Cisco - Himawan Nugroho CCIE 8171 - How to Pass CCIE Lab - Insider Tips

Share Embed Donate


Short Description

Download Cisco - Himawan Nugroho CCIE 8171 - How to Pass CCIE Lab - Insider Tips...

Description

How to Pass CCIE Lab: Insider’s Tips

Himawan Nugroho, CCIE #8171

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

1

About the Speaker Just another guy who wishes to be an expert one day. Discovers the future one day at a time. His greatest fear is becoming a guy without specialties. The first and the only Indonesian Triple CCIE till date.  Triple CCIE #8171 in Routing & Switching, Security and Service Provider track  8+ years experience in Networking: SP, Data Center, UC, Wireless, Security  Broad experience within Asia Pacific and Middle East 2000 – 2001 Schlumberger Omnes, Indonesia NOC Engineer to maintain the internal network within Asia and Australia 2001 – 2002 IBM Global Services, Indonesia Pre-sales and Network Consultant 2002 – 2006 Emirates Computers, Dubai, United Arab Emirates Pre-sales, Lead Engineer, Network Consultant, Technical Project Manager 2006 – now Cisco Advanced Services, Asia Pacific, based in Singapore Network Consulting Engineer  Currently working in several projects in different countries for Petronas (Malaysia), CAT (Thailand), Starhub Cable Vision (Singapore), VDC (Vietnam) and Telkomsel (Indonesia)  Personal websites: http://brokenpipes.blogspot.com and http://himawan.blogsome.com

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

2

Cisco Services Lifecycle Coordinated Planning and Strategy Make Sound Financial Decisions Prepare

Operational Excellence Adapt to Changing Business Requirements

Optimize

CISCO

Plan

Assess Readiness Can Your Network Support the Proposed System?

PARTNER Maintain Network Health Manage, Resolve, Repair, Replace

CUSTOMER Operate

Design

Design the Solution Products, Service, Support Aligned to Requirements

Implement

Implement the Solution Integrate Without Disruption or Causing Vulnerability Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

3

Cisco Advanced Services Cisco Advanced Services offer a comprehensive set of services that enables customer success by providing planning, design, implementation and optimization services for Cisco Technologies Transactional Services: Readiness assessment and deployment of new technologies onto the network

Prepare

Plan

Design

Implement

Subscription Services: Improving and optimizing network availability and performance of the Customer network

Operate

Optimize

Learn more about Cisco Services: http://www.cisco.com/en/US/products/svcs/services_area_root.html Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

4

Cisco Certification and CCIE Overview

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

5

Cisco Certification Three Levels of IT Certification Cisco offers three levels of general IT certification: Associate, Professional, and Expert (CCIE representing the highest level of achievement) Six Different Paths Various tracks—Routing and Switching, Network Security, Service Provider, Storage Area Network, IP Telephony and Network Design—are available, so that network professionals can match the certification path to their job role or industry IT Certification in Focused Areas In addition to general certifications, network professionals can enhance their core networking knowledge by achieving specialist certification in technologies such as security, IP telephony, and wireless

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

6

Cisco Certification

Service Provider Routing & Switching IP Telephony

Network Security

Network Design Storage Area Network

http://www.cisco.com/web/learning/le3/learning_career_certifications_and_learning_paths_home.html Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

7

CCIE Program Overview  Most highly regarded IT certification for over 14 years  Identifies those with expert level skills and experience  Exams continually updated and revised with new technologies  Requires passing difficult, handson lab exam

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

8

CCIE Certification Process • CCIEs must pass two exams, written and lab • The written qualification exam has 100 multiple-choice questions • The lab exam is what makes CCIE different. The full-day, hands-on lab exam tests the ability to configure and troubleshoot equipment • Not all lab exams are offered at all lab locations Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

9

CCIE Tracks and Process

Routing and Switching

Written

LAB

Security

Written

LAB

Voice

Written

LAB

Service Provider

Written

Storage networking

Written

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

LAB LAB

10

Process: CCIE Written  Available worldwide at Prometric and VUE for $300 USD, adjusted for exchange rate and local taxes where applicable  Two-hour exam with 100 multiple-choice questions  Closed book; no outside reference materials allowed  Pass/fail results are available immediately following the exam; the passing score is set by statistical analysis and is subject to periodic change  Waiting period of 72 hours between attempts  Must schedule first lab exam attempt within 18 months

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

11

Process: CCIE Lab  Available in select Cisco locations for $1250 USD, adjusted for exchange rates and local taxes where applicable, not including travel and lodging  Eight-hour exam requires working configurations and troubleshooting to demonstrate expertise  Cisco documentation available in room; no personal materials of any kind allowed in lab  Minimum score of 80% to pass  Scores can be viewed online within 48 hours and failing score reports indicate areas where additional study may be useful Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

12

CCIE Lab Layout Racks Are Fully Cabled

Candidates Do Not Have to Touch Racks Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

13

CCIE Lab Exam Grading  Proctors are responsible for grading all lab exams  Automatic tools aid proctors with simple grading tasks (e.g., capturing candidate’s configuration in database, basic configuration verifications, ping tests, etc.)  Automatic tools are never solely responsible for lab exam grading—proctors are  The proctor completes the grading of the exam and submits the final score  Partial marks are not awarded for questions  Points are awarded for working solutions only  Some questions have multiple solutions Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

14

CCIEs Worldwide

 Less than three percent of all Cisco certified professionals  Just 15,600 (active) around the world  Earn the respect of colleagues and employers  Show strong commitment to training, study, and education to maintain certification

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

15

CCIEs Worldwide (Nov 2007) Total of Worldwide CCIEs:

15658 (11.14.2007)

Total of Routing and Switching CCIEs:

14329

Total of Security CCIEs:

1207

Total of Service Provider CCIEs:

650

Total of Storage Networking CCIEs:

99

Total of Voice CCIEs:

601

Total of Indonesian CCIEs

41

Total with multiple certifications worldwide:

1344

Total of Routing and Switching and Security CCIEs:

517 (1)

Total of Routing and Switching and Service Provider CCIEs:

300 (1)

Total of Routing and Switching and Storage Networking CCIEs:

23

Total of Routing and Switching and Voice CCIEs:

182 (1)

Total with 3 or more certifications

210 (1)

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

16

CCIE Service Provider Track

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

17

“CCIE is not a rocket science. It just needs dedication, strategy and hard work.”

