Do CCIEs have special powers?

CCIE Routing & Switching

doccieshavespecialpowers — Sun, 10 Jul 2011 08:41:44 +0000

It’s been just under a year since I passed the SP lab, I’ve been concentrating on my career and work rather than studies and things have been moving along very nicely, having just started a new job. The technology is much more leading edge, specifically using Cisco’s IOS-XR which runs on the platforms CRS/ASR9k/GSR.

I spent a few months after the lab teaching myself Perl, which for any network engineer is a very powerful tool. Personally I think things like UNIX & scripting skills are what set good network engineers apart. I would strongly recommend the book by O’Reily “Learning Perl”. The author is so easy to follow and makes the whole thing very easy, this is on a par with the 642-642 QoS book which I also really liked.

Moving on to the point of this post, I’ve decided to start on my CCIE R&S! I don’t predict this being a huge task because I believe the course overlap is around 70%. I’m starting off with the book “Cisco Press – CCIE R&S Exam Certification Guide, 4th Edition”.

The plan is pretty much read that, sit written and start on the full scale labs by Internetwork Expert before hitting up the lab exam. I think I can knock this over in around six months after which I might start looking at CCDP/CCDE.

CCIE #26654

doccieshavespecialpowers — Tue, 10 Aug 2010 09:22:43 +0000

Between my first and second attempts I drilled down on my weaker areas, as per the points below;

- read every service provider related feature guide for all IOSs

- read the OSPF, IS-IS and Frame-Relay chapters of the following books;
CCIE RS Exam Certification Guide
OSPF Command & Configuration Guide
Troubleshooting IP Routing Protocols
Routing TCIP/IP, Volume 1
- read the Network Management / IP Services chapters of “Routing TCP/IP Volume II”
- did not do any practise labs
- went through the INE OEQ again
- read through notes from previously going through INE OEQ

By the time the date came around I was feeling confident, I was spending less time studying each day because i had literally run out of material to go through. I got to the lab early and slammed down a redbull then I was ready to begin.

The OEQs were done and dusted in the first five minutes. I’m pretty sure I got them all right, this wasn’t because I knew the material better – they were just easy questions. This further built my confidence, I knew I had definitely gotten the three I needed for the lab to count.

I started by reading the entire lab through, nothing really stumped me. I drew up a table of sections/points/time and got started. By the time lunch came around I had already completed around 70% of the paper. There was a major issue on several of the CEs which really scared me. During the lunch break I explained the symptoms to the proctor knowing full well that it was going to be intentional, he laughed and tormented me on not being able to figure out what the cause was (this was warranted as I was a little bit of a smart ass, the proctor is a good guy either way). I started thinking how many points would I lose so that I could calculate if I could still pass or not. When I went back after lunch I had some ideas (gotta stay inside the NDA) and managed to resolve the issue.

This left me with around four hours to finish the configurations and verify everything again. By the time I got to the end I had about two hours left. I felt that I had got every question correct, and went through and made sure everything was still working.

After going through verification twice I got to the point where I felt like “I think we are done here”.. I think that’s from a movie or something… so I cleaned up my desk and handed the exam back to the proctor insisting that there was no more for me to do here. I had left the exam over ninety minutes before the finish time, feeling that it was just too easy and that I had absolutely destroyed it.

I headed back to work to find some of the guys to have a few drinks with. When I eventually got home the results were still not up, then a little while later they appeared.

There was no score breakdown, no marks, just a “PASS” and my CCIE number 26654.

It has been an incredible journey, two years ago I was not even CCNA qualified and it still feels like that was only yesterday. I have to thank my girlfriend and family for supporting me through this endeavor and also all my peers, teachers and those who have mentored me during my career. Although it is true that I took this goal into my own hands, without the influence of others around me I would definitely not be where I am today.

Now I am at the end of this journey.. I have been so focused for so long that it feels strange to not know where I am going, what to do next or what the future holds.. At the very least I think this justifies taking it easy for a while before I guess I will have to start on something else…

There is one other matter to attend to, I started this journey with the thought

“Do CCIEs have special powers?”

I would have to say the answer is no, all it takes is a commitment and the finance to see it through – it’s something anyone can achieve if they want it bad enough!!

