MY CCIE BLOG

Moving to a Different Team

2011-01-13T03:37:00.001-08:00

First of all Happy New Year guys !!! Started my new role as Technical Architect with Fujitsu Telecommunications. So now i will be putting a different hat. From a Hands on Systems Engineer to being an Architect.

My Role will be to contribute to complex and diverse bids, tender support and projects within the networking arena for a broad range of multi vendor solutions.

To discuss and design solutions for a wide range of technical projects within the Enterprise and Service Provider sector.

Act as the technical design authority from acquisition to realisation.

I am quite excited for this new role as it will be a new challenge and a new area to explore. Will keep you guys updated on how it is going.

Jordan Migration Finished

2010-11-09T11:49:00.000-08:00

Finished Jordan migration over the weekend. Went pretty smoothly. Flew from Jordan to London just to get one day of rest as i am flying off tommorrow to Dubai for the migration over the weekend. But there is light at the end of the tunnel as once i finish the migration in Dubai i have a weeks off and go to India for holidays to see my Parents. So tired today as had lots to do ...Loads of washing to do ... Oh Yes i also forgot that yesterday it was my birthday as well. Felt so lonely as there was no body at house to greet me. But few friends made the evening Fantastic. Right off to Dubai tommorrow. Will post how it goes. Not a big site Few 3560's, couple of Citrix WAN repeaters and two routers ( i dont know what exactly has been shipped). Will see once i am there.

Abu Dhabi finished

2010-10-26T14:36:00.001-07:00

Reached home yesterday after 7 hour journey from Abu Dhabi to Heathrow. Finished the migration in Abu Dhabi. Was very quick and never expected that to be quick. Next i am off to Amman, Jordan for the next migration and then back in Dubai for two weeks for the migrations in Dubai. Have this week so expecting to do some reading on my CCIP exam.

Migration in Abu Dhabi

2010-10-19T06:05:00.001-07:00

Off to Abu Dhabi tommorrow morning for another migration. Not a big site this one !!! 2 WAN repeaters and few 3560 switches with one 6509 switch. Hopefully should have no problems....

Will keep you posted !!!

CCIP Study Started

2010-10-14T13:44:00.000-07:00

Got my books for CCIP today. So the countdown has begun. Have been reading BGP, QOS and MPLS for a while but now its time to put the real experience to test. Got my two books

1) CISCO QOS --Exam Certification Guide (Second Edition)
2) Internet Routing Architectures -- Second Edition

Will give my first composite exam .. BGP + MPLS within next 15 days. Will keep you updated...

LAN Migration Done

2010-10-13T15:16:00.000-07:00

Last week was busy migrating a site in Austria and preparing it so that it is ready for this week for the WAN migration. Site wasnt that big but configuring 1 x 6500 swtich, 22 x 3560 switches and migrating the users from the OLD entrasys switch in two days was tiring. But i am glad all of that worked without much of problems. Only one small problem which nearly brought the whole site down. I stil dont understand the real problem but if someone can shed some light on why this happened then that will be great.

What happened was that i had configured port channel on port 49 and 50 . Ports 51-52 were empty. By mistake the Fibre SFP was connected on port 51. We never noticed that while racking the switch and connected the fibre on that. We kept on racking the switches but after around 10-15 minutes users started complaining that they are not getting any IP from the DHCP and within 10 more minutes everyone in the office was complaining. I was quick to find the problem as i worked my way backwards and within 5-7 minutes i traced back to the switch where the SFP was plugged in wrong. Plugged it back into the righ port and .......it worked.

I still dont know how can SFP plugged into a wrong port can cause loop and bring the whole network down. Your comments !!!!!

4 Months into the new job

2010-09-18T00:07:00.001-07:00

Its been 4 months into this job and i am enjoying it quite a lot. During this 4 month period i have travelled to about 20-25 countries so far. It has been an incredible experience.

I completed my CCDP during this time as well. It has been a great experience in terms of culture as well. First month i travelled to the Istanbul and then travelled all the way to Middle East. Spent the whole month in Middle East and travelled to Customer sites in Abu Dhabi, Dubai, Bahrain, Muscat. Once i finished that part i travelled back to Ankara and then came my first migration in Bratislava ( Slovakia). That migration was a success and i was quite pleased with that. From there on i have travelled a lot into Europe and have done few more migrations and now i want to start doing some design stuff as well. Lets see how it goes.

New Role

2010-06-03T01:39:00.000-07:00

Hi Guys ! I have started my role with Fujitsu Telecommunications UK & Ireland as Systems Engineer. Started the role on 1st of June. I will working on migrations for Customers all over the EMEA ( Europe, Middle East, Africa) region. The job requires me to travel throught out the EMEA region. First we go to the site and do Site Audit and then feed that information back so that the design for the migration is done. Then next time we go back to the site and migrate the old kit with new kit. Will keep you guys posted on how it is progressing.

