Re-certified CCIE 20572

Finally done with that on last Friday 28th, that test was like a stone over my chest, with all my work and family I had almost no time for studding but I did it anyhow. So now for additional 2 years I can unchange my signature :-). The test was not that hard (ver3) I think the hard was the anticipation for a hard question that will fail me.

DCOF – Data Center of the Future

yesterday we had a virtual event provided by some of the leaders in Data Center Computing (Cisco, VMware, EMC, Oracle, NetApp, APC, EMERSON) the web virtual Event entail some of the challenges and current design's as well as future design and solutions we may encounter in Data Centers.

From my prospective the main event where the 2 first presenters Cisco and VMware, both have joind forces to show you how the Data Center of the Future should look like, VMware as the Application infrastructure and Cisco as the Networking complimentary.

We will expect to see them more and more in Data Centers providing High Availability Fault tolerance and network resilience between Data Centers.

Some of the hot discussed topics where the:

1. VN-link – amazing Cisco Nexus 1000V basically that is a replacement for vSwitch (VMware layer 2 switch on ESX/ESXi) and I will add to it an amazing with huge amount of capabilities in compare to the vSwitch under the ESX/ESXi.
2. FCOE – Fiber Channel Over Ethernet std although not new, in the context of Data Center resiliency, management, scalability and cost reduction FCOE can is defiantly an option.
3. vSphere – VMware Cloud solution version 4, was announced several weeks ago officially by VMware, yesterday was interesting to see the vision for the data center and there honesty about some of their weakness in the networking area (where Cisco compliment them to some level).

I work today a lot with VMware solutions and see their adaptation as their products advanced, the DCOF will be very interesting…

CCIE Re-certification

I have had in the past months much considerations to take before I am starting the process again of studying for my certification, some of the considerations I will share with you (some I will leave to my self). 1) Time - that is the main point as in the last 1.5 years since the CCIE my work had become so hectic and demanding that I barely have time for my family let alone my self. 2) Money - yes you would think becoming a CCIE would win you the jackpot but I would share with you a secret it will not (may be for some lucky ones) the financial crises had got to all. 3) Family - I have 1 wife 1 son and 1 in the oven (we say tphoo tphoo tphoo like touch wood). so I need again to split my self into several pieces hopefully I would be able to reassemble all back (transformers...). 4) Work - Yes work this is the place my pay check come from, again split my self. 5) Should I consider a different track - I gone back and forward on that question over and over. 6) What material to take - again read the same books, rfc's... and if it is a new track where to start. I will not bore you with all the details and I will tell you that the final result was 1) Time = night 2) Money = dont have a choice, my job dose not pay for that but is also fair and not taking my title under her "wings" like I hear about many others. 3) Family = I would just say that I love my wife son and soon to be ... 4) Work = the only once that do not have any considerations. 5) I Decided to re cert in my current track R&S, much less time! 6) Yes no choice but to go back to txt books.

Advice unless you have a spare time or your job help you (time, money, and they need it) do not consider a different track, specialize in your own track be the best you can be where you at.

So Wish me Luck (I will keep my date to my self for now) :-)

TCP Window Scale

One of the overlooked subjects especially when it come to the CCIE RS is the real deep knowledge and understanding of TCP, the one subject from the scope of TCP that I would like to pass to you readers is the concept of Window Scaling. Why do we need window scaling or what the hell is it?! First may be lets start with the why, I do not know about you guys but when I am buying something I expect to utilize it fully and not half way, and the same goes to my Internet line if I buy 10Mbps pipe I do not want to utilize only 5Mbps. So What is Window Scaling and how can he help us better utilize our pipe?! Window Scaling is an optional enhancement that allows us to extend our window size so you say wait why do I need to extend my window size? Well normally the window size is 16 bit with a max size of 64K byte and when you are talking about a in your LAN delay (1ms avg) that is more then enough for just above 500Mbps but when we are over the WAN we start experiencing some delays the amount of throughput we can provide is decreasing fast, already with 10ms delay you can have only just above 5oMbps with 100ms we already in 5Mpbs and you see where is that going. so what and how we can take the 16bit we have in the TCP header and make them bigger well the simple answer is we cant as we have only 16bit not one bit more in the header for window. but what we can do is use the options 3 byte filed to where we indicate what is our scale factor, the defined scale factor can be between 0 to 14 where the max window can be 1GB 65536 * (2^14) = 1073741824 well now we are talking this is a window. but with grate window come grate responsibility, now we need to watch out for overflowing the network causing congestion (the congestion will be for another talk). So basically what we learned is that the higher the Delay we need a bigger window to free the belt on our traffic. The Max Throughput calc is actually very simple: [ WIN(in bits)/delay(in second) ] / 1000000 = Throughput in Mbps Scale Window calc is: (2^scale factore) * window(bytes) Notice that as the WS is optional it must be offered by both sides to and the lowest WS factor win.