Lab round one 21/6/2010

doccieshavespecialpowers — Sat, 26 Jun 2010 23:57:18 +0000

Unfortunately I failed the lab last week. By my count I scored 2/4 on the OEQs and 73% on the lab.

The OEQs were not unfair, they were all realistic. One of them I didn’t know but that was my own fault, the other I made a minor mistake in answering but I should have got it.

The actual lab felt pretty easy, there are some obvious knowledge gaps in the subject of frame-relay / ISIS which is pretty much what cost me the exam (advanced frame-relay configuration not links not working). I finished the exam an hour or two ahead of time and went back through things. I think some of the points I lost where due to vague questions for which my answers were not what they were looking for.

I probably only lost about 12% from not knowing how to do stuff. They were all things I should have known but didn’t focus hard enough because I deemed them legacy and not important enough. I did really get all the hard stuff right with 100% across the MPLS/TE/BGP/VPN/Multicast questions.

All in all I think I could have beat it on the day and have rescheduled 9th August, until which I can fix up my weak spots!

7 Days to go!

doccieshavespecialpowers — Tue, 15 Jun 2010 09:02:34 +0000

As per the subject I have a week before the exam. I havn’t touched anything configuration based for a good week now as I am skimming through every and any RFC I can think of! This is because of the OEQ section, I’ve had a look around on the net for what kind of stuff they ask and it seems they will ask

- something CCNA level, easy
- something CCIP level, shouldn’t be an issue
- something CCIE, pretty hard
- something you will NOT know

Since <3/4 fails the exam you HAVE to get the hard question right. I'm told often this is something from an RFC. I have so far read the following

RFC3036 (LDP)
RFC3209 (RSVP TE Extensions)
RFC1195 (ISIS)
RFC2156 (PPPoE)
RFC2661 (L2TP)
RFC3107 (BGP extensions to carry labels)
RFC3630 (OSPF TE Extensions)

I am also reading MPLS Fundamentals again from the start, about half way through now.

Anyways don't want to fail, feeling pretty good about the practical side. Just worried about the OEQs. Maybe I'll get lucky and pass first go!

Veryifying IS-IS DIS / Pseudonode

doccieshavespecialpowers — Tue, 15 Jun 2010 08:51:17 +0000

This has been really unclear to me until now, I haven’t seen it well explained in any resource I’ve seen so I’ll put it up here for others to see. IS-IS uses the DIS (Designated IS) to perform a similar function to the OSPF DR. The reason this is necessary is on multiaccess networks (eg ethernet) there would be a requirement for every IS to have a neighbor and send SNPs for every other neighbor. This causes a similar problem in BGP where n(n-1) neighbors / updates are required.

For example If I have 3 routers on an ethernet LAN, 3(3-1) = 6 neighbor sessions and 6 updates every interval and so on

Now the router elected DIS (by whatever means..) acts as a pseudonode. This means that all routers on the multiaccess network have a neighborship with the pseudonode and send updates to the pseudonode. This goes for the DIS as well. This way there is a fake logical IS router in the middle of the multiaccess network and it becomes a group of point-to-point neighbors over a multiaccess network (this is how it is explained in RFC1195).

Now onto the point of this, how to verify the DIS/pseudonode

The router elected as the DIS can be identified like this;

R0#show clns int fa0/0
FastEthernet0/0 is up, line protocol is up
Checksums enabled, MTU 1497, Encapsulation SAP
ERPDUs enabled, min. interval 10 msec.
CLNS fast switching enabled
CLNS SSE switching disabled
DEC compatibility mode OFF for this interface
Next ESH/ISH in 35 seconds
Routing Protocol: IS-IS
Circuit Type: level-1-2
Interface number 0×0, local circuit ID 0×1
Level-2 Metric: 10, Priority: 127, Circuit ID: R0.01
DR ID: R0.00
Level-2 IPv6 Metric: 10
Number of active level-2 adjacencies: 2
Next IS-IS LAN Level-2 Hello in 1 seconds

The pseudonode can be verified in the database because there is a duplicate IS router with a modified name;

R0#show isis database

IS-IS Level-2 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R0.00-00 * 0×00000001 0x3E0B 444 0/0/0
R0.01-00 * 0×00000002 0xE66A 472 0/0/0
R2.00-00 0×00000002 0xACC6 469 0/0/0
R3.00-00 0×00000003 0x2BC3 469 0/0/0
R4.00-00 0×00000002 0xF840 449 0/0/0