Anonymous, first heard on the Internet 8 years ago

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

18

CCIE SP Overview  CCIE Service Provider certification indicates expert level knowledge and skill in SP technologies such as IP routing, Multicast, SP QoS and Security, MPLS, L2/L3 VPN, Traffic Engineering, Multi-Protocol BGP, and High Availability  The CCIE Service Provider certification was introduced in 2001  Not all Service Provider technologies appear in lab exam. CCIE SP lab exam focuses on building SP core networks and deploying SP common services (Please refer to lab exam blueprint.)  The specific SP networking technology, such as Dial, DSL, Cable, IPT, Content Networking, Optical WAN switching and Metro-E, only appear in written exam (Including the new CRS and IOS XR, please refer to written exam blueprint.)

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

19

CCIE SP Written Blueprint The written exam is a two-hour, multiple-choice, computer-based exam. CCIE Service Provider written exam blueprint: http://www.cisco.com/web/learning/le3/ccie/sp/comprehensive_blueprint.html

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

20

CCIE SP Written Question* Which statements about ISDN LADP are true? (Multiple answers) A. ISDN LAPD allows multiplexing of multiple logical data links on D channel B. ISDN LAPD is only relevant to BRI, not PRI C. ISDN LAPD has framing, sequence control, and an error detection mechanism D. ISDN LAPD does not have flow control mechanism Answer (A,C)

*Taken from Networkers 2005 Slides Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

21

CCIE Service Provider Lab  The Service Provider lab is an eight-hour exam that requires implementing comprehensive networking solutions and managed services to certain specifications. Technologies such as MP-BGP, MPLS, Traffic Engineering, VPN, SP security, SP multicast and SP QoS are emphasized in the exam  Candidates are not required to configure any end-user systems, but are responsible for any device residing in the network  Each configuration scenario and problem has pre-assigned point values  The candidate must obtain a minimum mark of 80% to pass

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

22

CCIE SP Lab Locations Beijing

RTP

Brussels



Sydney

San Paulo

Five worldwide CCIE lab locations for SP Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

23

CCIE SP Lab Blueprint CCIE Service Provider lab exam blueprint: http://www.cisco.com/web/learning/le3/ccie/sp/lab_exam_blueprint.html

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

24

SP Lab Equipments & IOS Lab may test any feature that can be configured on the equipment and IOS versions listed below. More recent versions may be installed in the lab, but you won’t be tested on them http://www.cisco.com/web/learning/le3/ccie/sp/lab_equipment.html  Cisco 7200 series routers IOS 12.2S (SERVICE PROVIDER/SECURE SHELL 3DES)  Cisco 3700 series routers IOS 12.3T (ENTERPRISE PLUS/H323 MCM)  Cisco 3600 series routers IOS 12.3T (ENTERPRISE PLUS/H323 MCM)  Cisco 2600 series routers IOS 12.2T (ENTERPRISE PLUS/H323 MCM)  Catalyst 3550 series switches IOS 12.2 (IP SERVICES) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

25

SP Lab Equipments in Rack  The equipment on the rack assigned to you is physically cabled and should NOT be tampered with. Before starting the Exam, confirm working order of all devices in your rack  During the exam, if any device is locked or inaccessible for any reason, you must recover it  When finishing the exam, ensure all devices are accessible for the grading proctor. Any devices that are not accessible for grading; can not be marked and may cause you to lose substantial points

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

26

CCIE SP Lab Logical Layout ATM/Eth BB

 High end routers form Multiple AS SP core  Low end routers and switches run as access routers  Backbone routers provide diverse information injection

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

SP Core

Access Net

27

CCIE SP Lab: Rack Access Candidate Workstation

Candidate Rack

Ethernet Exam Routers

Candidate PC Comm Server Corp Network

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

28

SP Lab: Pre configuration  The CCIE SP lab exam is preconfigured with basic layer 2 protocol on the devices, giving the candidate more exam time to work on SP-specific technologies  The routers and switches in your topology are preconfigured with Basic IP addressing, Hostname, passwords Switching; Trunk, VTP, VLANs Frame Relay; DLCI mapping (static/dynamic) All pre-configured passwords are 'cisco‘

 Do NOT change any pre-configuration on any device(s) unless explicitly stated in a question

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

29

SP Lab: Pre configuration  Candidate is responsible to make sure preconfiguration working properly  Useful command to verify pre-configuration Show vtp domain Show vtp status Show vlans Show interface trunk Show frame-relay map Show frame-relay pvc Show interface (type) (s/p.x)

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

30

SP Lab: Sample Topology* 131.yy.22.0/24 Fa0/0 131.yy.62.0/24

E0/0 S0/0 S0/1

R2

Fa0/0

R4

131.yy.46.0/24 S0/0.6 S0/1

10.yy.45.0/28

R5

Fa0/0

Fa0/0

176.16.yy.16/29

10.yy.5.0/24

XYZ, Site1

ABC,Site1

© 2008 Cisco Systems, Inc. All rights reserved.

XYZ,Site2

S0/1

R1

Presentation_ID

Fa0/1

E0/0

FR

176.16.yy.24/29

R3 176.16.yy.8/29

S0/0.2

FR S0/1

172.17.yy.0/24

S0/0 131.yy.24.0/24

FR

R6

BackboneA

Cisco Public

*Taken from Networkers 2005 Slides 31

SP Lab: IGP/BGP/VPN*

ISIS Area 49.0010 BGP AS 246

R2

R3 OSPF Area 10 R4

FR

XYZ,Site2

R6 FR

FR BGP AS 100

R1

R5 RIP V2

XYZ, Site1 Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

ABC,Site1 Cisco Public

*Taken from Networkers 2005 Slides 32

SP Lab: Sample Questions* Q2.1 Basic ISIS R2, R4, and R6 Form the SP Core; Configure IS-IS on All Links Between Routers R2, R4, and R6 Using Area 49.0010 Only Level-2 ISIS Adjacency Can Be Established; After Configuration, All Subnets Within ISIS Domain Should Be Reachable

Score: 4 Points *Taken from Networkers 2005 Slides Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

33

SP Lab: ISIS configuration R2

R4

interface FastEthernet0/0

interface Serial0/0

ip address 131.2.62.2 255.255.255.0

no ip address

ip router isis

encapsulation frame-relay

!

