GlobalConfig.net

Un-Productive

Brandon Carroll — Tue, 02 Feb 2010 12:57:37 +0000

For the last few weeks I have been using Windows 7. Now don’t get me wrong, Windows 7 is really pretty (Like a guy is even supposed to use that word). My Issue is that I feel Less productive than when I was using a Mac full time. I think its time to make a change so I can get back to work. My thought is that I want an iMac for my desktop at home. The only catch there is that I do a great deal of development these days with Camtasia. Why can’t the Mac version be as good as the Windows version? I suppose the same is true with Microsoft office, but we all know the answer to that one.

At any rate, my plan over the next few months…iMac, MacBook Pro, iPad.

Maybe I should take up stocks in Apple!

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

It’s a new year. Is it the year you get your CCIE?

Brandon Carroll — Wed, 06 Jan 2010 19:47:49 +0000

Many people that follow this blog are studying for the CCIE. Others are working on lower level certs. I don’t want to take a lot of time in this post since i’m halfway through my first week with IPexpert, but I’m curious…What are you going to do different this year?

By way of comments- yes comments- what is your plan of attack this year and what do you hope to accomplish?

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

CCIE R&S Updates: Not Breaking News, But Good News! Over the Past Year I have tried to provide relevant...
Change in Venue As many of you have already heard I have accepted...
Should you have a study partner for the CCIE? Should you have a Study Partner for the CCIE? It’s...

Related posts brought to you by Yet Another Related Posts Plugin.

Is your weekend going to Rock?

Brandon Carroll — Sat, 12 Dec 2009 04:22:02 +0000

Mine is! I have the opportunity to take a really quick trip to San Jose and meet my new Boss and fellow instructors. I am really looking forward to it! 2010 is going to be a great year!

In other news….I have 1 class left at Ascolta- SNAA, which is advanced ASA training. A week of VPN with certificates lies ahead of me.

Also 2 for 1 vRack time this weekend at ipexpert. If you didnt catch their post on Facebook you can Email sales@proctorlabs.com to take advantage!

Time for me to hop on an R&S rack and lab a bit.

Status Update: It’s been quiet here! Well it’s Sunday night and my wife is crashed out...
Follow UP- IPexpert Training Announced Last week I posted a brief announcement that IPexpert, the...
CCIE R&S Updates: Not Breaking News, But Good News! Over the Past Year I have tried to provide relevant...

Related posts brought to you by Yet Another Related Posts Plugin.

Change in Venue

Brandon Carroll — Mon, 07 Dec 2009 04:13:46 +0000

As many of you have already heard I have accepted a position with Industry renowned IPexpert. I have had many good years working for Ascolta training and I thank them for all that they have supported me in over the years. They are some of the finest people I have ever met.

I will be finishing up my teaching schedule over the next few weeks at Ascolta but will be more active in the Online Study List for Security and R&S, as well as here on the blog.

As I look forward into 2010 I am excited to see the wonderful changes that will come about. I believe that 2010 is really going to rock.

Stay tuned for posts here related to my new task…CCIE R&S and CCIE Voice.

Changes to GlobalConfig.net I want to take a minute to address the over...
Is your weekend going to Rock? Mine is! I have the opportunity to take a really...
CCIE Voice “Must Have” Links I know some of you that read this blog are...

Related posts brought to you by Yet Another Related Posts Plugin.

Can you count the days?

Brandon Carroll — Fri, 04 Dec 2009 05:23:44 +0000

Well, its been a Looooooooong time since I’ve posted. Why? Well because a ton of stuff has been going on. But, you are all in for a real treat. I am not going to say anything yet….but stay tuned!

Am I Insane? CCIE R&S in 90 Days! You may think so after what you are about to...

Related posts brought to you by Yet Another Related Posts Plugin.

CCNA Routing Protocol Comparison Chart Revised

Brandon Carroll — Thu, 29 Oct 2009 00:04:04 +0000

Routing Protocols Comparison for CCNA

I have always said I was going to make this chart since I draw it on the board for nearly every CCNA class I teach. Well, here it is. I may add to it later.

