CCIE Blog

INE’s Cisco Live 2013 Party at the Hard Rock Cafe

Brian Dennis, CCIE #2210 — Sat, 18 May 2013 03:25:55 +0000

I would like to thank the over 600 people who RSVP’d for INE’s 2013 Party at the Hard Rock Cafe in Orlando during Cisco Live. Registration is closed as of today for our party but I wanted to be the first to let everyone know about the grand prize giveaway we are doing. On top of the standard giveaway prizes (iPads, MacBook Airs, AAP Memberships, Bootcamps, etc) we are giving away a Harley Davidson 2013 XL 1200X Forty-Eight to a lucky winner during our party.

On top of the Harley Davidson 2013 XL 1200X Forty-Eight we’re having a second grand prize giveaway. Details on the second grand prize giveaway will be revealed after the drawing for the winner of the Harley Davidson at the party.

As a side note I don’t personally ride anymore but that bike really does look cool when it’s all blacked out.

New Voice Bootcamp Added Ahead of Blueprint Change

Mark Snow, CCIE #14073 — Wed, 15 May 2013 19:18:50 +0000

Again, while not officially a blueprint change just yet, it’s clearly coming. To that end we have gone ahead and taken the initiative to add another CCIE Voice bootcamp based on the current v3 blueprint.

The new date and location will be from Oct 7 – 18 in our brand new Seattle/Bellevue WA classroom and you can now register for it here.

A quick check of the Cisco CCIE Voice testing seats just now showed that there are still plenty available – with nearly one available every day between now and November in SJC, RTP and Tokyo, and fewer, but still plenty in Brussels, Bangalore and Sydney.

Those will all go quickly, just like our bootcamp seats will, so book both soon!

CCIE Voice to become CCIE Collaboration in November 2013!

Mark Snow, CCIE #14073 — Wed, 15 May 2013 16:45:20 +0000

Although the new blueprint hasn’t been “officially” announced yet, the CCIE Voice track is slated to become the CCIE Collaboration track this November, 2013. As of now only preliminary information is available, but per a reliable source the “CCIE Voice certification will be renamed CCIE Collaboration to reflect advances in networked collaboration solutions. The CCIE Collaboration certification will include voice, video, instant message, and presence.”

Stay tuned, as more information is likely to surface as we get closer to Cisco Live 2013 in Orlando. Speaking of which, it’s not too late to RSVP to INE’s CCIE Candidate Party at Cisco Live 2013. Hope to see you there!

CCIE Security Version 4 Technology Labs and Solutions – Now Available!

Brian Dennis, CCIE #2210 — Sat, 11 May 2013 06:15:30 +0000

Our new CCIE Security Version 4 Technology Labs and Solutions are now available in your members’ site account for customers who owned the previous CCIE Security Volume 1 or 2 workbooks. The labs are in the new HTML format like our Data Center material to ensure you always have the most up to date material along with allowing for advanced features (bookmarking, highlight tasks, etc). The full scale mock labs are in development now and are included with the Security workbook as we are doing away with the volume naming structure (Volume I, II, III, etc) and have gone to a single workbook.

Here is what is available in your members’ site account:

Section 1: System Hardening and Availability

Routing Protocol Authentication with RIPv2

Routing Protocol Authentication with OSPF

Routing Protocol Authentication with EIGRP

Routing Protocol Authentication with BGP4

Route Filtering with EIGRP

Route Filtering with OSPF

Route Filtering with RIPv2

Control Plane Policing

Control Plane Protection

Management Plane Protection

Disabling Unnecessary Services

Controlling Device Access

CPU Protection Mechanisms

Selective Packet Discard

Controlling Device Services

Transit Traffic Control with Flexible Packet Matching

Congestion Management

IOS File System Security

Network Telemetry Identification and Classification of Security Events

BGP TTL Security Hack

IPv6 Selective Packet Discard

Section 2: Threat Identification and Mitigation

Disabling DTP on All Non-Trunking Access Ports

Port Security on a Switch

Storm Control on a Switch

Port Blocking on a Switch

PVLAN (Private VLAN) on a Switch

Private VLAN (PVLAN) Configuration Propagation

Port ACL (PACL) on a Switch

MAC ACL on a Switch

VLAN ACL (VACL) on a Switch

Preventing STP Attacks Using BPDU Guard

Preventing STP Reconnaissance Attacks Using BPDU Filter

Preventing STP Attacks Using Root Guard

Preventing STP Loops Using Loop Guard

Preventing DHCP Spoofing Attacks Using DHCP Snooping

Preventing DHCP Spoofing Attacks Using DHCP Snooping with Port-Security

Preventing ARP Spoofing Using DAI (Dynamic ARP Inspection)