!

interface Serial0/0

interface Serial0/0.2 multipoint

ip address 131.2.24.2 255.255.255.0

ip address 131.2.24.4 255.255.255.0

ip router isis

ip router isis

encapsulation frame-relay

frame-relay map clns 402 broadcast

frame-relay map clns 204 broadcast

frame-relay map ip 131.2.24.2 402 broadcast

frame-relay map ip 131.2.24.4 204 broadcast

!

!

interface Serial0/0.6 multipoint

interface FastEthernet0/1

ip address 131.2.46.4 255.255.255.0

ip address 131.2.22.2 255.255.255.0

ip router isis

ip router isis

frame-relay map clns 406 broadcast

!

frame-relay map ip 131.2.46.6 406 broadcast

router isis

!

net 49.0010.0000.0000.2222.00

router isis

is-type level-2-only

net 49.0010.0000.0000.4444.00 is-type level-2-only

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

34

SP Lab: ISIS configuration R6 interface Ethernet0/0 ip address 131.2.62.6 255.255.255.0 ip router isis ! interface Serial0/0 ip address 131.2.46.6 255.255.255.0 ip router isis encapsulation frame-relay frame-relay map clns 604 broadcast frame-relay map ip 131.2.46.4 604 broadcast frame-relay lmi-type ansi ! router isis net 49.0010.0000.0000.6666.00 is-type level-2-only

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

35

SP Lab: ISIS verification Rack02R6# show ip route isis 131.2.0.0/24 is subnetted, 6 subnets i L2

131.2.4.4/32 [115/20] via 131.2.46.4, Serial0/0

i L2

131.2.2.2/32 [115/20] via 131.2.62.2, Ethernet0/0

i L2

131.2.22.0

[115/20] via 131.2.62.2, Ethernet0/0

i L2

131.2.24.0

[115/20] via 131.2.62.2, Ethernet0/0 [115/20] via 131.2.46.4, Serial0/0

Rack02R6# show clns neighbors System Id

Interface SNPA

State Holdtime Type Protocol

Rack02R2

Et0/0

000b.beee.4150

Up

8

L2

IS-IS

Rack02R4

Se0/0

DLCI 604

Up

27

L2

IS-IS

Rack02R4# ping 131.2.24.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 131.2.24.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/12 ms

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

36

SP Lab: Sample Questions* Q4.2 MPLS/VPN Configure MPLS/VPN to Make Sure That Networks Belong to XYZ Company Are Able to Access Each Other Between Site1 and Site2, and Only XYZ Site1 Networks Are Able to Access ABC Company Site1 Networks

Score: 4 Points *Taken from Networkers 2005 Slides Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

37

SP Lab: VPN configuration R4 router bgp 246

ip vrf abc

neighbor 131.2.2.2 remote-as 246

rd 246:45

neighbor 131.2.2.2 update-source Loopback0

route-target export 246:45

neighbor 131.2.6.6 remote-as 246

route-target import 246:45

neighbor 131.2.6.6 update-source Loopback0

route-target import 246:16

!

!

address-family vpnv4

ip vrf xyz

neighbor 131.2.2.2 activate

rd 246:34

neighbor 131.2.2.2 send-community both

route-target export 246:34

neighbor 131.2.6.6 activate

route-target import 246:34

neighbor 131.2.6.6 send-community both

route-target import 246:16

!

!

address-family ipv4 vrf xyz

interface Ethernet0/0

redistribute connected

ip vrf forwarding xyz

!

ip address 172.17.34.3 255.255.255.0

address-family ipv4 vrf abc

!

redistribute connected

interface Serial0/1 ip vrf forwarding abc ip address 10.2.45.4 255.255.255.0 Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

38

SP Lab: VPN configuration R6 ip vrf xyz

router bgp 246

rd 246:16

neighbor 131.2.2.2 remote-as 246

route-target export 246:16

neighbor 131.2.2.2 update-source Loopback0

route-target import 246:16

neighbor 131.2.4.4 remote-as 246

route-target import 246:34

neighbor 131.2.4.4 update-source Loopback0

route-target import 246:45

!

!

address-family vpnv4

interface Serial0/1

neighbor 131.2.2.2 activate

ip vrf forwarding xyz

neighbor 131.2.2.2 send-community both

ip address 172.16.16.6 255.255.255.0

neighbor 131.2.4.4 activate

encapsulation frame-relay

neighbor 131.2.4.4 send-community both

!

! address-family ipv4 vrf xyz redistribute connected !

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

39

SP Lab: VPN verification Rack02R4# show ip vrf detail

Rack02R6# show ip vrf detail

VRF abc; default RD 246:45; default VPNID

VRF xyz; default RD 246:16; default VPNID

Interfaces:

Interfaces:

Serial0/1

Serial0/1

Connected addresses are not in global routing table

Connected addresses are not in global routing table

Export VPN route-target communities

Export VPN route-target communities

RT:246:45

RT:246:16

Import VPN route-target communities RT:246:45

RT:246:16

Import VPN route-target communities RT:246:16

RT:246:34

RT:246:45

No import route-map VRF xyz; default RD 246:34; default VPNID

No export route-map

Interfaces: Ethernet0/0 Connected addresses are not in global routing table Export VPN route-target communities RT:246:34 Import VPN route-target communities RT:246:34

Presentation_ID

RT:246:16

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

40

How to Become a CCIE

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

41

“It was not because of luck. It was not given. It was not a gift. It was dedication, hard work, strategy, make sacrifice and so on. And when the time is right, make a decision and stick with it.”

