thanks!
To everyone that I had the privilege of meeting - Thanks!
To everyone that I might have offended - I apologize
And to everyone - Hope you all have a great 2011

The next post would be in the new year!

Cheers!

Amplebrain

What Next?

Hi Everyone! (Wonder if anyone still reads this blog)

This is my first post after a long hiatus from blogging.

Its been four months since my Last major exam. I decided to take a very long break since the exam was very demanding and I had to make up for 'other parts of my life' that suffered while trying to obtain my second CCIE.

Now, Its time to answer the million dollar question: WHAT NEXT?

At 21, with 2 CCIEs, I have just completed my year of 'compulsory' service to my country (finally), and its time to make a major career decision.

Options?
1. Pursue an academic (technical) degree: A Masters in Engineering or some related course looks appealing (the perfect icing on the cake for the Bachelors) but just doesn't seem to fit in the grand career plan at the moment. I do not see the relative advantage that a masters degree would offer me at the moment, so I'll pass.

2. Pursue an MBA: A masters in Business Administration might expose me to the right business knowledge that would complement my technical skills but I dont think this is the right time for an MBA, I'm a techie at heart and I still love what I do. Maybe in the next 2 years but definitely not now.

3. More CCIEs: I have been toying with the idea of taking another CCIE in SP or Voice. The challenge and the knowledge that comes with the CCIE study process is just too much fun to ignore. But if I have to do any more CCIEs, I need to have the experience to back it up, so I would wait for a few months before I launch out.

4. CCDE: The CCDE exam intrigues me because of it acclaimed difficulty, some part of me wants to study for the exam while the other part is certain that the exam is not meant for mere mortals like me. After looking at Petr Lapukhov's recommended list of materials, I have decided that I would pass. That would take a few years to study :)

5. Nothing :)

Conclusion: I do not think I would be taking any milestone exams in the next few months. I would rather focus on getting enough experience and building my project profile. This might involve changing job-roles, changing organizations or even location as long as the goal is accomplished.

Please feel free to drop your comments, I actually need them :)

Hope to post some more (non-techie) stuff soon.
Cheers!

It is done...Security Lab Passed!

Hi All,
I passed the security lab yesterday in Lagos (mobile lab) on my first attempt.
Thanks to everyone that was a part of this journey.
1. God: For grace, strength, courage, provision and favour.
2. Family: For all the support. Thanks a million.
3. Friends: You guys are the best. It's not easy to have so many friends when all you do is sit and stare at a screen all day.
4. Study Partners: (Tacack, Deolu, Peter) It was fun studying with you guys. Wishing Peter all the best as he takes the lab today!
5. Study groups: OSL totally rocks. Groupstudy, CLND and IEOC are also very helpful.
6. Everyone that wished me Luck :)

Study Materials
I used INE study materials (because I fell in love with them since my R&S) and they are very good. IPExpert also has some quality materials too. Yusuf's labs are also incredible and they show you what to look out for in the lab.

Once again, thanks for everything.
Cheers,
Amplebrain, CCIE R&S and Sec

XXI

In Real world,
1. We live in the 21st century
2. The legal adult age in most countries - Alcohol, rent-a-car etc.

In mathematics
3. A Fibonacci Number
4. A Triangular Number
5. A star number
6. An octagonal number
7. composite Number
8. A Harshad Number
9. A Motzkin number

Symbolism/Religion
10. Number of the perfection by excellence, 3 x 7, according to the Bible.
11. 21 chapters in the Gospel of St John

In Science/Networking :)
12. FTP port number
13. Atomic Number of Scandium

In entertainment & Sports:
14. Used to be a TV show
15. 21 points are required to win a game of badminton and tennis
16. A card game, also known as blackjack
17. Name of favorite movie :)
18. Number of spots on a cubical dice

Trivia:
19. Number of shots fired in a salute of Royalty
History20. Number of demands sent to the Chinese by the Japanese in 1915

and finally.
21. That's how old I become today :)
Yep, Happy birthday to me! Thanks to everyone who has made the day special so far.
Cheers!
Amplebrain.

7 wishes for 21

Its exactly 7 days to my 21st, and I am very excited. I am trying to make a wish list and I am finding it so hard (I'm just not used to making wishes :)
Anyway, here's my list - Just 7 items.