Big Move to UK

2010-04-22T07:08:00.001-07:00

Its been a long time since my last post. I always promise that i will be posting my updates regularly but sorry guys, i wasnt able to post anything for some time and the reason for that is that i have made a big move from New Zealand to UK. At the moment i am looking for a new role and hopefully will find an opening soon. Havent been able to study much for last few months as winding up everything in NZ took a long time and i never got time to study along with finishing my pending projects at work. I think now i should really start studying as my CCIE Written is going to expire soon in 4 months. I will aim to book my lab before that. Will keep everyone posted.

Section 1- Implement Layer 2 Technologies Done !!!!

2009-12-20T13:26:00.000-08:00

Update 1

Last night finished doing section 1 (Implement Layer 2 Technologies). So many times in the past i had just ignored this whole section and had moved on. I always used to think that this section is RIDICULOUSLY EASY but it is not and i have learnt a lot of new things in this section. This time i made sure that i finish the whole Section.

1)Read the whole section from the Exam Certification Guide.
2)Watched the VOD from IPEXPERT BLS
3)Did the First 4 Labs from the IPEXPERT RS VOL1-WB-LAB1

Now the next Section is Implement IPV4

Narbik's Bootcamp

2009-12-07T10:50:00.000-08:00

I am really disappointed with Narbik. Not as a tutor but in replying emails. I am close to my lab and wanted to attend (This is retake not a new) his bootcamp in Sydney. First the bootcamp was on but Narbik wanted me to wait and then again it was confirmed that it is on. I was about to pay for my tickets but just thought i will check with him that whether it is on or not. He said he is not sure as few students are from the same company and they have a project on so they will confirm with him. So i asked him to please confirm it in next day or so (Mind you i asked him to confirm it on Dec 1 for which he said he will confirm it in a day or two. Today its 8th December, 8.00 AM (NZ time) and still havent received any confirmations. So all in all i have decided i wont go as to get tickets at the last minute for the 13 th Dec Bootcamp will be very expensive. I dont want to send him another email as i feel bad because i have been sending him quite a lot emails (all of them were about bootcamps anyway) and i also feel bad because i am taking a retake and not paying for the bootcamp again. I am sure a lot of you have been to Narbik's bootcamps and have done retakes and all of you have had great experience, but i think i am not happy the way the whole thing has been dealt with. I have no doubts about Narbik's teaching capabilities and his style of teaching, i just loved it and i got to learn a lot of new things.

I am sure a lot of you will disagree with me as my case might be one off but if you had any experience like that then feel free to contact me and we will talk to Narbik. I am sure he will love all the feedback.

My EIGRP Troubleshooting Flashcard

2009-11-22T15:05:00.000-08:00

Key things about EIGRP Neighbour Process

The following should match:

Hello Types
K-value
AS Number
IP Subnet
Hello Interval
60 Seconds for low speed NBMA
5 Seconds for all other interfaces

Multicast Hellos

224.0.0.10 ( 0100.5e00.000a)

EIGRP DUAL Routing Algorithm Concepts

Feasible Distance ( FD) is the minimum distance (Metric) along a path to a destination Network.
Reported Distance (RD) is the distance towards a destination as advertised by an upstream neighbour.
A neighbour meets the feasibility condition (FC) if the reported distance by a the neighbour is smaller than the feasible distance (FD ) of this router.
Command Used to find out FD
Show ip eigrp topology all-links

EIGRP DUAL Routing Algorithm – Active Process

Normal (stable) state of a route is passive

Going active is the normal process for resolving network topology changes

Route becomes active if it is lost (or metric increases) and there aren’t any feasible successors

Going active means sending Queries to neighbours looking for an alternative path.

SIA-Queries are sent to a neighbour up to three times

May Attempt to get a reply from a neighbour for a total of 6 minutes.
If still no Reply by the end of this process, consider the route stuck through this neighbour.

On the router that doesn’t get a reply after 3 SIA-queries:

Reinitialize neighbour who dint answer.
Goes active on all routes kown through bounced neighbour.
Re-advertises to bounced neighbour all routes that we were advertising.

Likely causes of Stuck-in Active (SIA)

Bad or congested links.
Query Range is too long
Excessive redundancy
Overloaded router (high CPU)
Router memory shortage
Software defects
Minimising SIA Routes
Decrease query scope (involve fewer routers in the query process)
Summarisation (manual or auto)
Distribute-lists
Define remote routers as stubs
Run a Cisco IOS which includes the fix for CSCdp33034

Cisco Security Advisory

2009-09-07T17:06:00.000-07:00

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities

Advisory ID: cisco-sa-20090826-cucm
http://www.cisco.com/warp/public/707/cisco-sa-20090826-cucm.shtml
Revision 1.0
For Public Release 2009 August 26 1600 UTC (GMT)

Summary

Cisco Unified Communications Manager (formerly CallManager) contains multiple denial of service (DoS) vulnerabilities that if exploited could cause an interruption to voice services. The Session Initiation Protocol (SIP) and Skinny Client Control Protocol (SCCP) services are affected by these vulnerabilities.

Cisco has released free software updates for select Cisco Unified Communications Manager versions that address these vulnerabilities. There are no workarounds for these vulnerabilities.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090826-cucm.shtml.