Himawan Nugroho http://himawan.blogsome.com

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

42

How to Become CCIE  There is abundance of material available to prepare for the CCIE certification. However, you have to be very selective of the material you choose to use  Customize your study plan to reflect your own personal strengths and weaknesses. A good study plan is key to your success  There are many sample scenarios available on the Tech Support pages for each Cisco product and technology.  Documentation CD is the only resource you are allowed during the exam and you will need to be able to look up anything you need with speed and confidence  Build and practice scenarios for each topic in blueprint. Go beyond the basics—practice additional features  If a technology has multiple configurations—practice all of them. Learn show and debug commands for each topic Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

43

Himawan’s Steps to CCIE 1. Ask your self what’s the reason to become CCIE -

It’s a very tough challenge, candidates must sacrifice social life, time, and money, so there must be a good reason to do it

-

No need to impress others with the reason, just find it and believe it since it may be the only one that keep you going

2. Use the mid-level certification -

For R&S track, learn CCNP. For SP track, learn CCIP. For Voice track, learn CCVP. For Security track, learn CCSP.

-

You don’t have to pass the exam, but use the material

-

Passing the exam can help as checkpoint to see the progress of your study, and to get small reward during CCIE journey

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

44

Himawan’s Steps to CCIE 3. Build your home lab -

Not necessary to build complete topology, 3-4 routers will do

-

Build home lab with simulator/emulator, rent other devices

Dynamips http://www.ipflow.utc.fr/ index.php/Cisco_7200_Simulator Dynagen http://www.dynagen.org GNS3 http://www.gns3.net

4. Just pass the written test -

Passing written test doesn’t mean you are half-CCIE

-

Written and Lab blueprint sometime don’t match, so just get 70 to pass and register for the lab

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

45

Himawan’s Steps to CCIE 5. Read, read, read then practice, practice, practice -

CCO (www.cisco.com), configuration guide and sample config

-

Networkers, Google, Safari Online, use Blueprint as guidance

-

Use COD and workbook from CCIE Preparation vendor, i.e. Internetwork Expert http://www.internetworkexpert.com

6. Fast and Furious, with common sense -

For R&S and Security track, there are many tricks from new features. So try to finish the obvious as soon as possible then use Documentation CD to find the answers

-

For SP lab, Documentation CD is not our best friend anymore

-

Sometime, do it once and do it right is the only way to pass

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

46

Himawan’s Steps to CCIE 7. Join the community, build a healthy discussion group -

CCIE is a one-man-journey type of experience

-

Knowing there are others who face the same challenge is good enough to boost your spirit

-

Respect others, especially those who are willing to answer

8. Learn how to ask the right questions -

Do your own research, RTFM, first before asking questions

-

In discussion group, answer people questions if you expect them to answer yours

-

Proctors can provide hints if you ask the right question

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

47

Himawan’s Steps to CCIE 9. Understand the lab questions -

Don’t make assumption, ask proctors for any dispute, admit that we were not born in english-speaking country

-

When it looks so confusing, sit back and analyze the questions as a single unit. Use helicopter-view and global perspective to understand the whole topology and traffic flow

10. Skeptical is one the most important attitudes, among others -

Trust no one, trust no solution. Don’t trust any answer unless you try and prove it by yourself in your lab

-

Always ask questions: why? How come? What if? How to prove that? What if I add this? How if I answer it that way?

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

48

Himawan’s Steps to CCIE 11. CCIE is nothing but a mind game -

You need the right attitude and mindset to pass

-

Stay away from people who keep saying you can’t pass. Himawan says everyone has the same chance to pass

-

Be positive, adaptable, able to work and think under pressure

12. Enjoy every moment of it -

No one can describe the journey, you need to do it to feel it

-

Follow your heart, do it only because you really like it

-

Discuss your plan with others who love and care about you

-

Be in the moment, try to have fun even you must study in between your busy time. Feel every aspect of the journey. Enjoy every moment of it.

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

49

Some Links for CCIE Scott Morris, Quad CCIE, “So you want to be a CCIE?” http://certcities.com/editorial/features/story.asp?EditorialsID=89 Yusuf Bhaiji, CCIE Security Program Manager, “Insider’s Tips on Earning your CCIE in Security” (Packet Magazine, Aug 2004, Page 18) http://www.cisco.com/web/about/ac123/ac114/downloads/packet/packet/aug04/pdf s/aug04.pdf Himawan’s “How to Become CCIE” package: -

How to Become CCIE

http://brokenpipes.blogspot.com/2006/02/how-to-become-ccie.html -

How to Become CCIE v2

http://brokenpipes.blogspot.com/2008/03/how-to-become-ccie-v2.html -

How to Become CCIE on Amazon

http://www.amazon.com/gp/richpub/syltguides/fullview/BYNHY05D4X84 -

How to Become CCIE v2 on Amazon

http://www.amazon.com/gp/richpub/syltguides/fullview/RLUWDJWTD4FN2 -

Become a CCIE with Simulator

http://brokenpipes.blogspot.com/2006/09/become-ccie-with-simulator.html Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

50

Sharing My CCIE Journey Experience

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

51

“ First CCIE, is for my family and to send the message to the world that even a mere mortal like me can pass the lab. Second CCIE, is to impress Cisco so I can join Cisco AS team. Third CCIE, is for myself.”

Himawan Nugroho http://brokenpipes.blogspot.com

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

52

CCIE Routing & Switching Number of attempts: 2 (two) CCIE Lab location(s): Brussels, August 13 2001 and Tokyo, September 13 2001 CCIE Lab format: 2-day exam (both) Sponsored by: company (IBM, both) Written Exam: January 26 2001 Total number of practice lab hours: 900+ Primary CCIE Workbook: CCbootcamp Classroom training taken: Cisco ICND (2000), in the very beginning of the journey Short story: Went to Brussels for the first time after about 6 months preparation, failed in Troubleshooting section (second day last part), couldn’t sleep after failure, went to Tokyo exactly 1 month after the first attempt, passed the lab with still 1 hour time left Moments to remember: - Sleep in the office for 9 months - Start practice lab with only 2 routers and lots of loopback interfaces - Must “borrow” routers from customer premises to build the lab - First time flying to Europe, first Schengen Visa - First time flying with Business Class - Able to take 2nd attempt even the company policy was flying freeze - Japanese proctor with little English to communicate - Japanese Keyboard, Japanese Windows - Get the CCIE number in yellow color post-it paper - Want to drink Sake after passing, but get lost in the middle of Tokyo, eventually end up in McDonald Inspiring quote: “There is no spoon” (The Matrix) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