7. A smartphone: I'ld like a device that would keep me away from my laptop. I spend approximately 16hrs with *her* per day.

6. A PhotoAlbum: Yes, I intend to keep one :-)

5. A book - I can never omit this. Learning is what keeps me alive :) I'ld let you choose the kind of book :)

4. A transition ceremony: I personally consider 21 as the full transition to adulthood. I'ld like to celebrate this transition in a special way :)

3. A sincere opportunity to give back: All my life, I have experienced divine and human help in all my endeavors. I believe in paying-it-forward so I am looking for a *sincere* opportunity to give back in the little way I can.

2. A special gift in exactly 21days from now :)

1. A gift from the maker: Something special from the one who started me on this journey and has kept me for the past 2 decades.

That's it :-)
Cheers!
Amplebrain.

GETVPN With Multicast Rekeying

Hi All,
A post by fellow CCIE-Sec Candidate TacAck made me do some research/revision on GETVPN Rekey. I would highlight my findings in this post.
1. There are 2 modes: Unicast and Multicast.
2. The Rekey address command references an access-list that is downloaded to the group members which makes them automatically join the group (for multicast Rekeying)
3. With Rekey Authentication, The crypto keys must be generated
4. Rekey is triggered by changing the SA access-list. Rekeys are retransmitted for a number of times n after a period p. This can be adjusted with the "rekey retransmit p n" command

Here is a sample config for the KS:

crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key CISCO address 192.168.123.1
crypto isakmp key CISCO address 192.168.123.2
crypto ipsec transform-set TRANS esp-3des esp-md5-hmac
crypto ipsec profile GET
set transform-set TRANS
crypto gdoi group GET
identity number 123
server local
rekey address ipv4 REKEY
rekey retransmit 10 number 2
rekey authentication mypubkey rsa GET
sa ipsec 1
profile GET
match address ipv4 GET
replay counter window-size 64
address ipv4 192.168.32.3
ip access-list ext REKEY
permit udp host 192.168.32.3 ho 239.0.0.1

5. If an ASA is placed in between the KS and the GMs; two things must be considered.
1. Allowing GETVPN traffic especially if GMs are outside since the GM initiate the registration process. A hole should be punched to allow udp destination 848
2. Multicast traffic should be forwarded by the ASA. If the GMs are directly connected as in a STUB, then the "igmp forward" should be enough to forward the traffic.


Nuff said, time to take a break :)
Cheers, Amplebrain

My Favorite RFC

Hi,
I have had to review several RFCs in the course of preparing for the security CCIE. Common ones include RFC 1918, 2827, 3704 and 3330 which are on the test. Other Fun RFCs include 2385, 3715, 3945 and 3947.
Today, I stumbled on what I would call my favorite RFC 1882 - 12 Days of technology before Christmas. This is a classic geeky joke. :D

Enjoy!

Cheers, Amplebrain

Ups and Downs

Hi All,
I have been extremely busy with work and studies. I hardly find time to prepare a technical post.
I salute everyone who had their CCIE while working on a full-time job (well, almost everyone did :-)
Sometimes, I feel ready, sometimes, like today, I just don't know. I definitely still have some work to do. In any case, I strongly feel that I'ld be ready for the beast if I can maximize the remaining 7weeks.

Nuff said, Time to get back to studying? Where are my routes :-)

Hardcore Studying

Hi All,
Happy Easter Celebrations to everyone.
I have been extremely busy these past few weeks and I hardly have anytime to create a detailed post. Merging work with studies hasn't been as easy as I thought :(

I am trying to see if i can put in approx 40hrs a week till my security lab in June...That should average to about 320 - 350 hrs of study before the security lab day. Currently using INE materials with gradedlabs rackrental. The Equipments are a little old though. Ild like to try out the proctorlabs if I can fit it into the budget.

I noticed that when connecting to the Workstations remotely either using VNC or Remote desktop;

1. Do not change the Adapter settings for the external interface.
2. Do not set another default gateway for the Lab interface as multiple default gateways confuse the Windows operating system.
3. Watch out for split tunnels when using EZVPN... You can lose your connection if you don't specify the split tunnel as the TestPC would attempt to route all INTERNET traffic through the EZVPN Tunnel.

Have fun studying...