MPLS Deployment reasons

1) Faster convergence, in the old days that was a valid reason due to the relatively complex forwarding task that required more resources then Label forwarding. Today non relevant

2) RFC 1483 the newer 2684 AAL5 ATM Adaptation Layer 5 the implementation of IP over ATM

3) BGP Core Free on the SP network, as with MPLS lookup is done based on Labels and not destination address there is no need to have the BGP table in the Core for external prefixes lookup's. this is a massive change from the requirement that Every router in the core must have BGP enabled (cpu and memory intensive load) to only the edge router have BGP enabled mean higher performance and capability.

Note: edge routers still need to have the BGP routing tables, edge routers are translating between ip routing decision to label based decisions.

4) Deployment scalability, when we face with large scale client to deploy (client that connect with 50 - 300 sites and more) we need to have under the consideration the deployment scalability and management, with that in mind 2 models of deployment are optional:

a) VPN Overlay - creating a point to point connection over the SP network, can be achieved in layer 1, 2 or 3.

Layer 1 TDM E1 T1... Layer 2 ATM FR... Layer 3 GRE, IPIP...

b) Peer to Peer - creating a connection between sites trough the ISP and with him, what I mean is that the SP need to join the client network and to achieve client privacy the SP need to manage acl's and routing updates, not very scalable and a lot of overhead. notice that in addition to the disadvantage for the SP on the additional management overhead and complexity there is the client control (doesn't have any) of his layer 3 network trough the SP.

With MPLS the VPN allow the Peer to Peer bad model to have advantage over the Overlay model where in the MPLS we use VRF Virtual Routing Forwarding separators between each network and the configuration is done only on each new site. meaning that if I am an SP and I have 3 client (Cisco, Microsoft, Verizon) each vrf will have a unique color vrf Cisco, vrf Microsoft and vrf Verizon, and to join a new branch is only to color this branch traffic accordingly, so the main work is done in the initial design and implementation and any new addition is actually very simple to add.

5) TE - traffic engineering is a small phrase for a very big spectrum of options, normally traffic routing is decided at each point separately and usually the best route is chosen according to the shortest path to destination, using TE we can make the routing decision based on multiple criteria options. allowing the traffic to fully utilize network capability.

FRR - Fast ReRouting is a very good feature that allow you to detect and reroute based on router availability in less than 50ms Very important in high sensitive traffic like VoIP.

JUNIPER JNCIA-ER SCORE 90

Well I know this is not Cisco but I have just passed 30 min ago my JNCIA-ER exam with score of 90, to be honest that was one of the shortest test's I have ever had, usually I stay no meter what to the last minute but because I was pretty sure on my answers I have left after ~20 min. The resources provided from the www.juniper.net/fasttrack/ site are excellent and answer 100% to the test questions. almost to good to be true. I must say that the last 3 weeks I have been playing with the junos (under my vmware setup) it seem to be realy nice and powerful OS. So for you professionals and experts I think it should be very nice knowledge edition, I am still thinking if I want to proceed with the JNCIS-ER exam or stop here with juniper, I will update you later. All of you have a nice weekend :-)

Spanning Tree Basics

Spanning Tree is one of the topics that most people a really scared as it is almost fully automatic feature People don’t bother to dig into it; my idea here is to give you a simple way to understand the protocol basics And also get a glance on its complex. First thing when I learn a new protocol I would like to look how it is working on the low level, so here I have drown you the BPDU structure, you can see that all implementations have a common ground and thus there is full backward support: Filed Description: PID = Protocol ID Always 0x0000 VID = Version ID 1) STP 0x00 2) R-PVST 0x02 BT = BPDU Type 1) STP 0x00 2) R-PVST / MST 0x02