53

CCIE Security Number of attempts: 2 (two) CCIE Lab location(s): Brussels, December 8 2005 and Brussels, January 25 2006 CCIE Lab format: 1-day exam (both) Sponsored by: self funding (both) Written Exam: June 23 2005 Total number of practice lab hours: 600+ Primary CCIE Workbook: Trinetnt (now part of CCbootcamp) Classroom training taken: none Short story: Tried to impress Cisco by taking the lab, had many years experience in security but actually wanted to learn more into SP technology, went to Brussels after about 4 months preparation, failed with already above 70% score, couldn’t believe it and got into denial state, went back to Brussels about 6 weeks later, passed the lab this time Moments to remember: - Spend countless hours in Ebay to buy personal equipments - Going back and forth UAE post office to fight for the equipments - Self funded, so working hard to track expenditure and lab hour - Again, must “borrow” some equipments from customer premises :) - Pass Cisco CCIP in the middle of CCIE Security preparation - Get 9 days off due to the sad demise of UAE sheikh - The most balanced life between family time and CCIE preparation - First snowfall in life during second lab attempt - Lunch in Chinese Restaurant next to Brussels Grand Place after passing. Proper food after eating only ramen noodles for few days. Inspiring quote: “It’s not who you are underneath, it’s what you do that defines you” (Batman Begins) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

54

CCIE Service Provider Number of attempts: 1 (one) CCIE Lab location(s): Brussels, August 13 2007 CCIE Lab format: 1-day exam Sponsored by: company (Cisco) Written Exam: February 27 2006 (Metro Ethernet) Total number of practice lab hours: 240+ Primary CCIE workbook: Internetwork Expert Classroom training taken: none Short story: The track that I have been dying to complete for years, only with about 2 months extensive preparation, relied completely to Internetwork Expert for video on demand and workbook, the toughest CCIE preparation with very less spare time from projects and travels, slept maximum 2 to 3 hours every day in the last few weeks before the lab, passed the lab in first attempt Moments to remember: - The toughest CCIE track from the availability of time to study - The most fun at the same time since I really love the topics - No personal expense at all from lab fee, trip, workbook, lab - Sleep 2 to 3 hours maximum everyday anywhere I can: in the taxi, during the flight - Flying 16 hours to Brussels, 21 hours to go back to Singapore - Spend whole time in Cisco office to study from 2 days before the lab - Spend lots of time trying to find soft drinks, fruits, chocolates and any food available during the study in that weekend in Cisco office - Great feeling when the unicast and multicast traffic really work across different AS in the my lab day - Stay until 2 am in Cisco office waiting for the result - The feeling when I really pass it in first attempt Inspiring quote: No quotes from 300 movie, but it is really inspiring. “No sacrifice, no victory” (Transformers) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

55

Tips from Proctors

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

56

CCIE Lab Day Tips  Reduce stress—arrive early  Leave yourself time—exam can run over  Read entire exam  Redraw topology to clarify scenario  Manage your time  Make no assumptions  Keep a list  Work questions as a unit  Test your work  Save configurations often  Minimize last-minute changes Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

57

CCIE Lab: Troubleshooting  Know how to troubleshoot using tools available  Verify each question before moving on. Work the simple or basic questions first and then the complex ones  Keep in mind the point value; don’t lose too much time working on a 2 or 3 point question  Save your configurations. If necessary, you can reload a device and work on something else while it comes back up in a known state

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

58

CCIE Lab: Ask the Proctors  Ask the Proctor Questions  Proctor’s role is to keep exam fair  Talk to proctor if you don’t understand question  Ask the proctor clarifying questions  Report any equipment or technical problems to proctor as soon as it occurs

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

59

Q and A… Better with FAQ

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

60

Frequently Asked Questions  Will you share CCIE Lab questions? No, it against NDA  Am I too old? Am I too young? There is no such thing, CCIE is for everyone  I don’t have background in computer science, I don’t have degree related to computer or IT. So what? So do I, so do zillion people who work in IT  Is it too difficult? Is it too expensive? Nothing is too difficult. Practice with emulator, and by using the right strategy someone will pay for it  Can I be CCIE by only studying at home and without real experience? Yes you can, but certification without experience has less values  I want to become CCIE, and now I’m still doing my CCNA, what should I do? Easy, pass your CCNA first! Be in the moment, do the obvious  Do you mind if I make you my CCIE mentor? Yes, I don’t mind. Just send me email and ask your specific questions. But remember I can only provide guidance, you still have to make your own study plan and practice extensively I can only show you the door, you are the one who must open the door, Neo.  What should I do after I pass my CCIE? It’s up to you: lead more challenging projects, move to overseas, join Cisco AS, ask for more salary, become independent consultant, become US president… CCIE is just the beginning Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

61

Next Step

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

62

Next Step to Become CCIE  Don’t waste time to argue or to keep thinking about it, if you really want to do it then just DO IT and start NOW  Read the blueprint and analyze your weakness, then start reading about those topics  If you are still in the middle of CCNA or CCNP/CCIP journey, then finish it. Be in the moment, do the obvious  Build the lab with simulator/emulator, use it even for CCNP/CCIP  Don’t invest big, start small, single step at a time  Beware of rumors!  Build small study group, with others in the same knowledge level  Join networking community  Get help and direction from those who are willing to share Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

63

Additional Slides: CCIE SP in detail

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

65

CCIE SP Lab Blueprint CCIE Service Provider lab exam blueprint: http://www.cisco.com/web/learning/le3/ccie/sp/lab_exam_blueprint.html

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

66

SP Lab: Frame-Relay  Terms: DLCI, LMI, FECN, BECN, DE, BC, BE, CIR, MinCIR, TC  Features to practice Traffic shaping Multilink Fragmentation

FR

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

67

SP Lab: PPP  Terms: LCP, NCP, PAP, CHAP  Features to practice Authentication PPP multilink Fragmentation and interleaving Compression PPPoE

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

68

SP Lab: ATM  Terms: PVC, SVC, VPI, VCI, ILMI, AAL  Features to practice PVC, SVC RFC 1577 PPP over ATM Traffic shaping and policing Frame-relay ATM Inter-Working