Name	Class	Type	Administrative Distance	Metric	Classful/less	Algorithm	Transport Type
RIP v1	Distance Vector	IGP	120	Hop Count	Classful	Bellman-Ford	UDP/520
RIP v2	Distance Vector	IGP	120	Hop Count	Classless	Bellman-Ford	UDP/520
OSPF	Link State	IGP	110	Cost	Classless	Dikstra (SPF)	OSPF protocol 89
Integrated IS-IS	Link State	IGP	115	Cost	Classless	Dikstra (SPF)
EIGRP	Hybrid (Advanced Distance Vector)	IGP	90 (internal) 170 (external)	Composite (BW + DLY)	Classless	DUAL	EIGRP Protocol 88
BGP	Path Vector	EGP	20 (external) 200 (internal)	Path Attributes (Usually AS-Path)	Classless		TCP/179

There is obviously more to it than what you see here but for the CCNA this should be pretty good.

CCNA Routing Protocol Comparison Chart I have had many classes where students have asked me...
Free CCNA Technical Introduction for CCNA Candidates If the Widget below does not allow you to register...
links for 2009-08-25 Understanding Route Aggregation in BGP [IP Routing] – Cisco...

Related posts brought to you by Yet Another Related Posts Plugin.

CCNA Routing Protocol Comparison Chart

Brandon Carroll — Wed, 28 Oct 2009 21:19:08 +0000

I have had many classes where students have asked me for a simple chart that I write on the whiteboard when covering the routing protocols. I finally put it to paper and am providing it here. I hope some of you find it useful.

Name	Class	Type	Administrative Distance	Metric	Classful/less	Algorithm
RIP v1	Distance Vector	IGP	120	Hop Count	Classful	Bellman-Ford
RIP v2	Distance Vector	IGP	120	Hop Count	Classless	Bellman-Ford
OSPF	Link State	IGP	110	Cost	Classless	Dikstra (SPF)
Integrated IS-IS	Link State	IGP	115	Cost	Classless	Dikstra (SPF)
EIGRP	Hybrid (Advanced Distance Vector)	IGP	90 (internal) 170 (external)	Composite (BW + DLY)	Classless	DUAL
BGP	Path Vector	EGP	20 (external) 200 (internal)	Path Attributes (Usually AS-Path)	Classless

There is obviously more to it than what you see here but for the CCNA this should be pretty good.

You can download it from the link below if you prefer a PDF.

Routing_Protocol_Comparison

CCNA Routing Protocol Comparison Chart Revised Routing Protocols Comparison for CCNA I have always said I...
Free CCNA Technical Introduction for CCNA Candidates If the Widget below does not allow you to register...

Related posts brought to you by Yet Another Related Posts Plugin.

IPv6- Is it more Secure than IPv4

Brandon Carroll — Wed, 14 Oct 2009 19:04:15 +0000

In my IPv6 Class this week we get to touch a number of IPv6 topics. We have already discussed the Basics of IPv6, Routing Protocols, and QoS features. Aside from tunneling, which we cover on Thursday, one of the topics that I am most facinated with (being a CCIE Security) is of course….wait for it……Security! As I prep ahead of time for my class I can’t help but look to see what new and exciting resources are out there to share when it comes to Security. The following video, IMHO, is pretty darn cool. Take a little time to watch it and let me know what your thoughts are.

CCIE R&S Updates: Not Breaking News, But Good News! Over the Past Year I have tried to provide relevant...
What kind of study plan is right for you? Its been a few months since I passed the CCIE...
links for 2009-09-14 Postbox Mail for the MAC (tags: email postbox mac...

Related posts brought to you by Yet Another Related Posts Plugin.

GNS3 setup and outside connections with VoIP example

Brandon Carroll — Fri, 02 Oct 2009 05:52:26 +0000

I don’t want to write another guide to setup GNS3, there is a great tutorial which (in my opinion) covers all necessary steps. I just want to summarize a few things which may shorten the time to get a router in GNS3 to run, make it talk via the ethernet of your PC and connect to a physical router. Further I added an example for some simple VoIP configs to make a CME (with an 79xx phone registered) in the virtual router talk to a FXS interface (analog phone) on another router.