TCN / TCN Ack is used only with IEEE 802.1D or with interoperation with RSTP. Proposal and agreement handshake are bits used to prevent loops, proposal sent from a designated port And agreement is sent from the root port. Unlike IEEE 802.1D in which any transition between the blocking and the forwarding state causes a topology change, Only transitions from the blocking to the forwarding state cause a topology change with RSTP. Root ID Show the Root Bridge Priority and the MAC address Root Cost Show your distance from the Root Bridge BID = Bridge ID Here the switch advertise his own Bridge MAC and Priority Port ID A 2 byte number, the first octet build from a configurable priority, the second octet is a number set by the Bridge for the port BPDU was sent from usually in newer Bridge model the port id is the Port number but in Older models it was a random number assigned to the port. Newer models: Show spanning-tree vlan 1 detail Older models: Show spanning-tree MAge = Message Age Indicate an estimated time required for a BPDU to be sent and received by any other bridge, although specified in time it is actually increasing The value by hop count. MA = Max Age This filed is given from the root bridge and by default set to 20 sec indicate the max age of a BPDU. Hello Indicate the time between each BPDU sent from the root bridge. Default 2 sec FWDD = Forward Delay Indicate the amount of time the bridge should stay in each state when transiting from blocking to forwarding. V1_L = Version 1 Length V3_L = Version 3 Length MST EXTENTION MST Config ID MST Config Name = configuration name MST Config Revision Number = configuration revision number MST Config digest = configuration digest CIST Bridge Identifier = CIST Internal Root Path Cost = cost to the root bridge CIST Remaining hops = default (20) state the max number of hops from the root bridge if packet received a packet with remaining hops set to 0 then he will Ignore the spanning tree BPDU and will be able to declare himself as Root Understand the debug as it is one of the tools you have to troubleshoot in real time, but with that said you need to make sure you do not activate spanning tree debug on production with logging console enable as you will probably end up locked out from your switch. ! Do before debug under global config No logging console logging buffered 200000 end clear logging debug spanning-tree bpdu ! output will be displayed under the “show logging” ! to disable debug un all Example output from the debug: *Apr 14 01:19:56: STP: enc 01 00 0C CC CC CD 00 14 F2 E9 44 16 00 32 AA AA 03 00 00 0C 01 0B ! you can see destination MAC 01 00 0C CC CC CD the Cisco multicast address for PVST+ also LCP show AA AA indicate to look into the next 5 byte of information in the LCP, the last 2 byte indicate the ethertype 010b is for PVST+ *Apr 14 01:19:56: STP: Data 000002023C60670014F2E944000000000060670014F2E9440080160000140002000F00 *Apr 14 01:19:56: STP: VLAN0103 Fa0/22:0000 02 02 3C 60670014F2E94400 00000000 60670014F2E94400 8016 0000 1400 0200 0F00 ! BPDU represented in hex *Apr 14 01:19:56: RSTP(103): Fa0/22 repeated msg *Apr 14 01:19:56: RSTP(103): Fa0/22 rcvd info remaining 6 *Apr 14 01:19:56: STP: VLAN0104 rx BPDU: config protocol = rstp, packet from FastEthernet0/22 , linktype SSTP , enctype 3, encsize 22 Short story on the LCP LLC (Logical Link Control) also called 802.2 header and is between 3 to 8 byte long containing protocol type information of the packet. The 3 first bytes are mandatory: DSAP Destination Service Access Point SSAP Source Service Access Point And one more byte that is important only when using SNA in any other cases it is ignored Now you will probably ask what the additional 5 byte is. Now this is where it gets little complex, when using standard STP IEEE or ISL trunks (Cisco Run ISL with PVST that is much similar to the standard accept for the vlan ID addition) then DSAP and SSAP will be set to 0x42 but when configuring DOT1Q trunks on Cisco then they use PVST+ and they are setting the SSAP and DSAP to 0xAA where it point to the additional 5 byte where we get the SNAP (SubNetwork Access Protocol) that is giving us a description of what protocol we are using in layer 3 (AppleTalk, IP, XNS….) Ok this until now are the basics for STP, once you have the structure in place it will be much easier (warning: it is not easy) to understand how it works. Recommended reading: http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080094954.shtml

10 CCIE LAB TIPS

1. Read the entire exam – now I know everyone is saying that and even Cisco it advising that in there site, but this is one of the important things you need to do before you start configuring as when you start configuring, your mind is set to different mode and you will miss important details.
2. Take Notes - In addition to step 1 you must know to take notes, what I mean you ask yourself?! Well when you read the exam you will probably be thinking "am I wasting my time reading when other are typing and almost finishing their exam" I say NO you are not but because you all stress and your brain is speeding in almost 200mph you will not remember if you will not take notes.
3. Work Your Way UP – After first two steps are done you are probably 30 min – 40 min into your exam do not panic, work in a step by step layer 2 to layer 3…
4. Ask The Proctor – there was in my lab a real nice person that I am sorry I didn't ask for his name but for me his name was Mr. Proctor and whenever I had a question about something that I didn't understand or I thought that it is not well asked then I got up from my seat and went to his desk and ASKED, no shame, If you do not understand ASK that is one of his jobs, Accept for escorting you to the dining room J
5. Don't ASK Dumb Questions – The Proctor will not give you an answer to your lab question, he will only answer "yes" or "no" format and only if he understand from your question that you know what you are talking about, so do not go and ask "question 1.1 what do you want me to do here" (In CCIE Routing and Switching Practice Labs, Cisco Press book you can see a lot of questions / Answers like that).
6. Be Polite – the proctor doesn't work for you so be nice, that is the end of proctor candidate relation advice.
7. You Can Jump Back and FWD – the exam is open to your judgment you can say I will do first security then multicast or I will do IPv6 last
8. Keep Track – the exam have a lot of questions and sections, you need to write down questions and/or sections you finished, I myself written every question and its points, when done I have marked with "ok" when skipped marked with "later" when I have finished I looked on my paper and made sure I didn't left any question without "ok"
9. Know How to check – after every question I did a check to make sure that what they want to work dose work, it is not always sufficient to put the commands as some time one section is relaying on another and putting the command relating to that question will not work until you add or remove other commands, I hope that is not to confusing, but most of the exam time went in my exam to verification. Also once you go to sections like security that may brake other sections, I would go back and verify the sections all over again and if they don't work I know where is the problem, if I didn't check every step it would be hard and more stressful when something would not work at the end.
10. Do not panic – that is important and for some it is more for other it is less, when you see the exam for the first time do not panic take it and brake it to small pieces, and do it one step at a time, if you face a problem skip ahead do not try to solve it for 2hr you can come back to it later