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

69

SP Lab: ISIS Addressing IDP

DSP IDI

AFI

High Order DSP

Variable Length Area Address

System ID 6 Bytes

NSEL 1 Byte

 Area address: Variable length field composed of high order octets of the NSAP excluding the SystemID and SEL fields  SystemID: Defines an ES or IS in an area; Cisco implements a fixed length of 6 octets for the SystemID  NSEL: Selector, also designated as N-selector; it is the last byte of the NSAP and identifies a network service user (transport entity or the IS network entity itself)  Example: 49.0002.0000.0000.5555.00 Area = 49.0002, SysID = 0000.0000.5555, Nsel = 00

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

70

SP Lab: ISIS Router Level  IS-IS has a 2 layer hierarchy: Backbone and Area  An IS can be Level 1 router (intra-area routing) Level 2 router (inter-area routing) Level 1-2 router (intra and inter-area routing)  Level 1 router Has neighbors only on the same area Has the Level 1 LSDB with all routing information for the area Use the closest Level 2 router to exit the area  Level 2 router May have neighbors in other areas Has a Level 2 LSDB with all information about inter-area routing  Level 1–2 router May have neighbors on any area Has two LSDBs: level 1 and level 2 Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

71

SP Lab: ISIS Backbone  Backbone must be L2 contiguous Area-3

L1-Only L1L2 Area-2

L2-Only

L1L2 L1-Only

L1L2

Area-4 L1L2

Area-1

L1-Only

L1L2 L1-Only

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

72

SP Lab: ISIS Circuit Type  Circuit-type: Level 1 only Level 2 only Level 1–2 (default)

 Link type Point to Point LAN Designated Router (DIS) is elected based on interface priority with highest MAC address being tie breaker

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

73

SP Lab: ISIS Commands  Router Commands Router isis (tag) Net XX.XXXX. ... .XXX.XX Is-type level (X) Redistribute (routing protocol)

 Interface commands IP router isis (tag) Frame-relay map clns (dlci) broadcast Isis circuit-type level (x) Isis priority (value)

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

74

SP Lab: ISIS Commands  Verify and Troubleshooting Commands Show clns protocol Show clns neighbor Show clns interface Show isis database detail Show isis topology Debug isis adj-packets Debug isis spf-events Debug isis authentication information

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

75

SP Lab: ISIS Practice  Features to practice Multiple NET Metric adjustment Node/link level Fast hello Authentication L2 to L1 Routes leaking Overload Bit Signalling

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

76

SP Lab: OSPF Terminology  LSA Type: Router LSA, Network LSA, Summery LSA, External LSA, Opaque LSA  Area, Backbone, ABR, ASBR  Media type: Point-to-Point, Broadcast, Non-Broadcast  Cost, Router ID  Hello, Flooding, SPF calculation Note: Advanced OSPF features like stub, NSSA, virtual link, demand circuit do not test in SP test Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

77

SP Lab: OSPF Commands  Router commands Router ospf (process ID) Network x.x.x.x area y.y.y.y Neighbor x.x.x.x  Interface commands Ip ospf network Ip ospf priority Ip ospf hello-interval  Show commands Show ip ospf interface Show ip ospf neighbor Show ip ospf database Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

78

SP Lab: BGP Terminology  Autonomous System, Private AS  BGP neighbor, TCP connection (port 179), EBGP, IBGP  Attributes AS-Path Weight Origin MED Local Preference Community  Route Reflector, Client, Confederation, Cluster  Synchronization, Dampening

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

79

SP Lab: BGP Route Selection 

Ignore IBGP routes that are not synchronized



Ignore a route if the next hop is not known



Prefer the route with the largest weight



Prefer the route with the largest local preference



Prefer the route that was locally originated via network, aggregate or redistribution from an IGP



Prefer the route with the shortest AS path; if using bgp bestpath as-path ignore then skip this step: When using the as-set option for aggregated routes then the as_set counts as 1 regardless of the number of AS entries in the set; confederation sub AS numbers are not used to determine the AS-path length

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

80

SP Lab: BGP Route Selection 

Prefer the route with the lowest origin (IGP < EGP < Incomplete)



Prefer the route with the lowest MED; this comparison is only between routes advertised by the same external AS



Prefer EBGP routes to IBGP routes



Prefer the path with lowest IGP metric to the BGP next hop



Prefer the oldest route



Prefer the path received from the router with the lowest router ID

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

81

SP Lab: BGP Commands  Router commands Router bgp (AS number) Address-family ipv4 unicast Network x.x.x.x mask y.y.y.y Neighbor x.x.x.x remote-as yy Redistribute (routing protocol)  Global commands Ip as-path access-list (number) ip community-list (number/name) Route-map (name) Access-list (number) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

82

SP Lab: BGP Commands  Verification and troubleshooting commands Show ip bgp Show ip bgp neighbor Show ip bgp summary Show tcp brief Clear ip bgp Debug ip bgp evevents Debug ip bgp updates

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

83

SP Lab: BGP Practice  Features to practice EBGP, IBGP definition Multi-home, Path chosen on LP, MED, AS-Path Multi-path Aggregation, Redistribution Policy on Community Routes reflection, Confederation Dampening reduction

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

84

SP Lab: MPLS Fundamentals  Based on the label-swapping and forwarding paradigm  As a packet enters an MPLS network, it is assigned a label based on its Forwarding Equivalence Class (FEC) as determined at the edge of the MPLS network  FECs are groups of packets forwarded over the same Label Switched Path (LSP)  Need a mechanism that will create and distribute labels to establish LSP paths  Separated into two planes: Control Plane—responsible for maintaining correct label tables among Label Switching Routers Forwarding Plane—uses label carried by packet and label table maintained by LSR to forward the packet

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

85

SP Lab: MPLS Terminology  FEC  Label, Label stack, EXP, LSP  Label encapsulation (PPP, FR, Ethernet, 802.1Q,ATM)  Label Swap, Pop, Un-tag, Push, Aggregate  Label distribution  Label merge

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

86

SP Lab: Label Distributions  LDP/TDP IGP is needed in the network to provide network prefix Use TCP session to establish connection  RSVP Additions to RSVP signaling protocol Leverage the admission control mechanism of RSVP to create an LSP with bandwidth Label requests are sent in PATH messages and binding is done with RESV messages  MP-BGP Multi protocol extensions to BGP Routers need to be BGP peers Label mapping info carried as part of BGP NLRI  Static Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