Configuring IP Source Guard

Preventing VLAN Hopping Attacks

Implementing RFC 1918 Anti-Spoofing Filtering

Implementing RFC 2827 Anti-Spoofing Filtering

Implementing RFC 3330 Anti-Spoofing Filtering

Enabling TCP Intercept on a Router

Enabling TCP Intercept Watch Mode on a Router

Enabling TCP Intercept on the Cisco ASA Security Appliance

FPM (Flexible Packet Matching) and Configuration of Nested Policy Maps

Classification Using NBAR

Understanding and Enabling NetFlow on a Router

Preventing an ICMP Attack Using ACLs

Preventing an ICMP Attack Using NBAR

Preventing an ICMP Attack Using Policing

Preventing an ICMP Attack Using MPF

Preventing a SYN Attack Using ACLs

Preventing a SYN Attack Using Policing

Preventing a SYN Attack Using CBAC

Preventing a SYN Attack Using CAR

Preventing Application Protocol–Specific Attacks Using MPF

Preventing IP Spoofing Attacks Using uRPF

Preventing Fragment Attacks Using ACLs

Section 3: Intrusion Prevention and Content Security

IPS Initial Setup

Configuring an Inline Interface Pair

Creating a Custom Signature

Event Counting

Inline Blocking

IPS VLAN Groups and Virtual Sensors

Promiscuous Mode

IPS Event Summarization

IPS Event Processing and Blocking

IPS Rate-Limiting

IPS Application Inspection and Control

IPS META Engine

IPS Anomaly Detection

IOS IPS

Section 4: Identity Management

Initializing Cisco Secure ACS

Configuring AAA Clients

User and Local Identity Stores

ACS Active Directory Integration

Command Authorization

Installing ACS Certificates

802.1x Authentication with Cisco ACS

VLAN Control

802.1x VLAN Assignments

HTTP Authentication

ISE Initial Configuration

ISE Certificates and Admin Access

AD Integration

ISE and MAB

802.1X With ISE and Windows 7

Wired Local Web Authentication with ISE

Wireless 802.1x with ISE

Section 5: Perimeter Security and Services – ASA Firewalls

VLANs and IP Addressing

RIPv2

OSPF

EIGRP

Advanced Routing

IP Access-Lists

Object Groups

Administrative Access

ICMP Traffic

URL Filtering

Dynamic NAT and PAT

Static NAT and PAT

Policy NAT and PAT

Static Policy NAT and PAT on ASA1

Static Identity NAT

Outside Dynamic NAT

DNS Doctoring Using “Alias”

DNS Doctoring Using “Static”

Fragmented Traffic

IDENT Issues

BGP across the Firewall

Stub Multicast Routing

PIM Multicast Routing

Network Time Protocol

System Logging

Filtering System Logs

SNMP Monitoring

DHCP Server

HTTP Traffic Inspection

FTP Traffic Inspection

SMTP Traffic Inspection

TCP Inspection

RADIUS Accounting for GPRS Traffic Inspection

ICMP Traffic Inspection

Threat Detection

Un-Stealthing the Firewall

Get Title

Low Latency Queuing

Traffic Shaping

Hierarchical Queuing

Transparent Firewall

ARP Inspection

Ethertype Access-Lists

Transparent Firewall NAT

Firewall Contexts

Firewall Contexts Routing

Firewall Contexts Classification

Resource Management

Active-Standby Failover

Active-Active Failover

ASA Redundant Interface and Etherchannel

ASA Enhanced Object Groups

Identity Firewall

Section 6: Perimeter Security and Services – IOS Firewalls

IOS Access-Lists

Dynamic ACLs

Reflexive ACLs

Context-Based Access Control

Port-to-Application Mapping (PAM)

IOS Firewall and Stateful Failover

IOS Firewall Performance Improvements

CBAC Connection Tuning and TCP Intercept

uRPF

Zone-Based Policy Firewall

Zone-Based Firewall HA

Simple Cisco IOS NAT

Note that additional labs for Section 6 (Perimeter Security and Services – IOS Firewalls) will be available by Tuesday along with Section 7 (Confidentiality and Secure Access).