First of all you need to install GNS3, which in turn takes the necessary steps to install the underlying dynamips. Special thanks for this excellent work goes to the folks around the dynamips and GNS3 team. Have a look at the GNS3 site ( www.gns3.net ) and download the “all-in-1″ package. For the installation and initial etup, there is an excellent tutorial here: http://sourceforge.net/projects/gns-3/files/GNS3/0.5/GNS3-0.5-tutorial.pdf/download

I am running GNS3 in an XP64 environment on an AM2 platform with 8GB ram. I tried a few different router models and for my part the 2691 router runs rock solid. The 2621XM had its odds and crashed every now and then, but I cannot say what caused this. The downside of the 26xx series is the limited availability of up to date IOS if you want to test new features. Currently 12.4-15(T10) is the newest IOS which does not include some new SIP-related features. For testing and practicing standard VoIP features this will do the job in any case. I’m using an “Advanced IP-services” feature set. If you need to use the newest IOS-T-Versions, you need to simulate a 7200 series router for whichyou can download a 12.4-24(T1) version.

After the installation and initial setup, I just built a simple network with 2 routers (1 virtual and 1 physical) connected to each other via the PC’s ethernet interface. After starting GNS3, placing a 2691 router and a “cloud” symbol on the workspace, my simple network looks like this:

I switched on the display for the interface names. This is why you see the “nio_gen_eth:\….” entry unter the cloud. This is the physical PC interface. Regardless what IP-address the PC-interface has, the router address is independent (f0/0). If the router address is in the same subnet as your PC, you will be able to access the router from your PC. Lets assume a physical router with its f0/0 interface is reachable from the PC as well and has a FXS-VIC interface 0/1/0. The configuration of R0 (virtual router) and R1 (physical router) could look like this (assuming a very basic H323 connection to make the FXS interface reachable from CME):

R0:
interface FastEthernet0/0
ip address 192.168.16.3 255.255.255.0
speed 100
half-duplex                         <– we are sharing the PC-port like a HUB
!
dial-peer voice 100 voip
destination-pattern 1…                           <– H323 connection to the physical router
session target ipv4:192.168.16.100 <– IP-address of the physical router
!
telephony-service           <– Switch on CME
max-ephones 2
max-dn 5
ip source-address 192.168.16.3 <- accept registration from IP-Phones at this address
!
!
ephone-dn 1   <– the DN for the CIPC or 79xx phone
number 2000
!
ephone 1
description CME-Phone-1
mac-address 0000.0000.0001 <– put the real mac-addres of the phone here
type CIPC          <– phone type CIPC, 7940, 7960 etc.
button 1:1        <– first line gets DN #1 (2000)
!

If you use a 79xx phone you will also need to get the tftp server address (option 150)handed out to the phone via DHCP. A sample configuration would look like this:

ip dhcp excluded-address 192.168.16.1 192.168.16.150
!
ip dhcp pool IP-Phones
   network 192.168.16.0 255.255.255.0
   default-router 192.168.16.3
   option 150 ip 192.168.16.3

This should let the IP-phone register with the CME. The dial-peer with the destination pattern 1… will send all dialed numbers with 4 digits starting with 1 to the .100 IP-address. The configuration of R1 with the FXS-port in 0/1/0 will look like this:

R1:

interface FastEthernet0/0
ip address 192.168.16.100 255.255.255.0
speed 100
half-duplex       <– we are sharing the PC-port like a HUB
!
dial-peer voice 200 voip
destination-pattern 2…                     <– H323 connection to the virtual router
session target ipv4:192.168.16.3 <– IP-address of the virtual router
!
dial-peer voice 100 pots
destination-pattern 1000                <– DN of the analog phone
port 0/1/0                                              <– physical FXS-port

The destination-pattern 1000 assigns DN 1000 to the analog port and is used as CLID on outgoing calls.