Affected Products
Vulnerable Products

The following products are affected by vulnerabilities described in this advisory:

* Cisco Unified Communications Manager 4.x
* Cisco Unified Communications Manager 5.x
* Cisco Unified Communications Manager 6.x
* Cisco Unified Communications Manager 7.x

Products Confirmed Not Vulnerable

Cisco Unified Communications Manager Express is not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities.

Details

Cisco Unified Communications Manager is the call processing component of the Cisco IP Telephony solution that extends enterprise telephony features and functions to packet telephony network devices, such as IP phones, media processing devices, VoIP gateways, and multimedia applications.
Malformed SIP Message Vulnerabilities

Cisco Unified Communications Manager contains two DoS vulnerabilities that involve the processing of SIP packets. Each vulnerability is triggered by a malformed SIP message that could cause a critical process to fail, resulting in the disruption of voice services. All SIP ports (TCP 5060 and 5061, UDP 5060 and 5061) are affected by these vulnerabilities.

The first SIP DoS vulnerability is documented in Cisco Bug ID CSCsi46466 and has been assigned the CVE identifier CVE-2009-2050. The first vulnerability is fixed in Cisco Unified Communications Manager versions 6.1(1) and later.

Cisco Unified Communications Manager 4.x versions are only affected by the first SIP DoS vulnerability if a SIP trunk is explicitly configured. To determine if a SIP truck is configured on a Cisco Unified Communications Manager version 4.x system, navigate to Device > Trunk and choose the option SIP Trunk in the Cisco Unified Communications Manager administration interface. To mitigate against this vulnerability, administrators are advised to restrict access to TCP and UDP port 5060 on vulnerable Cisco Unified Communications Manager 4.x systems that are configured to use SIP trunks with screening devices to valid SIP trunk end points.

The second SIP DoS vulnerability is documented in Cisco Bug ID CSCsz40392 and has been assigned the CVE identifier CVE-2009-2051. The second vulnerability is fixed in Cisco Unified Communications Manager versions 5.1(3g), 6.1(4), and 7.1(2).
Network Connection Tracking Vulnerability

Cisco Unified Communications Manager contains a DoS vulnerability that involves the tracking of network connections by the embedded operating system firewall. By establishing many TCP connections with a vulnerable system, an attacker could overwhelm the operating system table that is used to track network connections and prevent new connections from being established to system services. Any service that listens to a TCP port on a vulnerable system could be affected by this vulnerability, including SIP and SCCP.

This vulnerability is documented in Cisco Bug ID CSCsq22534 and has been assigned the CVE identifier CVE-2009-2052. The vulnerability is fixed in Cisco Unified Communications Manager versions 5.1(3g), 6.1(4), 7.0(2), and 7.1(2).
Related SIP and SCCP DoS Vulnerabilities

Cisco Unified Communications Manager contains two DoS vulnerabilities involving the processing of SIP and SCCP packets. By flooding a vulnerable system with many TCP packets, an attacker could exhaust operating system file descriptors that cause the SIP port (TCP 5060 and 5061) and SCCP port (TCP 2000 and 2443) to close. This action could prevent new connections from being established to the SIP and SCCP services. SIP UDP (5060 and 5061) ports are not affected.

The SCCP vulnerability is documented in Cisco Bug ID CSCsx32236 and has been assigned the CVE identifier CVE-2009-2053. The SCCP vulnerability is fixed in Cisco Unified Communications Manager versions 5.1(3g), 6.1(4), 7.0(2a)su1, and 7.1(2).

The SIP vulnerability is documented in Cisco Bug ID CSCsx23689 and has been assigned the CVE identifier CVE-2009-2054. The SIP vulnerability is fixed in Cisco Unified Communications Manager versions 5.1(3g), 6.1(4), 7.0(2a)su1, and 7.1(2a)su1.
Top of the section Close Section
Vulnerability Scoring Details

Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS at

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html.

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at

http://intellishield.cisco.com/security/alertmanager/cvss.

Workarounds

There are no workarounds for the vulnerabilities in this advisory. Administrators can mitigate the SCCP- and SIP-related vulnerabilities by implementing filtering on screening devices to permit access to TCP ports 2000 and 2443, and TCP and UDP ports 5060 and 5061 only from networks that need SCCP and SIP access to Cisco Unified Communications Manager servers.

Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory:

Final Day of F5 Training

2009-07-29T14:38:00.000-07:00

I know this post is not related to cisco but i was sitting here in the course and had a break so thought that i havent been able to blog for a while as been really busy at work. Last 3 days i have been on the F5 LTM Course. We have few F5's at work so work finally decided to pay for our F5 training.

The course was divided in 2 parts.

1) BIG-IP LTM V9.4 Essentials
2) BIG-IP LTM V9.4 Advanced.