Three iPad Mini Winners for the OSPF Virtual Link Problem

Brian Dennis, CCIE #2210 — Sat, 11 May 2013 05:29:51 +0000

I offered one iPad Mini but in the end I’m giving three iPad Mini’s away. The first one to the person who answered it first as stated in my original blog post. The second one to the first person to answer it and explain why point-to-multipoint resolved it which is also worthy of an iPad Mini. Finally a third to a very detailed answer that is just too good not to give an iPad Mini for. Next time we’ll do the first answer and the best answer.

Here are the winner’s answers in order listed above:

Jessica Odlow contact the winners on Monday to get their shipping address and iPad Mini’s shipped out.

OSPF Virtual Link Issue – First to answer wins iPad Mini

Brian Dennis, CCIE #2210 — Fri, 10 May 2013 17:07:04 +0000

There was an interesting post on IEOC yesterday in regards to an OSPF virtual link. Below is the original post and questions to win at the bottom of this post.

Okay, I have never came across anything like this before. On R2 and R3 connected via serial with HDLC. OSPF network type default to P2P. I configured VL using the OSPF RIDs of both routers. R3 VL comes up and R2 VL is down. I changed just about every option which makes logical sense and nothing works. I reboot and clear process and still nothing. Out of shear desperation I changed the network-types to P2MP on both sides and voila it works. I tried testing broadcast and that doesn’t work. Only difference I can find is the mask changed from /24 to /32 in the LSA…as it should. But I am not sure why this has any bearing on the VL coming up.

Rack1R2#show ip ospf vir

Virtual Link OSPF_VL8 to router 222.255.255.255 is down

Rack1R3#show ip ospf vir
Virtual Link OSPF_VL0 to router 150.1.2.2 is up

Rack1R2(config)#int s0/1/0
Rack1R2(config-if)#ip ospf network p
Rack1R2(config-if)#ip ospf network point-to-m
*May 9 15:28:40.599: %OSPF-5-ADJCHG: Process 1, Nbr 222.255.255.255 on Serial0/1/0 from FULL to DOWN, Neighbor Down: Interface down or detached
*May 9 15:28:41.007: %OSPF-5-ADJCHG: Process 1, Nbr 222.255.255.255 on Serial0/1/0 from LOADING to FULL, Loading Done
Rack1R2(config-if)#
*May 9 15:28:46.815: %OSPF-5-ADJCHG: Process 1, Nbr 222.255.255.255 on OSPF_VL8 from LOADING to FULL, Loading Done
Any thoughts??

Here are the relevant show commands and the configurations.