Amplebrain

Cisco's New ASA 8.3(x)

The newly released ASA 8.3(x) software released by Cisco. Many new features have been added. Notable features include:
1. The Support of browser based VPN on Win7 and 64 but Windows
2. Overhaul of NAT config - static, global, NAT-config and alias commands have been retired.
3. Use of real (not NAT) addresses in the access-list configuration.

The new features can be found here.

I haven't tested the features yet so I dont have any personal opinion. I think I would have preferred that they left NAT the same way though :-).

The good news is that these 'features' would not appear on the Security lab for at least another six (6) months.

Have fun studying and working!

Cheers Amplebrain

A Year After...

Today makes it exactly one year since I became a Routing and Switching CCIE. I can't believe Its 365 days already. I can remeber my LAB day like it was yesterday.

Bruno was the Proctor. I walked into the lab feeling confident with my level of preparation but when I logged into my routers, they were all fully configured. I checked with Bruno (nice proctor) and he confirmed that it was their error - they failed to re-initialize the rack so the previous candidates configs were still on the rack. I had to wait for some minutes again. I lost all the composure I had.
By the time I was called in, I was a bag of nerves. I just stared at the screen and try to see if I could continue with my strategy. I just had to hope that there wasn't going to be any more mistakes that would cost me my lab. I wasn't ready to throw away 1750 dollars (I took the mobile lab).

The lab went well, OEQ were okay, The config section was good too. Finished on time, verified and identified some careless mistakes. Fixed them and verified again. I went home and waited till 1:30am and there was no mail from cisco. Fell asleep and woke at 4:30 am with an IM from my friend. He had passed. I logged in and there was it. PASS. I was so excited. Now i could focus on finishing school - I was in my final year in the University.

In the past year, a lot has changed. I have realized that a CCIE isn't by any means the pinnacle. It just gives you the opportunity to see farther. In the last year;

I graduated from the University,
I got a full time Job
I started this blog
I have learnt so much about so much.
I have been asked more questions than the previous 19years of my life before I became a CCIE

Looking back at the last year? Has it been worth it? YES...I wish I had a little more experience though but I am making up for that. :-)

Do I intend to take another CCIE? Yes: But the conditions are certainly different now - I am working (less time to study).

I hope that by the next 'anniversary', I'ld be a dual CCIE.

Right now, Its time to get back to studying.
Thanks for reading!

P.S: Cisco officially announced CRS-3 on my 'Anniversary'
Cheers...

Amplebrain

Advertise maps in BGP

A recent discussion on groupstudy pushed me into labbing BGP again.
In BGP, Advertise maps are used for two functions;
1. Conditional Advertisement
2. Route aggregation.

In conditional advertisement, Advertise maps are with an EXIST-MAP (or NON-EXIST map) to perform conditonal advertisement. Here the advertise-map specifies a route-map that matches the prefixes that would be advertised ONLY if the prefixes in the EXIST-MAP exist in the routing table.

The syntax is "neighbor ip-address advertise-map map-name {exist-map|non-exist} map-name"

The other use of advertise-maps is in specifying what attribute would be carried along in the as-set attributes of an aggregate during summarization.

Assume we have R1, R2,R3 and R4 in AS 1, 2,3 and 4 respectively
R1 -- R4 --- R3
|
R2

R1, R2, and R3 advertise 150.1.x.0/24 into bgp where x is the router number.

R4 aggregates the routes to 150.1..0.0/16 with as-set attribute.
By default, none of the routers get the update anymore since their
individual routes are a part of the summary.

Using advertise map, we want to make R1 and R3 get the summary; so we only advertise the attributes of the prefix form R2 with the summary.

Using as path access-lists and route-maps on R4 we have,

ip as-path access-list 1 permit ^2$
route-map adv permit 10
match as-path 1

router bgp 4
aggregate-address 150.1.0.0 255.255.0.0 as-set summary-only advertise-map adv

Now, R1 and R3 get the summary, R2 doesn't because its AS number is carried along with the summary

R1(config-router)#do sh ip bg | i 150.1.0.0
*> 150.1.0.0 192.168.1.4 0 0 4 2 i

R2(config-router)#do sh ip bg | i 150.1.0.0
R2(config-router)#

Ok. That's it for now. Back to security :-) I was trying to look into NAC with the CTA and CSA. Fun stuff :D

Cheers,
Amplebrain