The first two days were basic stuff where we learnt how the F5 works and how does it do Load Balancing. Then we did some labs on the different methods of Load Balancing. The second day we did irules, NAT'S, SNAT's. I think the F5 is quite a smart box and can do a lot of things

The next two days were the advanced ones where we worked on what we learnt from the Essentials course. We did some advanced Irules and advanced SNAT's and NAT's. Then we did how to create Virtual Servers and assigning some Pools to that and getting the Load Balancing work on the way Pools work. Today being the last day we are working on the Administration and some Advanced Profiles and then we have a final lab project where all of what we have learnt will be put to test.

Its been a great week of learning. i know you guys must be getting bored. So i am signing off for the day and i promise to keep my blog updated as much i can.

Well Done Omkar

2009-07-19T15:21:00.000-07:00

On Saturday go an email from Omkar Tambalkar ( We did Narbik's Bootcamp together) and he has passed his CCIE R & S. Here is what OMKAR had to say.

Hello everybody,

I took the test at San Jose this week and it was an surreal experience, I passed and got #####. The whole experience has been great. I was planning to take the test in Feb 09 but work comittments and deadlines caused me to drop the ball and I rescheduled it for July 09.

Narbik, your bootcamp was awesome, it really helped me solidify the concepts and pass the lab!!

Cheers,

Omkar

So Well done again Omkar and wish you best of luck for the next one (SECURITY).

Got an update from IPEXPERT

2009-07-02T14:56:00.000-07:00

Got an update from Drew at IPEXPERT and here is what they say

Hello Vivek,

We went ahead and re added the updated R&S files. We are aware of an issue with the by section files that our developers are working as fast as possible to fix. In the mean time we ask that customers download the full volume 1 PDF until the by section files are working.

So hopefully the issue will be fixed soon. Thanks Drew. Will keep everyone posted when i have full access to the new files.

No update from IPEXPERT yet

2009-06-30T16:46:00.000-07:00

Following up from my last post few days ago. I am still awaiting a response from IPEXPERT. Still getting the same error.

Will keep everyone posted with any updates as and when i get them.

New IPEXPERT Blueprint Ver 4.0

2009-06-28T18:41:00.000-07:00

Got the email this morning from IPEXPERT with the subject

"IPexpert’s CCIE R&S (Blueprint Version 4.0) Workbook, Volume 1 Now Shipping".

Was very excited and went straight to my members section and got this error. So i have emailed them and hopefully they will fix it for me. I think in New Zealand it is already monday and the links might not be ready by Monday US time.

Will update all of you once the error has been fixed. But i am really excited.

New Update for Command Memorizer

2009-03-19T18:41:00.000-07:00

Recently got an update for Command Memorizer. Man i am loving this product. The new updates contain shortcuts to DOC CD which i think are very good. Then they have added Forums section in it, plus they have another section called CCIE Quickfire which quick fire questions about few sections. My overall experience with the product has been great and i would like to say BIG THANKS to David Bombal and Richard Bannister for such a great contribution. Well Done guys !!!!Keep it up....

CCIE Command Memorizer.

2009-02-25T13:28:00.000-08:00

First look at CCIE Command Memorizer.

Bought CCIE Command Memorizer today. My first impression of the product is very good. I already have IPEXPERT BLS as i mentioned in my previous post but this tool gives me different perspective that way i can learn. Even though i have to type the commands in full but i dont mind doing that. The whole thing is divided in parts. They cover most of the topics mentioned in the CCIE (R & S) blueprint. You cant type " ? " for help, which means that you need to know the command before you type it. I think this is a good feature but everyone has a different view on things. The reason why i think it is great is that instead of typing ? all the times and drill down until i find the right command with COMMAND MEMORIZER i need to actually know what i am typing which means i can save a lot of time during my lab exam as i know the commands by heart. Another benefit of not having help when attempting any scenario is that it will change my habit of typing ? everytime and instead go to the CISCO DOC CD to find the answer which means i am improving my navigation skills for the CISCO DOC which can be very handy when i am doing my lab. But again everyone has a different view.

You can do the scenarios as many times you want. Once you are finished you can reset the whole page and do all over again. You dont even need internet connection, once you have activated the product you are good to go and you can use the product anywhere you want.

I tried the switching section and they have really good scenarios to work on. They start from basic and then complex scenarios.

Will update more once i have tried it a bit more.

Display configuration sections while configuring the router

2009-02-17T14:56:00.000-08:00

Was going through my Google reader the other day and found this very interesting article on NIL wiki page. Its about how to display the configuration of currently selected interface or routing protocol without using any parameters.

I know what you must be thinking now that you can do that with do show running interface name but with this EEM TCL policies you can achieve it without parameters that would display the configuration of the currently selected interface..

For more on this visit the NIL WIKI PAGE.

How Cisco Grade short answer section

2009-02-11T14:56:00.000-08:00

Was reading the cisco forum " Certifications: CCIE Open Ended Questions" on how cisco are grading the open ended questions and here is what i found:

Hello XXXX,
I work on the CCIE team. The short answer section is graded on an "all or nothing" basis. If you answer the minimum number correct you will get 100%. If you don't achieve the minimum, your score shows as 0%. It is indeed possible that you answered two questions correctly.

Lora O'Haver
Learning @Cisco

Dont you think it is bit unfair. What i think that you should be awarded marks on each right answer you give on the open ended questions. Feel free to comment.