Rack1R2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     51.0.0.0/32 is subnetted, 1 subnets
O E2    51.51.51.51 [110/20] via 192.10.1.254, 00:02:11, FastEthernet0/0
     155.1.0.0/16 is variably subnetted, 18 subnets, 2 masks
O IA    155.1.146.0/24 [110/58793] via 155.1.0.5, 00:02:11, Serial0/0/0
C       155.1.23.0/24 is directly connected, Serial0/1/0
O IA    155.1.10.0/24 [110/19910] via 155.1.0.5, 00:02:11, Serial0/0/0
O IA    155.1.8.0/24 [110/19760] via 155.1.0.5, 00:02:11, Serial0/0/0
O IA    155.1.9.0/24 [110/39220] via 155.1.0.5, 00:00:06, Serial0/0/0
O IA    155.1.13.0/24 [110/97454] via 155.1.0.5, 00:00:07, Serial0/0/0
O       155.1.0.3/32 [110/38860] via 155.1.0.5, 00:00:07, Serial0/0/0
C       155.1.0.0/24 is directly connected, Serial0/0/0
O       155.1.0.1/32 [110/78024] via 155.1.0.5, 00:02:12, Serial0/0/0
O IA    155.1.7.0/24 [110/39190] via 155.1.0.5, 00:00:07, Serial0/0/0
O       155.1.0.4/32 [110/58493] via 155.1.0.5, 00:02:13, Serial0/0/0
O IA    155.1.5.0/24 [110/19730] via 155.1.0.5, 00:02:13, Serial0/0/0
O       155.1.0.5/32 [110/19430] via 155.1.0.5, 00:02:13, Serial0/0/0
O IA    155.1.58.0/24 [110/19730] via 155.1.0.5, 00:02:13, Serial0/0/0
O IA    155.1.37.0/24 [110/39160] via 155.1.0.5, 00:00:08, Serial0/0/0
O IA    155.1.79.0/24 [110/39190] via 155.1.0.5, 00:00:08, Serial0/0/0
O IA    155.1.67.0/24 [110/39190] via 155.1.0.5, 00:00:08, Serial0/0/0
O IA    155.1.108.0/24 [110/19880] via 155.1.0.5, 00:02:13, Serial0/0/0
C    192.10.1.0/24 is directly connected, FastEthernet0/0
     150.1.0.0/24 is subnetted, 10 subnets
O IA    150.1.7.0 [110/39161] via 155.1.0.5, 00:00:08, Serial0/0/0
O IA    150.1.6.0 [110/58794] via 155.1.0.5, 00:02:13, Serial0/0/0
O IA    150.1.5.0 [110/19431] via 155.1.0.5, 00:02:13, Serial0/0/0
O       150.1.4.0 [110/58494] via 155.1.0.5, 00:02:13, Serial0/0/0
O       150.1.3.0 [110/38861] via 155.1.0.5, 00:00:08, Serial0/0/0
C       150.1.2.0 is directly connected, Loopback0
O       150.1.1.0 [110/78025] via 155.1.0.5, 00:02:15, Serial0/0/0
O IA    150.1.10.0 [110/19881] via 155.1.0.5, 00:02:15, Serial0/0/0
O IA    150.1.9.0 [110/39191] via 155.1.0.5, 00:00:09, Serial0/0/0
O IA    150.1.8.0 [110/19731] via 155.1.0.5, 00:02:15, Serial0/0/0
Rack1R2#show ip ospf ne
Neighbor ID     Pri   State           Dead Time   Address         Interface
150.1.5.5         0   FULL/  -        00:01:41    155.1.0.5       Serial0/0/0
222.255.255.255   0   FULL/  -        00:00:30    155.1.23.3      Serial0/1/0
192.10.1.254      1   FULL/DR         00:00:34    192.10.1.254    FastEthernet0/0
Rack1R2#show ip ospf int br
Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
Lo0          1     0               150.1.2.2/24       1     P2P   0/0
Se0/0/0      1     0               155.1.0.2/24       19430 P2MP  1/1
VL8          1     0               0.0.0.0/0          65535 DOWN  0/0
Se0/1/0      1     5               155.1.23.2/24      19430 P2P   1/1
Fa0/0        1     51              192.10.1.2/24      300   BDR   1/1
Rack1R2#show ip ospf int
Loopback0 is up, line protocol is up
  Internet Address 150.1.2.2/24, Area 0
  Process ID 1, Router ID 150.1.2.2, Network Type POINT_TO_POINT, Cost: 1
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 2/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)
Serial0/0/0 is up, line protocol is up
  Internet Address 155.1.0.2/24, Area 0
  Process ID 1, Router ID 150.1.2.2, Network Type POINT_TO_MULTIPOINT, Cost: 19430
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_MULTIPOINT
  Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5
    oob-resync timeout 120
    Hello due in 00:00:24
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/3, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 2
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 150.1.5.5
  Suppress hello for 0 neighbor(s)
OSPF_VL8 is down, line protocol is down
  Internet Address 0.0.0.0/0, Area 0
  Process ID 1, Router ID 150.1.2.2, Network Type VIRTUAL_LINK, Cost: 65535
  Configured as demand circuit.
  Run as demand circuit.
  DoNotAge LSA allowed.
  Transmit Delay is 1 sec, State DOWN
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
Serial0/1/0 is up, line protocol is up
  Internet Address 155.1.23.2/24, Area 5
  Process ID 1, Router ID 150.1.2.2, Network Type POINT_TO_POINT, Cost: 19430
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:05
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/4, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 9, maximum is 26
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 222.255.255.255
  Suppress hello for 0 neighbor(s)
FastEthernet0/0 is up, line protocol is up
  Internet Address 192.10.1.2/24, Area 51
  Process ID 1, Router ID 150.1.2.2, Network Type BROADCAST, Cost: 300
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 192.10.1.254, Interface address 192.10.1.254
  Backup Designated router (ID) 150.1.2.2, Interface address 192.10.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:07
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/2, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 9, maximum is 27
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 192.10.1.254  (Designated Router)
  Suppress hello for 0 neighbor(s)
Rack1R2#show run
Building configuration...
Current configuration : 1681 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Rack1R2
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable password cisco
!
no aaa new-model
memory-size iomem 15
!
dot11 syslog
ip source-route
no ip icmp rate-limit unreachable
!
!
ip cef
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 150.1.2.2 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
!
interface FastEthernet0/0
 ip address 192.10.1.2 255.255.255.0
 ip ospf 1 area 51
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/0/0
 ip address 155.1.0.2 255.255.255.0
 encapsulation frame-relay
 ip ospf network point-to-multipoint non-broadcast
 ip ospf priority 0
 ip ospf 1 area 0
 frame-relay map ip 155.1.0.5 205
 no frame-relay inverse-arp
 frame-relay lmi-type cisco
!
interface Serial0/1/0
 ip address 155.1.23.2 255.255.255.0
 ip ospf 1 area 5
!
router ospf 1
 router-id 150.1.2.2
 log-adjacency-changes
 auto-cost reference-bandwidth 30000
 area 5 virtual-link 222.255.255.255
 neighbor 155.1.0.5
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
access-list 100 permit ospf any any
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
line vty 0 4
 password cisco
 login
!
scheduler allocate 20000 1000
end
Rack1R2#