GOOD LUCK

CCIE LAB Learn Process

I will separate the LAB study process from the Written Exam as they are 2 different process from my point of view, so my study to the lab started at the end of 2006 after I passed my Written Exam, first my plan was to study for 4 months using Rack Rental but as I progressed I saw that this target was not realistic and I had a lot more to practice and to study before I will attempt to go to the lab so I scheduled my lab for mid August 2007, I rented almost 600 hours of rack time and scheduled almost every day a lab session, very important detail I forgot to mention is that I purchased the IEWB from Internetworkexpert. At first stage of my study the version that was available of the Work Book was 3 that was according to the old LAB format with 2 Catalysts only later they released version 4 and 4.1 according to the updated format of 4 Catalysts, but never mind that, at first few months I had a lot of mess in my brain as I didn't had any structured plan on how to approach the lab, then I saw that that mess is getting me no where I stoped and done a study plan divided to subjects that need to be covered and to the importance level meaning that OSPF BGP EIGRP... FR, VLAN, VTP, STP... all these are core subjects and needed to get the highest focus then I taken the Security QoS Multicast IPv6 and other miscellaneous subjects and given them a lower priority and each subject like that I divided to sub category and gave them also priority, finely I had a structured plan of approach and I started working according to it but yet again I saw that I have short time to my LAB so I postponed my first lab attempt to Jan 16 2008, I have rented additional ~500 hours, also I didn't mention but I done also a lot of reading both books like TCP/IP vol 1 and 2 CCIE R&S Practice Labs CCIE Practical Studies vol 1 and 2 RFC's of OSPF BGP RIP IGMP and more It is needless to say that the books are sufficient but it is nice to know the source of the books and some time I found the RFC information clearer then the books. The final stages before the first attempt was almost 3 weeks of each day 8hr doing full lab from the IEWB. I managed to solve most of the labs within 6hr max. as I mentioned my first attempt was in Jan 16th in San Jose California and it was unsuccessful, although I did 100% on the core subjects I had failed the other miscellaneous subjects and there is no excuse for that as most likely I was not ready for all areas, I got my answer on the morning before my flight back and that was a depressing moment (or should I say a week), but after a week I decided that I should not let this effect me and taken my conclusion from the test result on what I need to give my attention and prepared another plan for making my knowledge in these areas stronger for my next attempt that I scheduled for April 18th 2008 (this was passover evening in Israel) I have scheduled this time only ~80hr of rack time and focused on reading. the second attempt I have had in my first 20 min a blackout I said to my self what the hell do I do now?! but then I taken a step back and started all over again reading and taking notes only after ~40min I have started my configuration and from that moment I went trough it like a tornado it was like the cartoons where you get the spot light above your head and then you start doing every thing fast, I got my spot light and went trough one section after another by lunch I had finished almost 80% of the test then when I returned from lunch I finished all the config by 2PM after all checks and 2 full lab reboots. I must say the proctor was very nice and answered all my questions, my suggestion is in your question do not ask for an answer ask for clarification meaning make the proctor know that you know what you are talking about and do not shoot in the dark for answers. Although I finished at 2PM I stayed and tested my configuration until the test timed out just to make sure, I probably went trough the lab 20times, and very important thing SAVE CONFIG. After the lab I was so nerves starting to question my self although deep down I felt that I passed, I had a very long weekend waiting for the report but then it came at 5AM San Jose time Sunday I saw my number and what a wonderful feeling. Now I will take a time off before my next quest

CCIE #20572

That is one happy weekend for me, I posting this from my room Residence Inn in Milpitas City an hour after I recived one of the best news after a very long year and half of studying and one failiur, I passed my CCIE of R&S in San Jose Apr 18 2008. Wonderful feeling, please forgive me for the short story. Thank you all for the support especialy to my wife, son and parents that suffered my moods and my busy schedual.