To interrogate this further you can look at the detailed output and see that there are only ISIS neighbors between each IS router and the pseudonode (note that R4 is not on the ethernet segment but lies on a point-to-point link off R3;

R0#show isis database detail

IS-IS Level-2 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R0.00-00 * 0×00000002 0x3C0C 1128 0/0/0
Area Address: 49.0000
NLPID: 0xCC
Hostname: R0
IP Address: 10.1.1.1
Metric: 10 IS R0.01
Metric: 0 IP 10.1.1.1 255.255.255.255
Metric: 10 IP 10.23.0.0 255.255.0.0
R0.01-00 * 0×00000002 0xE66A 366 0/0/0
Metric: 0 IS R0.00
Metric: 0 IS R2.00
Metric: 0 IS R3.00
R2.00-00 0×00000003 0xAAC7 1115 0/0/0
Area Address: 49.0000
NLPID: 0xCC
Hostname: R2
IP Address: 10.2.2.2
Metric: 10 IS R0.01
Metric: 0 IP 10.2.2.2 255.255.255.255
Metric: 10 IP 10.23.0.0 255.255.0.0
R3.00-00 0×00000004 0x29C4 1117 0/0/0
Area Address: 49.0000
NLPID: 0xCC
Hostname: R3
IP Address: 10.3.3.3
Metric: 10 IS R0.01
Metric: 10 IS R4.00
Metric: 0 IP 10.3.3.3 255.255.255.255
Metric: 10 IP 10.23.0.0 255.255.0.0
Metric: 10 IP 10.34.34.0 255.255.255.0
R4.00-00 0×00000002 0xF840 342 0/0/0
Area Address: 49.0000
NLPID: 0xCC
Hostname: R4
IP Address: 10.4.4.4
Metric: 10 IS R3.00
Metric: 0 IP 10.4.4.4 255.255.255.255
Metric: 10 IP 10.34.34.0 255.255.255.0

Note this doesn’t affect the way packets are forwarded, only the logical topology of the neighbors used for sending updates!

IPExpert WB2 – Cleared

doccieshavespecialpowers — Tue, 18 May 2010 09:27:17 +0000

Starting to feel quite confident now that I’ve been through both of those products. Not much catches me out, I think i would have graded at 80%-90% for most of them.. some maybe even higher.

I still have the CC Bootcamp workbook to go through and I also wanted to freshen up on the LDP/RSVP/TE RFCs before the lab.

Still working through INE’s OEQ tester which is pretty tough. At least is lets me know what I don’t understand that well.

Just over a month before the lab now, feeling the stress!

IEWB II – Cleared

doccieshavespecialpowers — Sun, 25 Apr 2010 05:57:47 +0000

I don’t know what I was thinking but I basically did not do any study between January and mid way through March, when Cisco emailed me to pay for my exam.. I decided to go for it but didn’t realise how much work was left to do.

Between around 20th March and Yesterday I’ve gone through all 10 labs in IEWB2. This was extremely difficult to get into but after the first few it was breezy. It does get a little harder towards the end but if those labs were the exam I sit I think there is a good chance I’ll pass.

Moving onto IPExpert labs A to F now.

Carrier Supporting Carrier Architectures

doccieshavespecialpowers — Mon, 04 Jan 2010 04:34:21 +0000

Going through the CSC questions in IEWB1 I noticed that I didn’t really understand the difference between the three types.. I guess just like the Inter-AS options the lines between the different architectures have blurred. In summary the CSC options are;

#1 (IP) – MPLS is only used on PE/CE (of the supporting carrier)
#2 (MPLS) – MPLS is used between the supporting-carrier PE and supported-carrier PE
#3 (HVPN) – MPLS is used right up to the supported carrier’s PE and CE

I guess once you get to hierarchical VPN it is actually CSC#3 with sub option #1 or #2.. I guess the method you use really depends on what kind of traffic the lowest tier wants to send over the backbone.