Rack1R3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     51.0.0.0/32 is subnetted, 1 subnets
O E2    51.51.51.51 [110/20] via 155.1.0.5, 00:03:23, Serial1/0
     155.1.0.0/16 is variably subnetted, 18 subnets, 2 masks
O IA    155.1.146.0/24 [110/104898] via 155.1.0.5, 01:37:37, Serial1/0
C       155.1.23.0/24 is directly connected, Serial1/3
O IA    155.1.10.0/24 [110/66015] via 155.1.0.5, 01:37:04, Serial1/0
O IA    155.1.8.0/24 [110/65865] via 155.1.0.5, 01:37:04, Serial1/0
O       155.1.9.0/24 [110/360] via 155.1.37.7, 01:56:21, FastEthernet0/0
C       155.1.13.0/24 is directly connected, Serial1/2
O       155.1.0.2/32 [110/84965] via 155.1.0.5, 00:03:24, Serial1/0
C       155.1.0.0/24 is directly connected, Serial1/0
O       155.1.0.1/32 [110/124129] via 155.1.0.5, 01:37:39, Serial1/0
O       155.1.7.0/24 [110/330] via 155.1.37.7, 01:56:22, FastEthernet0/0
O       155.1.0.4/32 [110/104598] via 155.1.0.5, 01:37:40, Serial1/0
O IA    155.1.5.0/24 [110/65835] via 155.1.0.5, 01:37:40, Serial1/0
O       155.1.0.5/32 [110/65535] via 155.1.0.5, 01:37:40, Serial1/0
O IA    155.1.58.0/24 [110/65835] via 155.1.0.5, 01:37:40, Serial1/0
C       155.1.37.0/24 is directly connected, FastEthernet0/0
O       155.1.79.0/24 [110/330] via 155.1.37.7, 01:56:23, FastEthernet0/0
O       155.1.67.0/24 [110/330] via 155.1.37.7, 01:56:23, FastEthernet0/0
O IA    155.1.108.0/24 [110/65985] via 155.1.0.5, 01:37:06, Serial1/0
     222.255.255.0/32 is subnetted, 1 subnets
C       222.255.255.255 is directly connected, Loopback222
O IA 192.10.1.0/24 [110/85265] via 155.1.0.5, 00:03:25, Serial1/0
     150.1.0.0/24 is subnetted, 10 subnets
O       150.1.7.0 [110/301] via 155.1.37.7, 01:56:23, FastEthernet0/0
O IA    150.1.6.0 [110/104899] via 155.1.0.5, 01:37:40, Serial1/0
O IA    150.1.5.0 [110/65536] via 155.1.0.5, 01:37:40, Serial1/0
O       150.1.4.0 [110/104599] via 155.1.0.5, 01:37:41, Serial1/0
C       150.1.3.0 is directly connected, Loopback0
O       150.1.2.0 [110/84966] via 155.1.0.5, 00:03:26, Serial1/0
O       150.1.1.0 [110/124130] via 155.1.0.5, 01:37:41, Serial1/0
O IA    150.1.10.0 [110/65986] via 155.1.0.5, 01:37:08, Serial1/0
O       150.1.9.0 [110/331] via 155.1.37.7, 01:56:24, FastEthernet0/0
O IA    150.1.8.0 [110/65836] via 155.1.0.5, 01:37:08, Serial1/0
Rack1R3#show ip ospf ne
Neighbor ID     Pri   State           Dead Time   Address         Interface
150.1.5.5         0   FULL/  -        00:01:51    155.1.0.5       Serial1/0
150.1.7.7         1   FULL/DR         00:00:39    155.1.37.7      FastEthernet0/0
150.1.1.1         0   FULL/  -        00:00:39    155.1.13.1      Serial1/2
150.1.2.2         0   FULL/  -        00:00:39    155.1.23.2      Serial1/3
Rack1R3#show ip ospf int br
Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
VL0          1     0               155.1.23.3/24      65535 P2P   0/0
Lo0          1     0               150.1.3.3/24       1     P2P   0/0
Se1/0        1     0               155.1.0.3/24       65535 P2MP  1/1
Fa0/0        1     2               155.1.37.3/24      300   BDR   1/1
Se1/2        1     4               155.1.13.3/24      65535 P2P   1/1
Se1/3        1     5               155.1.23.3/24      65535 P2P   1/1
Rack1R3#show ip ospf int
OSPF_VL0 is up, line protocol is up
  Internet Address 155.1.23.3/24, Area 0
  Process ID 1, Router ID 222.255.255.255, Network Type VIRTUAL_LINK, Cost: 65535
  Configured as demand circuit.
  Run as demand circuit.
  DoNotAge LSA allowed.
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 3/6, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 2, maximum is 7