IPSec Basics

IPSec is an suit of protocols designed to provide interopable and high secure data transfer service. to understand IPSec we need to go to the basics and see some defenitions and protocols used by IPSec and start from there to build our understanding on IPSec, after we know what is IPSec and what he need to provide us we can go over to the practical usage and some configuration samples. so as I have said we have some basics to cover and we will start with: Authentication - is how the units verify they are who they say they are Data Integrity - making sure that the data that was sent it what was recived in the other side with no change Confidentiality - it the Encription of the data Anti-Replay - preventing play back attack, if this mechanizem was not enable then a potential attacker could capture a stream of data and replay it to the box this stream was sent and potentialy could log into the network even if the data is hashed it dosent metter as the other side need to know to unpack that data. this 4 definitios are the very basic to understand, and each one is playing a very important role in the vpn. AH Authentication Header - as it is mentioned in his name it is a header authentication method and can provide integrity authentication and anti-relplay, it is the older form of creating IPSec VPN, and today less used. ESP encapsulation security protocol - this is the new form of creatign IPSec VPN and it add the very important element of Confidentiality or encription of the data as I mentioned. the methods we have to encrypt the data are very wide spread but here are the most common ones DES data encription standart 64bit key 3DES it is 192bit what is even funy The procedure for encryption is exactly the same as regular DES, but it is repeated three times. AES Advanced Encryption Standard has a minimum key size of 128bit and maximum of 256bit, a AES 128 is considered more secure then 3DES. RSA (Ron Rivest, Adi Shamir, and Leonard Adleman) is used for Asymetric Public Private Keys Authentication there are 2 main methods to authenticate pre-shared key is a staticly defigned by the Admin on the units the less secure way but the more common method Certificate Authority this is the high security methode and the less common due to the complex of configuration and usually also you need to buy Certificate from one of the vendors like verisign, commodo... Integrity is using hashing for making sure that that the data is not changed: MD5 Message-Digest algorithm 5 the most commonly hash used today the hash size is 128bit. SHA-1 Secure Hash Algorithm 1 the hash size is 160bit DH Diffie-Hellman "A public-key cryptography protocol which allows two parties to establish a shared secret over an insecure communications channel. Diffie-Hellman is used within IKE to establish session keys and is a component of Oakley." (this line was taken from Cisco Site:http://www.cisco.com/en/US/docs/ios/12_1t/12_1t3/feature/guide/dtgroup5.html#wp1015327 ) Let Me try to expalin the proccess; each unit have a private key (used for decryption) a key that is never passed, and a Diffie-Helman Key (Public Key used for encryption) when a unit want to do a key exchange they each send there Public Key to the other side so lets drill down to Unit_A, Unit_A get the Public Key of Unit_B then using the RSA create a shared key that shared key can only be opened on Unit_B with Unit_B Private Key so even if you intercept the shared key you cant reverse engineer it to see as only the private key of Unit_B will be able to understand it. ok untill here I have summerized for you all the key concepts and provided an example of the proccess used in Asymetric Process of the IPSec next I will take the concept and show you in practice what need to be done to form an IPSec connection. General Guide lines to configure an IPSec connection: 1) Create IKE Policy 2) Create IPsec Transform Set 3) Defign ACL for the encription 4) Configure a Crypto Map 5) Assign the Crypto Map to an Interface Note: when you want to create an IPsec between 2 units you must make sure there configuration match so this is a tip copy the configuration you did to a notepad and on the other side unit only flip the ACL IP address to match the other side and paset it, if you did correct on the first side you will have a working connection, if you did bad then you will need to troubleshoot only one side and again copy paste to the other side, save time and pain!

New Job

Hi Guys, Sorry I don’t have much time as I started a week ago new job in Expand Networks as one of the 3rd level Support Team, our product is the answer to Cisco WAAS, currently I am only learning trying to catch up some huge amount of information on a product that I was never familiar before and in between still studying and preparing for My CCIE. so wish me luck I hope soon I will be able to catch a breath and give you some nice articles :-)

Juniper start here

Ok although I am a fan of Cisco you cant go around and not see that Juniper is there and slow but safely moving up and up, I remembered that I heard the name Juniper in 2001 I said yes yes... and thought to my self another one of thus companies... Today I cant ignore them anymore, and why I saw today the first (I think, as I never saw before) online rack rental and workbook for Juniper http://www.routertricks.com/ this I think is the first but many will follow after, as the demand and the deployments of Juniper in the world today are growing and I do not think there is an ISP or any SP (Wireless / Mobile / Others) in the Industry today that do not have Juniper some where in his network, now I do not think it is bad for Cisco (other then sales), I think that good competitors bring the best in you, when I was in school if some one tried had better grades then me then I always tried to do harder and if I was the better one I always made sure that it would stay that way (I was very competitive with subjects I liked). so competition is good for Cisco from my point of view.

