My Favorite RFC

Hi,
I have had to review several RFCs in the course of preparing for the security CCIE. Common ones include RFC 1918, 2827, 3704 and 3330 which are on the test. Other Fun RFCs include 2385, 3715, 3945 and 3947.
Today, I stumbled on what I would call my favorite RFC 1882 - 12 Days of technology before Christmas. This is a classic geeky joke. :D

Enjoy!

Cheers, Amplebrain

Ups and Downs

Hi All,
I have been extremely busy with work and studies. I hardly find time to prepare a technical post.
I salute everyone who had their CCIE while working on a full-time job (well, almost everyone did :-)
Sometimes, I feel ready, sometimes, like today, I just don't know. I definitely still have some work to do. In any case, I strongly feel that I'ld be ready for the beast if I can maximize the remaining 7weeks.

Nuff said, Time to get back to studying? Where are my routes :-)

Hardcore Studying

Hi All,
Happy Easter Celebrations to everyone.
I have been extremely busy these past few weeks and I hardly have anytime to create a detailed post. Merging work with studies hasn't been as easy as I thought :(

I am trying to see if i can put in approx 40hrs a week till my security lab in June...That should average to about 320 - 350 hrs of study before the security lab day. Currently using INE materials with gradedlabs rackrental. The Equipments are a little old though. Ild like to try out the proctorlabs if I can fit it into the budget.

I noticed that when connecting to the Workstations remotely either using VNC or Remote desktop;

1. Do not change the Adapter settings for the external interface.
2. Do not set another default gateway for the Lab interface as multiple default gateways confuse the Windows operating system.
3. Watch out for split tunnels when using EZVPN... You can lose your connection if you don't specify the split tunnel as the TestPC would attempt to route all INTERNET traffic through the EZVPN Tunnel.

Have fun studying...

Amplebrain

Cisco's New ASA 8.3(x)

The newly released ASA 8.3(x) software released by Cisco. Many new features have been added. Notable features include:
1. The Support of browser based VPN on Win7 and 64 but Windows
2. Overhaul of NAT config - static, global, NAT-config and alias commands have been retired.
3. Use of real (not NAT) addresses in the access-list configuration.

The new features can be found here.

I haven't tested the features yet so I dont have any personal opinion. I think I would have preferred that they left NAT the same way though :-).

The good news is that these 'features' would not appear on the Security lab for at least another six (6) months.

Have fun studying and working!

Cheers Amplebrain

A Year After...

Today makes it exactly one year since I became a Routing and Switching CCIE. I can't believe Its 365 days already. I can remeber my LAB day like it was yesterday.

Bruno was the Proctor. I walked into the lab feeling confident with my level of preparation but when I logged into my routers, they were all fully configured. I checked with Bruno (nice proctor) and he confirmed that it was their error - they failed to re-initialize the rack so the previous candidates configs were still on the rack. I had to wait for some minutes again. I lost all the composure I had.
By the time I was called in, I was a bag of nerves. I just stared at the screen and try to see if I could continue with my strategy. I just had to hope that there wasn't going to be any more mistakes that would cost me my lab. I wasn't ready to throw away 1750 dollars (I took the mobile lab).

The lab went well, OEQ were okay, The config section was good too. Finished on time, verified and identified some careless mistakes. Fixed them and verified again. I went home and waited till 1:30am and there was no mail from cisco. Fell asleep and woke at 4:30 am with an IM from my friend. He had passed. I logged in and there was it. PASS. I was so excited. Now i could focus on finishing school - I was in my final year in the University.

In the past year, a lot has changed. I have realized that a CCIE isn't by any means the pinnacle. It just gives you the opportunity to see farther. In the last year;

I graduated from the University,
I got a full time Job
I started this blog
I have learnt so much about so much.
I have been asked more questions than the previous 19years of my life before I became a CCIE

Looking back at the last year? Has it been worth it? YES...I wish I had a little more experience though but I am making up for that. :-)

Do I intend to take another CCIE? Yes: But the conditions are certainly different now - I am working (less time to study).

I hope that by the next 'anniversary', I'ld be a dual CCIE.

Right now, Its time to get back to studying.
Thanks for reading!

P.S: Cisco officially announced CRS-3 on my 'Anniversary'
Cheers...

Amplebrain

Advertise maps in BGP

A recent discussion on groupstudy pushed me into labbing BGP again.
In BGP, Advertise maps are used for two functions;
1. Conditional Advertisement
2. Route aggregation.

In conditional advertisement, Advertise maps are with an EXIST-MAP (or NON-EXIST map) to perform conditonal advertisement. Here the advertise-map specifies a route-map that matches the prefixes that would be advertised ONLY if the prefixes in the EXIST-MAP exist in the routing table.

The syntax is "neighbor ip-address advertise-map map-name {exist-map|non-exist} map-name"

The other use of advertise-maps is in specifying what attribute would be carried along in the as-set attributes of an aggregate during summarization.

Assume we have R1, R2,R3 and R4 in AS 1, 2,3 and 4 respectively
R1 -- R4 --- R3
|
R2

R1, R2, and R3 advertise 150.1.x.0/24 into bgp where x is the router number.

R4 aggregates the routes to 150.1..0.0/16 with as-set attribute.
By default, none of the routers get the update anymore since their
individual routes are a part of the summary.

Using advertise map, we want to make R1 and R3 get the summary; so we only advertise the attributes of the prefix form R2 with the summary.

Using as path access-lists and route-maps on R4 we have,

ip as-path access-list 1 permit ^2$
route-map adv permit 10
match as-path 1

router bgp 4
aggregate-address 150.1.0.0 255.255.0.0 as-set summary-only advertise-map adv

Now, R1 and R3 get the summary, R2 doesn't because its AS number is carried along with the summary

R1(config-router)#do sh ip bg | i 150.1.0.0
*> 150.1.0.0 192.168.1.4 0 0 4 2 i

R2(config-router)#do sh ip bg | i 150.1.0.0
R2(config-router)#

Ok. That's it for now. Back to security :-) I was trying to look into NAC with the CTA and CSA. Fun stuff :D

Cheers,
Amplebrain

Death of Dynamips...or NOT?

Hi All,

Cisco has introduces software licensing with the IOS 15.0
My first reaction was to mourn the exiit of my faithful friend...DYNAMIPS.

But on a closer look, the IOS licensing DOES NOT directly affect dynamips.

"Cisco Software Activation is a simplified approach to software deployment and management, and is implemented on Cisco Catalyst 3750-E and 3560-E Switches and Cisco Integrated Services Routers Generation 2"

http://www.cisco.biz/en/US/products/ps9677/products_ios_technology_home.html

Dynamips CANNOT emulate the devices with licenses yet.

The Licensing hasn't been implemented on the 7200s yet so we can still run the 15.0 on the 7200 routers.

Thanks to Ivan of "Cisco IOS Hints and Tricks" for pointing this out.

http://blog.ioshints.info/2010/02/death-of-dynamips-theyve-got-it-all.html#more

I guess we can still have fun studying afterall :-)