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)
Loopback0 is up, line protocol is up
  Internet Address 150.1.3.3/24, Area 0
  Process ID 1, Router ID 222.255.255.255, Network Type POINT_TO_POINT, Cost: 1
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 2/5, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)
Serial1/0 is up, line protocol is up
  Internet Address 155.1.0.3/24, Area 0
  Process ID 1, Router ID 222.255.255.255, Network Type POINT_TO_MULTIPOINT, Cost: 65535
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_MULTIPOINT
  Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5
    oob-resync timeout 120
    Hello due in 00:00:18
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/2, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 16
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 150.1.5.5
  Suppress hello for 0 neighbor(s)
FastEthernet0/0 is up, line protocol is up
  Internet Address 155.1.37.3/24, Area 2
  Process ID 1, Router ID 222.255.255.255, Network Type BROADCAST, Cost: 300
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 150.1.7.7, Interface address 155.1.37.7
  Backup Designated router (ID) 222.255.255.255, Interface address 155.1.37.3
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:08
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 6, maximum is 27
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 150.1.7.7  (Designated Router)
  Suppress hello for 0 neighbor(s)
Serial1/2 is up, line protocol is up
  Internet Address 155.1.13.3/24, Area 4
  Process ID 1, Router ID 222.255.255.255, Network Type POINT_TO_POINT, Cost: 65535
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:08
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/3, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 6, maximum is 28
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 150.1.1.1
  Suppress hello for 0 neighbor(s)
Serial1/3 is up, line protocol is up
  Internet Address 155.1.23.3/24, Area 5
  Process ID 1, Router ID 222.255.255.255, Network Type POINT_TO_POINT, Cost: 65535
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/4, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 28
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 150.1.2.2
  Suppress hello for 0 neighbor(s)
Rack1R3#show run
Building configuration...
Current configuration : 1817 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Rack1R3
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable password cisco
!
no aaa new-model
memory-size iomem 10
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 150.1.3.3 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
!
interface Loopback222
 ip address 222.255.255.255 255.255.255.255
!
interface FastEthernet0/0
 mtu 1504
 ip address 155.1.37.3 255.255.255.0
 ip ospf 1 area 2
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial1/0
 ip address 155.1.0.3 255.255.255.0
 encapsulation frame-relay
 ip ospf network point-to-multipoint non-broadcast
 ip ospf priority 0
 ip ospf 1 area 0
 frame-relay map ip 155.1.0.5 305
 no frame-relay inverse-arp
 frame-relay lmi-type cisco
!
interface Serial1/1
 no ip address
 shutdown
!
interface Serial1/2
 ip address 155.1.13.3 255.255.255.0
 ip ospf 1 area 4
 clock rate 64000
!
interface Serial1/3
 ip address 155.1.23.3 255.255.255.0
 ip ospf 1 area 5
 clock rate 64000
!
router ospf 1
 log-adjacency-changes
 auto-cost reference-bandwidth 30000
 area 5 virtual-link 150.1.2.2
 neighbor 155.1.0.5
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
line vty 0 4
 password cisco
 login
!
scheduler allocate 20000 1000
end
Rack1R3#