CCIE R&S CBAC FireWall

One of my major weakness until recently was security, security is the one topic that can kill you if you do not know what you are doing or if you are not careful enough to lookinto the small details. in the past when I came to a task I would attack it straight ahead and not thinking what it can do to other things I did before or what I need to do in the next task, I worked in a task by task strategy, today as I grown :-) I learned that nothing especially in real life is not presented to you in a step by step manner, you always need to gather all the information and sort it your self like a puzzle, some time the puzzle is small and easy some time you cant find the middle piece to complete your puzzle. so my advice to you is take the exam as a puzzle put all the parts in front of you (mean read all and draw basic topology accordingly) and build your puzzle from bottom up (piece by piece) if you cant find a piece then skip you will find it later. Now with that analogy the Security is one of those last pieces in your puzzle that can brake your entire puzzle so you can decide either to leave one piece out or to start rearrange everything (not recommended). With that in mind I would like to talk here on CBAC or the IOS Firewall, the basic Idea is very similar to reflexive ACL but with enhanced support of features and application. What Do we need for the firewall to work: 1) We Must have an ACL - the ACL will be in most of the cases (for the R&S CCIE) on the outside interface and it will have a Deny all statement, now that was a hard issue for me to grasp at first I said to my self what the hell do I need the Firewall to use a ACL?! isn’t that already build into the firewall, well no! the Firewall is "inspecting" traffic as it go out or come in but the ACL define what to be denied from coming into the Router, so that mean only traffic that is coming from inside the network to outside is allowed back in and traffic that is trying to come from outside need to stay out unless there is a permit statement. 2) We need to define and inspect rules and that is another thing that you need to be careful, as if you only set a rule to inspect icmp that mean that only icmp traffic from your network to the outside and back will be allowed, if you will try to browse the internet without setting an inspect rule your traffic will not be inspected and therefore not been allowed back in!!! Now here is my home router example: I start by defign the traffic that I am using from in --> out ip inspect name HOME-FW sip <- My Voip service need to be up ip inspect name HOME-FW snmp <- I have Snmp Server to monitor the networks I maintain ip inspect name HOME-FW http <- a man need to surf :-) ip inspect name HOME-FW https <- some time need to use a secure web browsing ip inspect name HOME-FW dns <- well I do not want to use IP for all my surfing so I need name resolve server access ip inspect name HOME-FW smtp <- need to sent out mail ip inspect name HOME-FW pop3 <- mail in ip inspect name HOME-FW ssh <- all my servers using SSH (linux RHES) ip inspect name HOME-FW icmp <- Pings ip inspect name HOME-FW telnet <- Some of the router I manage are old or do not have SSH ip inspect name HOME-FW udp <- miscellaneous traffic ip inspect name HOME-FW tcp <- miscellaneous traffic ! ip access-list extended ACCESS-CONTROL permit icmp any any echo-reply <- that I am using as the traffic from the router it self is not inspected so if I will not permit it then I will not babble to ping from the router, the same go for the traceroute permit icmp any any time-exceeded permit icmp any any port-unreachable permit udp x.x.x.80 0.0.0.15 any eq snmptrap <- I have in my home a Snmp Server and to allow traps from outside to come in I need a permit permit udp x.x.x.80 0.0.0.15 any eq 5060 <- although I enabled SIP in the inspection rule calls that are originated from outside in need to be permitted as only traffic inspected from inside to outside is permited permit udp host x.x.x.83 any range 10000 20000 <- that is for the RTP, it is not really needed but for the "obscure" bugs that can happen I rather permit it then loose a call. deny ip any any log-input <- the log-input is for tracing attackers always good to have. ! interface Dialer0 <-- that is my outside interface .. ip access-group ACCESS-CONTROL in .. ! interface Vlan16 <-- that is my inside interface .. ip inspect HOME-FW in .. !

This is In response to the comment posted: The ACL has no direct relation to the CBAC firewall, it is there to prevent traffic coming into your network from the outside, the inspection rule is there to inspect traffic going out from your network. if the ACL was not there the traffic would have been inspected but still people would able to go into your network. so if you want to block traffic you must have ACL but if you inspect traffic then even if there is a deny statement on the outside interface traffic is allowed to return. so the short answer CBAC is not inspecting the ACL, CBAC is inspecting what you tell him on the inspection rule.

CCIE Lab San Jose 16 Jan 2008

Ok, I wished to tell you my number after that date but unfurtunetly for me I will need to hold on with that post. so for now I will tell you my expireance, I traveled from Israel to San Francisco California on Jan 12 2008 arrived after painful 18hr flight with a connection in London. Days before the exam I have taken the liberty to relax and sleep as much as I can. The lab Day I have arrived as early as I could at 7am to Tasman Drive 150 bldg C waiting for them to open the doors (yes I am that freek). at about 7:30 they have opened the doors and I waited for the other candidates to arrive, at about 8:15 we where guided to the Lab...(now I cant tell you what happen there as I am obligated to the NDA). What I can tell you is that it was hard but not impossiable I have actually had no problem with the core topics and but I did found the security and qos to be confusing enough to fail me. I certenly learned from this expireance (it was expensive lesson) and hope to not fail on that again, but with no pain there is no gain.