The first option simply means that the service provider does not need to peer with the customer using BGP (useful for customers who want the whole internet in their VRF). The second allows the supported carrier to deploy any MPLS application over the supported carrier’s backbone (AToM, VPN, IPv6 etc). The third option just means that the supported carrier can hierarchically support another carrier for either of the previous.

Looking closer at OSPF Sham-links

doccieshavespecialpowers — Fri, 01 Jan 2010 08:34:31 +0000

I was already aware what Sham-links were supposed to be for and might have even configured them once or twice. It does seem there are a few things that can go wrong. I noticed a lot of this doing one of the IEWB1 labs. Some of the following is pretty obvious and some I do not recall seeing mentioned anywhere;

The addresses used in the sham-link command must be internal to the VRF of that OSPF instance
A sham-link cannot be established if the source/destination address’s next-hop is not via the MPLS Cloud (the address is learned over the PE-CE link through the backdoor link)
Default of behavior for MPLS VPNs when a PE redistributes BGP into OSPF is to advertise the LSAs with type 3. As the routes are redistributed into BGP at the ingress PE the advertising router ID is changed to self by the PE. If a sham-link exists however the LSAs with the same advertising router ID will not be propogated as LSA type 1-2.

The third point there is what I found most interesting. Of course you wouldn’t be able to have a backdoor topology using the MPLS VPN as the primary link without this extra little feature of sham-links. This is because the first attribute which OSPF uses to choose the best route is LSA type.

O > O IA > O Ex

And here’s the proof

R6#sh ip ro
10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
O IA    10.1.8.8/32 [110/12] via 10.1.46.4, 00:03:27, GigabitEthernet0/0
C       10.1.6.6/32 is directly connected, Loopback0
O E2    10.1.4.4/32 [110/1] via 10.1.46.4, 00:03:27, GigabitEthernet0/0
O E2    10.1.3.3/32 [110/1] via 10.1.46.4, 00:03:27, GigabitEthernet0/0
C       10.1.46.0/24 is directly connected, GigabitEthernet0/0
O IA    10.1.38.0/24 [110/2] via 10.1.46.4, 00:03:27, GigabitEthernet0/0
O IA    10.1.68.0/24 [110/65546] via 10.1.46.4, 00:03:27, GigabitEthernet0/0

Then add the sham-link (the other side was already done)

R4(config-router)# area 0 sham-link 10.1.4.4 10.1.3.3 cost 1000
*Mar 1 01:36:20.811: %OSPF-5-ADJCHG: Process 68, Nbr 10.1.38.3 on OSPF_SL0 from LOADING to FULL, Loading Done

Looking at the same routing table you can see all the same routes are still learnt via the same neighbor yet the LSA type has changed

R6#sh ip ro
10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
O       10.1.8.8/32 [110/1012] via 10.1.46.4, 00:00:06, GigabitEthernet0/0
C       10.1.6.6/32 is directly connected, Loopback0
O E2    10.1.4.4/32 [110/1] via 10.1.46.4, 00:00:06, GigabitEthernet0/0
O E2    10.1.3.3/32 [110/1] via 10.1.46.4, 00:00:06, GigabitEthernet0/0
C       10.1.46.0/24 is directly connected, GigabitEthernet0/0
O       10.1.38.0/24 [110/1011] via 10.1.46.4, 00:00:06, GigabitEthernet0/0
O       10.1.68.0/24 [110/66546] via 10.1.46.4, 00:00:06, GigabitEthernet0/0

One thing which can make this simple config go horribly wrong is the sham-link addresses. You can see in my example they are external for the CE router, this just happened to be the way the question asked for the task to be done.

It was not a requirement for the PE loopbacks to be in OSPF area 0. If however it was then the difficulty increases very quickly just to make the sham-link come up (due to bullet point two above). You would potentially have to fight the weight and administrative distance to make it work.

Bottom line: if the question doesn’t require you to have the PE addresses in OSPF area 0 then don’t! This will save a lot of time tweaking route-maps and other things..

Slow progress over Christmas break

doccieshavespecialpowers — Sat, 26 Dec 2009 23:37:20 +0000

I’ve already booked my lab for 21/06/2010 (the earliest date I could get). Shame it is so far away I think I could attempt it a lot earlier..

Anyway just got through “IPExpert – Volume I” and now will be moving onto “Internetwork Expert Volume I”.

Fun stuff!