87

SP Lab: MPLS Commands  Configuration commands Ip cef Mpls ip Mpls label protocol ldp/tdp Mpls ldp router-id interface (type) (number) Mpls atm vpi (number) Mpls atm control-vc (vpi/vci)  Troubleshooting commands show mpls forwarding-table show mpls interface show mpls ip binding show mpls atm-ldp summary Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

88

SP Lab: MPLS VPN  PE—Provider Edge router  P—Provider router  CE—Customer Edge router  VPN—Virtual Private Network  VRF—Virtual Routing and Forwarding instance  VPNv4 Address family used in BGP to carry MPLS-VPN routes  RD Route Distinguisher, used to uniquely identify the same network/mask from different VRFs  RT Route Target, used to control import and export policies, to build arbitrary VPN topologies for customers Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

89

SP Lab: MPLS VPN Operation  MP-BGP session facilitates the advertisement of VPNv4 prefixes + labels between MP-BGP peers  At the advertising PE, BGP allocates labels for VPN prefixes and installs them in the LFIB (MPLS forwarding table)  At the receiving PE, IF BGP accepts VPN prefixes with labels, THEN BGP installs VPN prefixes in the VRF FIB (CEF table)  VPNv4 traffics are encapsulated in MPLS packet between PEs

CE

VRF

PE

CE

iBGP—VPNv4 Label Exchange LDP

LDP iBGP—VPNv4

CE

PE

VRF

LDP iBGP—VPNv4

PE

CE

VRF

CE Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

90

SP Lab: MPLS Inter AS VPN  Back to back VRFs is simple method to deploy inter AS MPLS VPN  RFC 2547bis define three Inter AS MPLS VPN methods in Option (a) (b) (c) for large complex inter AS VPN deployment ASBR2

ASBR1 1. Back-to-back VRFs

AS #1

PE 1

2. MP-eBGP for VPNv4

AS #2 PE2

3. Multihop MP-eBGP between RRs CE1

VPN-A

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

4. Non-VPN Transit Provider

CE2

VPN-A

Cisco Public

91

SP Lab: VPN Commands  PE commands Ip vrf (name) Rd mm:nn Route-target import/export xx:yy Router bgp (as number) Address-family vpnv4 Neighbor x.x.x.x activate Neighbor x.x.x.x send-community extended Neighbor x.x.x.x send-label  PE interface commands Ip vrf forwarding (name)

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

92

SP Lab: VPN Commands  PE-CE commands Router ospf (ID) vrf (name) Network x.x.x.x area yy Router rip address-family ipv4 vrf (name) Network x.x.x.x  Troubleshooting commands Show ip cef vrf (name) Show ip vrf detail Show ip bgp vpnv4 all Show ip bgp vpnv4 vrf (name) Show ip (igp) (vrf) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

93

SP Lab: MPLS VPN Practice  Intra AS MPLS VPN  PE-CE routing in OSPF, BGP, RIP  BGP Route reflection for VPNv4  Multi-homed VPN sites  eiBGP Multipath Load Balancing  Extranet VPN, Internet Access VPN, VRF-aware NAT VPN  Inter AS VPN, MP-eBGP for VPNv4, Multihop MP-eBGP between RRs  Carrier’s Carrier

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

94

SP Lab: MPLS L2VPN Customer Site

PSN Tunnel

PWES

Customer Site

Customer Site

Pseudowires

PE

PWES

PE PWES

PWES

Customer Site

Emulated Service A Pseudowire (PW) Is a Connection Between Two Provider Edge (PE) Devices which Connects Two Pseudowire End-Services (PWESs) of the Same Type

• Ethernet

• HDLC

• 802.1Q (VLAN)

PWES

• ATM VC or VP Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

• PPP • Frame Relay VC 95

SP Lab: L2VPN Deployment  Any transport over MPLS MPLS in the core Targeted LDP session between PEs Targeted LDP session distributes pseudowire labels PE uses per-platform label space for both link and targeted LDP sessions

 L2TP V3 Transparent Layer 2 traffic transport Operates over native IP backbone network Supports multiple Layer 2 Data Link emulation types

 GRE Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

96

SP Lab: L2VPN Commands  Configuration commands Pseudowire-class (name) Encapsulation mpls/l2tpv3 Xconnect x.x.x.x yy pw-class (name)

 Troubleshooting commands Show mpls ldp discovery Show mpls l2transport binding Ping mpls pseudowire Show l2tun tunnel Show l2tun tunnel session

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

97

SP Lab: MPLS TE  Information distribution IGP extensions flood available bandwidth information, OSPF uses Type 10 (area-local) Opaque LSAs, ISIS uses new TLVs  Path selection/calculation TE Head-end does a “Constrained SPF” (CSPF) calculation to find the best path, Path can also be explicitly configured  Path setup RSVP used to set up TE LSP, PATH messages (from head to tail) carries LABEL_REQUEST, RESV messages (from tail to head) carries LABEL  Trunk admission control On receipt of PATH message, Router will check there is bandwidth available to honour the reservation, On receipt of a RESV message, Router actually reserves the bandwidth for the TE LSP  Forwarding traffic on to tunnel Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

98

SP Lab: TE Traffic to tunnel  Static routing  Policy routing  Auto route  Forwarding Adjacency R8

R3 R4 R2 R1

R5 R6

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

R7

99

SP Lab: MPLS TE Commands  Global commands Ip cef Mpls traffic-eng tunnels  OSPF/ISIS Mpls traffic-eng tunnels Mpls traffic-eng router-id loopback x Mpls traffic-eng area (number) Mpls traffic-eng level x Metric-type wide  Interface commands Mpls traffic-eng tunnels Ip rsvp bandwidth (number) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

100

SP Lab: MPLS TE Commands  Tunnel commands Tunnel destination (Tail Router ID) Tunnel mode mpls traffic-eng Tunnel mpls traffic-eng bandwdith (number) Tunnel mpls path-option (num) explicit/dynamic  Traffic routing commands Ip route (net) (mask) tunnel (number) Tunnel mpls traffic-eng autoroute announce Tunnel mpls traffic-eng forwarding-adjacency  Show commands Show mpls traffic-eng tunnel Show mpls traffic-eng link-management Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