CCDE Interview with Russ White

CCIE BGP ORF

This days I am a little slow on article writing as I am in the final lap before my lab exam (wish to pass..) ok that was on a personal note. Now on a hopefully helping note, i had a little bit difficulty understanding first the logic behind ORF but when the coin dropped then I started hearing a voice in my head saying tada... So here it how it goes, the real BGP full table is currently almost 250K path entries, now you have connection to 3 ISP's and you want for example to get from your Backbone ISP the full table and from your other ISP's only partial table, you then face with a dilemma should I develop my human bagging skills to ask nicely from each ISP's to filter on his side specifically for you and what you will probably get as answer is "NO" or if he is nice then "NO". So now you face with a problem you can get from each of the ISP's the full table and filter on your side but it will not solve the performance and resource intensive problem you wanted to avoid. or you can call the nice person in the ISP side and ask him just to put neighbor capability orf prefix-list recive and on your side: neighbor capability orf prefix-list send note: that this will reset your BGP peer relationship, after that you will create your Prefix Filter now lets say you want to only recive the 2 class B subnets all you need to do is: ip prefix-list FILTER-FULL-TABLE seq 5 permit 187.0.0.0/16 ip prefix-list FILTER-FULL-TABLE seq 10 permit 198.0.0.0/16 ip prefix-list FILTER-FULL-TABLE seq 15 deny 0.0.0.0/0 le 32 ! ! under the BGP process ! router bgp neighbor prefix-list FILTER-FULL-TABLE in ! This will result in filtering the BGP table on your ISP side so you will not even get the table to filter it, it is cool not?! as it is allowing you to create filters on the ISP side without him to do any thing. Here is a small example from my home lab: R3 is peering with R1 and R1 is advertising some prefixes now R3 want to filter them but not on his side: !R3 before ORF ! router bgp 100 no synchronization bgp log-neighbor-changes neighbor 150.1.1.1 remote-as 200 neighbor 150.1.1.1 password CISCO neighbor 150.1.1.1 update-source Loopback0 ! R3#sh ip bg BGP table version is 193, local router ID is 150.1.3.3Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 150.1.1.1 0 0 200 i *> 150.1.1.0/24 150.1.1.1 0 0 200 i *> 167.13.0.0 150.1.1.1 0 0 200 i *> 167.13.135.0/24 150.1.1.1 0 0 200 i *> 205.90.31.0 150.1.1.1 0 200 254 ? *> 220.20.3.0 150.1.1.1 0 200 254 ? *> 222.22.2.0 150.1.1.1 0 200 254 ? ! Here is R1 before: R1#sh ip bg nei 150.1.3.3 ad BGP table version is 16, local router ID is 150.1.1.1Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 0.0.0.0 32768 i *> 150.1.1.0/24 0.0.0.0 0 32768 i *> 167.13.0.0 0.0.0.0 32768 i *> 167.13.135.0/24 0.0.0.0 0 32768 i *> 205.90.31.0 192.10.1.254 0 0 254 ? *> 220.20.3.0 192.10.1.254 0 0 254 ? *> 222.22.2.0 192.10.1.254 0 0 254 ? ! router bgp 200 no synchronization bgp log-neighbor-changes network 150.1.1.0 mask 255.255.255.0 network 167.13.135.0 mask 255.255.255.0 aggregate-address 150.1.0.0 255.255.248.0 aggregate-address 167.13.0.0 255.255.0.0 neighbor 150.1.3.3 remote-as 100 neighbor 150.1.3.3 password CISCO neighbor 150.1.3.3 next-hop-self ! NOW: I would like to filter on R1 the following so I will not even get prefixes" 167.13.135.0/24 150.1.1.0/24 222.22.2.0/24 So I am setting on ! R1 (the ISP side for that example) router bgp 200 neighbor 150.1.3.3 capability orf prefix-list receive ! ! R3 (the client side) router bgp 100 neighbor 150.1.1.1 capability orf prefix-list send neighbor 150.1.1.1 prefix-list FILTER-DUP in ! and the following prefix list ip prefix-list FILTER-DUP seq 5 deny 167.13.135.0/24 ip prefix-list FILTER-DUP seq 10 deny 150.1.1.0/24 ip prefix-list FILTER-DUP seq 11 deny 222.22.2.0/24 ip prefix-list FILTER-DUP seq 15 permit 0.0.0.0/0 le 32 ! now be prepared for the TADA.. R3#sh ip bg BGP table version is 194, local router ID is 150.1.3.3Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 150.1.1.1 0 0 200 i *> 167.13.0.0 150.1.1.1 0 0 200 i *> 205.90.31.0 150.1.1.1 0 200 254 ? *> 220.20.3.0 150.1.1.1 0 200 254 ? So Up to now it looks normal that the filter was done on our side and when applied it was filtering incoming prefixes, but no! See R1 Advertisements: R1#sh ip bg nei 150.1.3.3 ad BGP table version is 16, local router ID is 150.1.1.1Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 0.0.0.0 32768 i *> 167.13.0.0 0.0.0.0 32768 i *> 205.90.31.0 192.10.1.254 0 0 254 ? *> 220.20.3.0 192.10.1.254 0 0 254 ? and no there is no prefix list on R1, belive me: R1#sh ip bg nei 150.1.3.3 ... Outbound Route Filter (ORF): received (4 entries) Sent Rcvd Prefix activity: ---- ---- Prefixes Current: 4 0 Prefixes Total: 4 0 Implicit Withdraw: 0 0 Explicit Withdraw: 0 0 Used as bestpath: n/a 0 Used as multipath: n/a 0 ... ORF prefix-list: 3 I hope that was a little eye open on this issue :-)

Mary Christmas and Happy New Year

To all of you that study during the holidays and thinking they are the only one, well you are not alone. Our dedication to the goal is what Differentiate us, an expert is not the one that know all, it is the one that is most dedicated to find the best solution and do what ever it takes. So Mary Christmas and Happy New Year to all of you out there :-) Now let ABBA Continue from here....

CCIE EIGRP METRIC

One of the annoying fileds in my opinion is calculation, I hate them! in my mind it is just in the way of the cool stuff. but unfurtunetly to get to the cool stuf you need to calculate.

so I would like to start by giving you a little review and may be more indepth look over EIGRP Metric, as we all should know EIGRP is a Hybrid Routing Protocol that use a Composite Metric in his DUAL Diffusing Update Algorithm. the Composite metric is composed (good word selection :-)!?) from K Values.

K1 K2 K3 K4 K5

K1 = Bandwidth = 1 meaning it is used in the calculation by default.

K2 = load = 0 you gust it, meaning that is not participating in the calculation by default.