Breaking the Application Bottleneck : TechWiseTV

2009-02-03T01:22:00.000-08:00

Learn how you can improve application deployment times and deliver significant power savings in your data center. Find out how you can give your WAN users LAN-like speed and reduce your bandwidth usage with a solution that can easily be installed. Watch TechWiseTV and see how the Cisco ACE Application Control Engine Module and Cisco Wide Area Application Services (WAAS) enable you to:

Improve application performance by 300 percent or more
Dramatically reduce your operating costs by maximizing the benefits of virtualization
Simplify your network architecture and your IT management
Add a vital new layer of security against application attacks
Mitigate the risk of making changes to your data center and branch IT environments

You can register for this event by following the link ------> REGISTER

Congratulations to Carl Burkland

2009-02-02T15:06:00.001-08:00

Congratulations to Carl Burkland on passing the the R & S lab on Friday. Well done Carl. Send him your congrats to Carl.

CCIE Written Exam

2009-01-28T13:02:00.000-08:00

Sorry for not been able to update my blog for some time. Had been busy studying for my Written Exam. Passed the CCIE written exam today. Got 87 and i think it is a good result. I sucked big time on QOS getting only 33 % only. QOS always has been my weak point and it has been proved as well. Now i know where to put some more efforts on. Planning to schedule my lab around MAY. I know i still need to put a lot of hardwork. Will talk to Narbik about renting one of his racks and take it for one month or preferabbly two months if he gives me a better deal on rack rental. Otherwise will rent Narbik's rack rental for one month and rent some rack time from IPEXPERT as i had bought BLS from them. So i can do some of their labs as well. Will try to update the blog with my daily study schedule. Thanks again to Dave and Rick who kept me motivated during my CCIE written learning process.

Virtual Links

2009-01-14T14:59:00.000-08:00

Virtual Links

Used to connect an area to the backbone thru another area.
Configuration uses router-id.
Used to connect discontinuous Area O's.
Any discontinuous area is a bad idea.
If authentication is configured on Area O it must be configured on the far end virtual link router. Use " Area O authentication " on remote end

Nested Virtual Links

You can extend to more than one area away.
One Hope at a time.
As you install Virtual link, you bring Area O outwards to the remote area.

OSPF without Area O

In a single area system, Area O is not needed.
Once you have more than one area, Area O is required.
A virtual link by itself is part of Area O.
To make a virtual link come up though, some area must exist in Area 0 already.
Loopbacks work perfectly fine.

Link Metrics

Router advertised dont include local link.
Received Router have local link cost added.
Frequently use " SH IP RO OS" to see changes.
May influence simple path changes on Per Router Basis.
May influence Area exit point choices if multiple ABR's exist.
Use "SH IP O I | IN IS UP | COST"

Changes to CCIE Lab and Written Exam Question Format and Scoring

2009-01-14T01:53:00.000-08:00

Effective February 1, 2009, Cisco will introduce a new type of question format to CCIE Routing and Switching lab exams. In addition to the live configuration scenarios, candidates will be asked a series of four or five open-ended questions, drawn from a pool of questions based on the material covered on the lab blueprint. No new topics are being added. The exams are not been increased in difficulty and the well-prepared candidate should have no trouble answering the questions. The length of the exam will remain eight hours. Candidates will need to achieve a passing score on both the open-ended questions and the lab portion in order to pass the lab and become certified. Other CCIE tracks will change over the next year, with exact dates announced in advance.

Effective February 17th, 2009, candidates will also see two other changes in CCIE written exams. First, candidates will now be required to answer each question before moving on to the next question; candidates will no longer be allowed to skip a question and come back to it at a later time. Second, there will be an update to the score report. The overall exam score and the exam passing score will now be reported as a scaled score, on a scale from 300-1000. This change will not affect the difficulty of the current set of exams and will assure CCIE written exams will be consistent with Cisco’s other career certification exams.

OSPF - Things to Remember

2009-01-11T15:12:00.000-08:00

Few things to remember about OSPF

- Always match Network Type
- Timers wont matter if interface types are different
- Broadcast and Non Broadcast always try to elect DR/BDR
- Always use Broadcast statement when using Frame-Relay Maps.

Things about Network Types

- If you cant change the network type use NEIGHBOUR command
-Configure all OSPF frame relay interfaces for Point to Multipoint.

Types of Network Types

-Broadcast -- DR election takes place -- Timer 10/40
-Non-Broadcast - DR election takes place-- Timer 30/120
-Point to Point - NO DR-- Timer 10/40
-Point to Multipoint - NO DR - Timer 30/120
-Point to Multipoint Non Broadcast - NO DR timer 30/120

Where to use OSPF Neighbour Command

- Neighbour Command is used to Signify where a Peer is when it cant be reached via multicast.
-Only necessary on one side of connection
-Hub site will configure the neighbour command

CCIE Written Exam scheduled.