101

SP Lab: Multicast Terms  Multicast addressing, Administratively Scoped Addresses, SSM Range  Shared Distribution Tree, Source Path tree  RPF- Reverse Path Forwarding  RP- Rendezvous Point  Dense mode, Sparse mode, Register, Join, Prune, SPT switchover  IGMP  SSM, Bir-PIM, MVPN

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

102

SP Lab: Multicast Sparse  Must configure a Rendezvous Point (RP)  Uses Explicit Join model  Traffic only flows to where it’s needed  Router state only created along flow paths  Works for both sparsely or densely populated networks

RP

Source

Traffic Flow Shared Tree Source Tree Receiver Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

103

SP Lab: Multicast RP  Static Configured on every router with the same RP address  Auto RP Candidate RPs, Mapping Agents be configured Two specially IANA assigned Groups used,Cisco-Announce 224.0.1.39, Cisco-Discovery - 224.0.1.40  BSR Candidate BSR’s (C-BSR) be configured C-RP’s send C-RP announcements to the BSR BSR periodically sends BSR messages to all routers  Anycast RP Two or more routers have same RP address Senders and Receivers Join/Register with closest RP MSDP session(s) run between all RPs Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

104

SP Lab: Inter Domain Mcast  MBGP: Multiprotocol BGP Defined in RFC 2283 Address Family Information (AFI) = 1 (IPv4), Sub-AFI = 2 (NLRI is used for multicast RPF check)

 MSDP

AS5

RP G

AS7

RP

F 172.16.5.1

172.16.6.1

Source

172.16.3.1

172.16.4.1 D

E

MSDP peers talk via TCP connections (port 639) Source Active (SA) messages Used to advertise active Sources in a domain RP or receiver last-hop join inter-domain source tree Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

RP A BGP Peer MSDP Peer SA Message

AS100

105

SP Lab: Multicast VPN  MPLS VPN between PEs in core  IP multicast enabled in MPLS VPN core

CE

 MVRF define per VRF multicast routing and forwarding

CE

B 2

B 1

A

PE

MPLS VPN Core

B

Default MDT

 MVRF tunnel interface join into multicast distribution tree (MDT)

PE CE D

PE

E

PE

 Multicast domain formed between PEs

 MVPN traffic encapsulated in GRE tunnel

A

CE

C E

E

CE F

Data MDT

D

PE

C

C

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

CE

106

SP Lab: Multicast Commands  Global commands ip multicast-routing ip multicast-routing vrf (name) ip pim rp-address x.x.x.x ip pim rp-candidate (interface) Ip pim bsr-candidate (interface) Ip pim send-rp-announce (interface) Ip pim send-rp-discovery (interface) ip msdp originator-id (interface) Ip msdp peer x.x.x.x  Interface commands Ip pim sparse-mode/dense-mode Ip igmp join-group x.x.x.x Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

107

SP Lab: Multicast Commands  Multicast BGP commands address-family ipv4 multicast Network x.x.x.x mask y.y.y.y Neighbor x.x.x.x activate  MVPN commands Mdt-default x.x.x.x Mdt-data x.x.x.x  Show commands Show ip mroute Show ip pim interface Show ip pim neighbor Show ip pim rp mapping Show ip bgp ipv4 multicast Show ip msdp peer Show ip mroute vrf (name) Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

108

SP Lab: Multicast Practice  Sparse mode, Dense mode  IGMP  Static RP, BSR, Auto RP, Anycast-RP  Inter domain multicast, MSDP, MP-BGP  SSM, Bidirectional PIM  Multicast VPN

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

109

SP Lab: QoS on IP/MPLS  Classification Base on 802.1Q COS, IP precedence, DSCP, Network-based application to classify traffic  Marking Mark appropriate traffic with IP Precedence, DSCP, EXP,etc  Policing, Shaping, Queuing Committed Access Rate, Class-Based Weighted Fair Queuing, LLQ, FR traffic shaping  Congestion Avoidance Weighted Random Early Detection  MPLS QoS uses Differentiated Services (DiffServ) architecture defined for IP QoS

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

110

SP Lab: QoS Practice  Class-Based Weighted Fair Queuing (Modular QoS CLI)  Committed Access Rate  NBAR  WERD  MPLS DiffServ Tunneling

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

111

SP Lab: SP Security  Management plane/Device security Use Tools or protocols to protect device like router, switch. Disable unneeded service, disable CDP, set NTP, disable IP unreachable overload, login security, SNMP authentication, etc.

 Control plane security Protect routing protocols. Routing protocol authentication, AS Ingress and Egress Route Filtering, deny Documenting Special Use Addresses, etc.

 Data plane Validate packets going through the router. BCP 38 Packet Filtering, uRPF, etc.

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

112

SP Lab: Attack in SP Network  Attack detection Use IOS tools to detect network anomaly which likely be attack. ACL with logging, SNMP, Netflow, etc.

 Attack mitigation Protect target victim. uRPF, ICMP backscatter, CAR limiting traffic, TCP intercept, BGP Remote Trigger black hole, etc.

ISP

Hacker

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

CPE

Target

113

SP Lab: RTBH  Configure all edge routers with static route to Null0 ip route 192.0.2.1 255.255.255.255 Null0  Configure trigger router, iBGP mesh  Activate black hole Redistribute host route for victim into BGP with next-hop set to 192.0.2.1, Route is propagated using BGP to all BGP speaker and installed on routers with 192.0.2.1 route, All traffic to victim now sent to Null0 Peer A Peer B

IXP-W A

IXP-E Upstream A

Upstream A

B

D

C

Upstream B

E Target G

F POP Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

NOC 114

SP Lab: SP Security Practice  Selective Packet Discard  ISIS, OSPF, BGP, RIP routing update authentication  Netflow, ACL with logging, syslog  uRPF  Infrastructure ACL  Remote Triggered Black Hole Filtering

Presentation_ID

© 2008 Cisco Systems, Inc. All rights reserved.

Cisco Public

115

View more...

Comments

Copyright © 2017 KUPDF Inc.
SUPPORT KUPDF