So to win the iPad Mini you need to answer what is causing the OSPF virtual link not to come up to begin with and why.

Technically I already won but I’m not eligible to win prizes.

CCIE Data Center – Implementing Nexus – Videos Now Available

Brian Dennis, CCIE #2210 — Tue, 07 May 2013 00:02:12 +0000

Our new “CCIE Data Center – Implementing Nexus” course is now available in AAP and members site accounts. The course is just under 18 hours in length and covers the Nexus 7k, 5k and 2k platforms. It’ll be available for direct purchase in the next few hours.

http://www.ine.com/all-access-pass/training/playlist/ccie-dc-implementing-nexus

Cisco Catalyst 3850 – QoS Quick Note

Brian Dennis, CCIE #2210 — Mon, 06 May 2013 16:57:17 +0000

I recently added a couple Catalyst 3850′s to my development rack as we are starting to develop them internally. I’ll do a few more detailed blog posts on the Catalyst 3850 in the near future but I just wanted to show how simple it is to perform basic QoS functions using the MQC on the 3850. Below is the configuration to limit VLAN 15 traffic received on a trunk link from a router to 512k.

class-map match-any test
  match vlan  15
!
policy-map test
 class test
    police cir 512000
!
interface GigabitEthernet1/0/5
 switchport mode trunk
 load-interval 30
 service-policy input test

Not only is it extremely simple to configure and intuitive from an IOS perspective but you actually get output from the show policy-map command.

Rack1SW1#sho policy-map interface g1/0/5
 GigabitEthernet1/0/5 

  Service-policy input: test

    Class-map: test (match-any)
      Match: vlan  15
      police:
          cir 512000 bps, bc 16000 bytes
        conformed 18935704 bytes; actions:
          transmit
        exceeded 761225593 bytes; actions:
          drop
        conformed 0000 bps, exceed 0000 bps

    Class-map: class-default (match-any)
      Match: any
Rack1SW1#

I can’t imagine having to use the 3750 or 3560 switch anymore after working on the 3850 much less doing QoS on them. Basically if you know the IOS then you already know how to configure the 3850.

Rack1SW1#sho ver | in Software
Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.02.01.SE RELEASE SOFTWARE (fc1)
Rack1SW1#

Service Provider CCIE Rack Pricing Change

Brian Dennis, CCIE #2210 — Fri, 03 May 2013 01:48:48 +0000

Now that we’re at 12 full Service Provider CCIE racks and going to 16 racks I’ve had the price of the rentals dropped from 30 tokens to 18 tokens to be more in line with utilization. Another reason the prices were lowered – I received a lot of requests on Twitter to lower the price

INE’s CCIE Data Center Rack Rentals Now Public

Brian McGahan, CCIE #8593, CCDE #2013::13 — Thu, 02 May 2013 18:09:34 +0000

First off I’d like to thank all of you that participated in beta testing both the CCIE Data Center Technology Lab Workbook and DC Rack Rentals, and for all the constructive feedback that was submitted. Yesterday the DC rack system left beta, and is now publicly available for bookings.

Data Center rack rentals cost 20 tokens for the base topology, which includes Nexus 7000, Nexus 5000, and Virtual Machines. There are three add-ons to the topology, which are Nexus 2000 & SAN, UCS & SAN, and ACE 4710. Each of the add-ons cost 5 tokens apiece, which means the maximum cost for the full topology is 35 tokens per session. With bulk token pricing this equates to about $11 USD per hour for rental, which is much more affordable than any other vendor out there.

For more detailed information on how to book sessions and use the system, please see the CCIE Data Center Rack Rental Access Guide.

Before the end of the month we will also be launching a second “Mock Lab” Data Center topology that will be used for full-scale 8-hour lab scenarios. More information about the availability of rentals on this topology will be posted soon.

Happy Labbing!