2009-01-05T00:09:00.000-08:00

Last few days had been really busy. Dint study at all last few days as the family as the family is back from the UK after celebrating Christmas and New Years. I dint get time to blog at all. After i finished switching i managed to finish OSPF and a little bit of BGP before New Years. I have booked my CCIE written exam on 28th January 2009. So its time to get serious again and knock the Written exam and start preparing for the Big one. Thanks to RICK TYRELL, DAVE AROUNSACK , OMKAR (all buddies from CCIE BOOTCAMP in PASADENA, US) for following my blog and keeping in touch with me. Congrats to DAVE for Passing his CCIE Written exam.

Switching Finished

2008-12-22T15:08:00.000-08:00

Finished switching labs from IPEXPERT. Also finished the Switching labs from Advanced workbook which we got at the bootcamp. Have started with Labs and videos from IPEXPERT BLS. Once i finish both of them then i will start RIPV2 labs from Soup to Nuts and then finally finish RIP by doing the labs from advanced workbook.

Study day 3 Switching

2008-12-18T14:36:00.000-08:00

This morning i finished all my switching labs from Narbik's Soup to nuts. Also watched the switching videos from IPEXPERT BLS. Tonight i am going to finish the Bootcamp workbook which i got from Narbik's bootcamp. A lot of new things came out of it. The labs are really good and i have much better handle on switching. I always used to take switching lightly and used to concentrate more on Routing. But now after doing the labs and watching videos it was an eye opener. Once i finish the bootcamp workbook i will do IPEXPERT switching labs. Hopefully switching will be finished by the end of Sunday.

Back to Study Mode

2008-12-16T16:49:00.000-08:00

Finally got back into the Study Mode. As i am still awaiting for my books to arrive from the courier company ( Customs are holding onto my baggage and i had to fill some forms) so i thought i cant waste my time waiting for the workbooks to arrive. So i started with the IPEXPERT BLS video. It is divided into five parts and each part is equivalent of one day at the bootcamp. So i started with Day 1 and picked up Frame-relay saw the video. Then i did few labs on Frame-relay. I had a free session with Proctor labs so i thought it is a good idea to get used to their system and also do some labs to make the best use of it. The system is easy to understand and quite straightforward. So finally i finished Frame-Relay. Tommorrow it is switching and i am sure it will take more than a day to finish the videos and finish the exercises which come with it.

Trip to India ends today

2008-12-10T18:38:00.000-08:00

Today is my last day in India. I fly back to Auckland tommorrow morning. The trip has been great. Also went to US to attend my bootcamp in this trip. After coming back from my bootcamp havent studied anything as had just two days to pack all the bags and other stuff which i have to take away. One suitcase full of CCIE books. Will start updating my blog on my study once i am back in Auckland.

DAY 5

2008-12-06T16:37:00.000-08:00

Couldnt update the blog yesterday had to catch a flight just after the class. Last day we did Multicasting. Narbik as usual makes it look so easy. Then Narbik bought us some Armenian food. Overall my experience has been very satisfying. I learnt a lot of new things during this 5 day bootcamp. Learnt a lot of things which will make me a better engineer. As Narbik says that if you know ( i should say understand) his workbooks cover to cover you will pass the exam. I am flying out of US tonight and wont be able to update the blog for next two days. But will update again of how my lead up to the exam is going. Narbik gave us some really good tips on how to study before attempting the lab. I am planning to do my lab exam in august and before that will attend Narbik's bootcamp in Sydney which is free for the students who have attended a bootcamp before. Great way to revise everything again.

Workbooks provided with bootcamp

1) Soup to nuts ( You get this when you sign up for the bootcamp) you are expected to finish this before you start the bootcamp.

2) Advanced CCIE Routing and Switching Work Book ( 5 workbooks 1 for each day) : You get this workbook during your bootcamp which is specially made for the bootcamp.

3) You get another workbook during the bootcamp which has got some more complex labs

That is a lot to digest in 5 days but you can work on them according to your study plan. I would really recommend this bootcamp to anyone who wants to prepare for this CCIE Routing and Switching.

Day 4 Narbik Bootcamp

2008-12-04T14:06:00.000-08:00

Today did some RIP labs. It looks so easy when Narbik is explaining the stuff on the whiteboard but as soon as you leave the class and go back to the hotel and try to finish the labs which are in the workbook so suddenly start thinking how did he do that. You really need to know a lot before you start doing all those labs. But the quality of labs if really good. I am really impressed with the way he has taught in the last few days and i feel that i will be a better engineer. Another day and a half to go and then i fly to SFO.

DAY 3 BOOTCAMP NARBIK

2008-12-03T11:35:00.000-08:00

Day 3 of the bootcamp. Today we are doing BGP. Half way thru the day and already learnt so many new things. The class will finish around 4.30 -5 then we start doing the labs which according to Narbik are RIDICULOUSLY EASY. Narbik is taking us out for lunch. So we are going for lunch now. Rest after the lunch.