K3 = Delay = 1 you can take it from here

K4 = Reliability = 0

K5 = MTU = 0

the K values tells us if the value is participating in the calculation or not and what is the weight of the value, meaning that if you set K1 to 3 then it means that the weight of K1 will be 3 times more "important" or in other words it will take the BW * 3.

So now we know what are the "K" Values we need to know how to calculate:

well I will not endolge you with long version of the formula as it is hardly ever use (by hardly I mean I never seen it fully used).

Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]

in the attached picture I draw a small network to demonstrate what I mean to get from R1 to R3 netwrok 3.3.3.0/24

you have the following options:
R1 -> R2 -> R3
The lowes bandwith in that path is 64Kbps
The Delay is 20000 for the 64Kbps link 100 for the 100 Mbps linke and another 100 for the 3.3.3.0/24 network link also 100Mbps = 20200 microseconds delay.

so now lets put all into the formula:

Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 100 + 100)]
Metric = [256 * (156250) + 256 * (20200)]
Metric = [40000000 + 5171200]
Metric = 45171200 = FD Feasable Distance (I will Talk about this in a bit)

R1 -> R4 -> R3

Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 1000 + 100)]
! note that now you have 1000 in the path as it is a regular 10 Mbps Ethernet
Metric = [256 * (156250) + 256 * (21100)]
Metric = [40000000 + 5401600]
Metric = 45401600 = FD

R1 -> R2 -> R4 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 20000 + 20000 + 100)]
Metric = [256 * (156250) + 256 * (60100)]
Metric = [40000000 + 15385600]
Metric = 55385600 = FD

R1 -> R4 -> R2 -> R3 I think you should do it now, you should get the point of the calculation

Now that have an idea how to calculate we need to see what route is preferd, in that senarion it is easy but in complex networks this basics can help us understand the proccess (leave the calc to the router).

FD as I was mentioning this Feasable Distance is the Metric that our router see from his outgoing interface to the point he wish to go, also caled end-to-end metric.

AD Advertised Distance that is the Distance we recive from our directly connected neighbor for the path we wish to go.

so for FD of R1 ->R2 ->R3 we get an AD of R2->R3.

FS Feasible Successor is the Router that is chosen by us to be the next hop to the Destination Prefix.

FC Feasible Condition is a rule that tells us in a very logical way to select a FS he must send to us an AD that is lower then the FD.

if we received from R4 for example a AD higher then the FD that we had already in our topology table to get to R3 then we would not consider him to be a Feasible Successor.

so final step lets take the Paths and FD and Calculate the AD and see what path sould we go as I am already exited where to go from now:

Now our AD for the Paths sent to R1:

R2 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/100000) + 256 * (100 + 100)]
Metric = [256 * (100) + 256 * (200)]
Metric = [25600 + 51200]
Metric = 76800 = AD
Metric = 45171200 =FD

R4 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 100)]
Metric = [256 * (156250) + 256 * (20100)]
Metric = [40000000 + 5145600]
Metric = 45145600 = AD
Metric = 45401600 = FD

R1 -> R2 -> R4 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 20000 + 20000 + 100)]
Metric = [256 * (156250) + 256 * (60100)]
Metric = [40000000 + 15385600]

Metric = 55385600 Here we can clearly see that there is not way that this route can meet the FC.
So we have a winner:
Metric = 76800 = AD
Metric = 45171200 =FD

to get to R3 3.3.3.0/24 R1 will take the path R1 ->R2 -> R3.
if it will fail then the path R1 ->R4->R3 will be taken as he still qualified to meet then FC for FS

FS Feasible Successor the second path in the topology that is set only of FC are met.

I hope this was an intersting article :-)

IPV6 Tricks

Have you ever faced with a situation where you where stuck out of your server due to a IP Address Change, well if you didn't you might one day, let me tell you how IPv6 Saved me. I have several Linux Servers in My Company and Due to some maintenance I needed to change the IP Address on on of them, simple task although it went bad due to a miss spelling on the ifcfg-eth0 file. and like I love to go fast with configuration I did a stupid mistake and restarted the network service well needless to say that as soon as I did that I was left outside, started yelling and spelling out some wired brrrrrrr hmmmm grrrrrrr and all sort of mad words. but then I said to my self hey i am an almost Expert I know Networking, how do I solve this, well the port is still listening on the Ethernet Network so If I had some way of login via ARP or MAC or Other Protocol then I was good to go, and then it pupped out to me IPv6 use in link local address based on MAC address and I have the MAC address of my Linux also I remembered that Linux from Kernel 2.6 is using IPv6 Nativity mean that if i will take the MAC address and convert it to IPv6 link local address FE80:: and do not forget to inverse the 7th bit of the MAC address if you have MAC 1234:5678:1111 0001 0010 now it is 0001 0000 1034:5678:1111 and you add to it FE80:: FE80::1034:5678:1111 --> TADA then I will be able to ping it and log in from one of my other servers so that is what I did and there you go a rescue backdoor to your network when your IPv4 network is down. also you could login from remote if you set on your Cisco a 6to4 tunnel, but that is for next article, leave the good stuff for later :-)