Narbik bootcamp Day 1

2008-12-01T22:32:00.000-08:00

Finished Day 1 of Narbik's bootcamp. Man it is intense. Narbik gave us 5 workbooks and two bootcamp workbooks. One for everday and if you get time then try doing some labs from the bootcamp workbook.Really tired today....but it is worth it. Today we covered switching and frame relay. Too many things which i havent even seen before plus the examples which he gives are really great...Will try to update everyday but not sure whether i have that energy to do that at the end of the day...

Narbik Bootcamp

2008-11-03T10:14:00.000-08:00

Getting ready for my bootcamp on Dec 1 - Dec 5 in Pasadena. This morning i got my SOUP to NUTS workbook. Quite big workbook about 800 pages of Q & A. Good timing that i am in india at the moment for holiday so got the whole workbook printed for under $30 including binding. Will get my IPEXPERT workbooks printed as well as the estimated cost of getting them printed in colour is just $65 as compared to what they charge $250.

Will start my Soup- nuts workbook tommorrow as it is already 11:57 PM and had a busy day today which included shopping , eating lots of YMMMMMMY food and last but not least OSPF. Finished OSPF from IPEXPERT workbooks. A great relief. But now my focus will be soup to nuts as i am aiming to finish it by 26th December as i fly on 28th and i need 27th for travelleing from Chandigarh to Delhi ( 4 hours by train).

Certifications Connect - Becoming a CCIE (Video on Demand)

2008-10-14T03:37:00.000-07:00

Found this really interesting VOD on sadikhov forums. The Video on Demand has got Q & A and also there is a Virtual Tour where they show you what you can expect during the exam. Really nice.

http://tools.cisco.com/cmn/jsp/index.jsp?id=42187&redir=YES&userid=(none)

Register for CCIE TV: CCIE Program Updates October 23, 2008

2008-10-14T03:32:00.000-07:00

Watch a live presentation done Learning@Cisco Product Marketing Managers David Bump, Mary Ng and Sanjay Mehta. David Bump manages the Cisco 360 Program and the Service Provider curriculum. Sanjay Mehta manages the Wireless Certifications and Curriculum. Mary Ng manages the Unified Communications Curriculum and is the Project Lead for CCIE Security.

Date: October 23, 2008Time: 8:00 am PST, 11:00 am EST, 15:00 GMTDuration: 1.5 hour

Agenda:

The program will focus on the following objectives. After the presentation portion of the show, we’ll be taking live calls from YOU – the viewer— during our Q&A session. You may also submit questions electronically.

Objectives:

• CCIE Program Overview• CCIE 360 Program• CCIE Mobile Testing Labs• CCDE Updates• Security Lab Updates• Brand new curriculum!!!

You can register for this event using the following link

https://cisco.hosted.jivesoftware.com/docs/DOC-3164

Source: Cisco Learning Network.

Cisco Advisrory VI :Cisco IOS Software Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability

2008-09-24T19:16:00.000-07:00

Summary

A vulnerability exists in the Cisco IOS software implementation of Layer 2 Tunneling Protocol (L2TP), which affects limited Cisco IOS software releases.

Several features enable the L2TP mgmt daemon process within Cisco IOS software, including but not limited to Layer 2 virtual private networks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack Group Bidding Protocol (SGBP) and Cisco Virtual Private Dial-Up Networks (VPDN). Once this process is enabled the device is vulnerable.

This vulnerability will result in a reload of the device when processing a specially crafted L2TP packet.

Cisco has released free software updates that address this vulnerability.

Workarounds that mitigate this vulnerability are available.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml

Cisco Advisory V: Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks

2008-09-24T19:14:00.000-07:00

Summary

Multiple Cisco products are vulnerable to DNS cache poisoning attacks due to their use of insufficiently randomized DNS transaction IDs and UDP source ports in the DNS queries that they produce, which may allow an attacker to more easily forge DNS answers that can poison DNS caches.

To exploit this vulnerability an attacker must be able to cause a vulnerable DNS server to perform recursive DNS queries. Therefore, DNS servers that are only authoritative, or servers where recursion is not allowed, are not affected.

Cisco has released free software updates that address these vulnerabilities.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080708-dns.shtml.

Cisco Advisory IV :Cisco IOS MPLS VPN May Leak Information

2008-09-24T19:12:00.000-07:00

Summary

Devices running Cisco IOS versions 12.0S, 12.2, 12.3 or 12.4 and configured for Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs) or VPN Routing and Forwarding Lite (VRF Lite) and using Border Gateway Protocol (BGP) between Customer Edge (CE) and Provider Edge (PE) devices may permit information to propagate between VPNs.

Workarounds are available to help mitigate this vulnerability.

This issue is triggered by a logic error when processing extended communities on the PE device.

This issue cannot be deterministically exploited by an attacker.

Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml

Cisco Advisory III :Multiple Multicast Vulnerabilities in Cisco IOS Software

2008-09-24T19:10:00.000-07:00

Summary

Two crafted Protocol Independent Multicast (PIM) packet vulnerabilities exist in Cisco IOS software that may lead to a denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml.

Note: The September 24, 2008 IOS Advisory bundled publication includes twelve Security Advisories. Eleven of the advisories address vulnerabilities in Cisco's IOS software, and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each Advisory lists the releases that correct the vulnerability described in the Advisory. Please reference the following software table to find a release that fixes all published IOS software Advisories as of September 24th, 2008:

http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-cucm.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml

http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml

Cisco Advisory II :Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities

2008-09-24T19:09:00.000-07:00

Summary

Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the IOS device.

Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory.

There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml.

Cisco New Advisories

2008-09-24T19:06:00.000-07:00

Vulnerability in Cisco IOS While Processing SSL Packet

Summary

A Cisco IOS device may crash while processing an SSL packet. This can happen during the termination of an SSL-based session. The offending packet is not malformed and is normally received as part of the packet exchange.

Cisco has released free software updates that address this vulnerability. Aside from disabling affected services, there are no available workarounds to mitigate an exploit of this vulnerability.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml .

CCIE R & S BLS

2008-09-24T15:19:00.000-07:00

Bought the Blending learning from IP EXPERT. Managed to buy it for $999 US. Downloaded few workbooks from the online account until i get my HardDrive full of goodies. The first look on the BLS is good. They have decent workbooks and you can practice all of them using their Racks if you dont have the rack at home. They are running some specials on Rack Rentals where you get 30 % extra for any rack rental they buy.

Finally Decided

2008-09-17T03:31:00.000-07:00

So today i finally decided that i need to clear my brain of all the clutter about what i am going to do while i am away on holidays. I am going back home (India) for holidays ...But wait i still have nearly two months before i go on holidays. So i finally pulled the plug and came back to reality that i need to start preparing for my CCIE before i do that Narbik's bootcamp either in Sydney/US. Have been bit busy at work and the rest of the time wife has been dragging me to accompany her to the shopping centres so that she can buy all those gifts. But finally today i am feeling a bit proud of myself that i have finally got my time table ready.

HSRP

2008-09-17T03:19:00.000-07:00

HSRP uses a priority scheme to determine which HSRP-configured router is to be the default active router. To configure a router as the active router, you assign it a priority that is higher than the priority of all the other HSRP-configured routers. The default priority is 100, so if you configure just one router to have a higher priority, that router will be the default active router.

All hosts on the network are configured to use the IP address of the virtual router (in this case, 1.0.0.3) as the default gateway. The command for configuring the default gateway depends on the host's operating system, TCP/IP implementation, and configuration.

Note The configurations shown in this case study use the Enhanced IGRP routing protocol. HSRP can be used with any routing protocol supported by the Cisco IOS software. Some configurations that use HSRP still require a routing protocol to converge when a topology change occurs. The standby router becomes active, but connectivity does not occur until the protocol converges.

The following is the configuration for Router A:

hostname RouterA

interface ethernet 0

ip address 1.0.0.1 255.0.0.0

standby 1 ip 1.0.0.3

standby 1 preempt

standby 1 priority 110

standby 1 authentication denmark

standby 1 timers 5 15

interface ethernet 1

ip address 3.0.0.1 255.0.0.0

router eigrp 1

network 1.0.0.0

network 3.0.0.0

The following is the configuration for Router B:

hostname RouterB

interface ethernet 0

ip address 1.0.0.2 255.0.0.0

standby 1 ip 1.0.0.3

standby 1 preempt

standby 1 authentication denmark

standby 1 timers 5 15

interface ethernet 1

ip address 2.0.0.2 255.0.0.0

router eigrp 1

network 1.0.0.0

network 2.0.0.0

The standby ip interface configuration command enables HSRP and establishes 1.0.0.3 as the IP address of the virtual router. The configurations of both routers include this command so that both routers share the same virtual IP address. The 1 establishes Hot Standby group 1. (If you do not specify a group number, the default is group 0.) The configuration for at least one of the routers in the Hot Standby group must specify the IP address of the virtual router; specifying the IP address of the virtual router is optional for other routers in the same Hot Standby group.

The standby preempt interface configuration command allows the router to become the active router when its priority is higher than all other HSRP-configured routers in this Hot Standby group. The configurations of both routers include this command so that each router can be the standby router for the other router. The 1 indicates that this command applies to Hot Standby group 1. If you do not use the standby preempt command in the configuration for a router, that router cannot become the active router.

The standby priority interface configuration command sets the router's HSRP priority to 110, which is higher than the default priority of 100. Only the configuration of Router A includes this command, which makes Router A the default active router. The 1 indicates that this command applies to Hot Standby group 1.

The standby authentication interface configuration command establishes an authentication string whose value is an unencrypted eight-character string that is incorporated in each HSRP multicast message. This command is optional. If you choose to use it, each HSRP-configured router in the group should use the same string so that each router can authenticate the source of the HSRP messages that it receives. The "1" indicates that this command applies to Hot Standby group 1.

The standby timers interface configuration command sets the interval in seconds between hello messages (called the hello time) to five seconds and sets the duration in seconds that a router waits before it declares the active router to be down (called the hold time) to eight seconds. (The defaults are three and 10 seconds, respectively.) If you decide to modify the default values, you must configure each router to use the same hello time and hold time. The "1" indicates that this command applies to Hot Standby group 1.