This should serve just as a starter configuration. Dive into the VoIP configurations and test any szenario with multiple routers – the sky is the limit. For demo purposes I connected the physical router with a FXO-port to my landline and so I got a PSTN integration. Further possibilities could be setting up a VPN to one of your routers and register the CIPC on your Laptop via the VPN at the CME…..

An integration with UCM will be possible in a similar way. The router needs a Dial-peer pointing to the Callmanager and in turn the Callmanager needs to know a gateway entry with the routers IP-address…..

by Patrick Geschwindner, Ascolta

GNS3 (dynamips) and Voice-Labs I hear often that it is hard to practice/demo voice...
Convert Cisco IP-Phone from SIP to Skinny (SCCP) and reverse I have often been asked for a quick way to...
links for 2009-08-01 Lightweight Directory Access Protocol – Wikipedia, the free encyclopedia...

Related posts brought to you by Yet Another Related Posts Plugin.

Is Core Knowledge Key?

Brandon Carroll — Fri, 02 Oct 2009 01:56:41 +0000

In some popular online forums people have been talking about how the number of candidates that have passed the CCIE Security since the new version is very low, almost non-existant. While there may be issues with the lab itself, a claim on commenter made, I wonder how much of this is related to a lack in understanding of core knowledge concepts. See, as an instructor its easy to get into the trap of knowing all the technical details of how something works because you teach it so often and yet you lack in practical configurations. This is something I have always fought against, one reason I spend as much time as I can on the equipment.

But when it comes to the CCIE you have to face the Open Ended Questions (OEQs). I hear a lot of talk about them and I know that people struggle with them. So I have to ask the question: How do you get your core knowledge? I think this information can be obtained in a few different ways.

Cisco Certified Courses
Cisco Press Books
Third Party Books
Non-Certified Courses
Cisco Documentation
Blogs, Wikis, Forums, and whatever else is out there on the Web.

What do you use?

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

Now back to the point of this post. Is core knowledge key? Absolutley! So let me share with you something I know alot about- The Cisco Certified Courses. I’m going to relate this to CCIE Security, but if anyone wants to know about Voice or R&S we can get Patrick to put that post together.

So lets break down the CCIE Security Lab Blueprint and see what courses would cover the information.

Topic 1:

Implement secure networks using Cisco ASA Firewalls

Perform basic firewall Initialization

Configure device management

Configure address translation (nat, global, static)

Configure ACLs

Configure IP routing

Configure object groups

Configure VLANs

Configure filtering

Configure failover

Configure Layer 2 Transparent Firewall

Configure security contexts (virtual firewall)

Configure Modular Policy Framework

Configure Application-Aware Inspection

Configure high availability solutions

Configure QoS policies

For this section you’re going to want to look at the SNAF course. This class goes into all the topics of the ASA that are defined here. The only drawback to this course is that the labs are primarily using ASDM, something you’re not going to use on the lab. You can look at the outline for the course here.

Next section looks like this:

Implement secure networks using Cisco IOS Firewalls

Configure CBAC

Configure Zone-Based Firewall

Configure Audit

Configure Auth Proxy

Configure PAM

Configure access control

Configure performance tuning

Configure advanced IOS Firewall features

All of this information is going to be found in IINS and SND. IINS is the CCNA Security course and it was developed by Ascolta for Cisco. It’s entry level but teaches you a wide range of security concepts. If you want to start somewhere- this is it. SND is much more involved technically. It includes the topics in this section in detail. You can find the course information here.

The next topic relates to VPN.

Implement secure networks using Cisco VPN solutions

Configure IPsec LAN-to-LAN (IOS/ASA)

Configure SSL VPN (IOS/ASA)

Configure Dynamic Multipoint VPN (DMVPN)

Configure Group Encrypted Transport (GET) VPN

Configure Easy VPN (IOS/ASA)

Configure CA (PKI)

Configure Remote Access VPN

Configure Cisco Unity Client

Configure Clientless WebVPN

Configure AnyConnect VPN

Configure XAuth, Split-Tunnel, RRI, NAT-T

Configure High Availability

Configure QoS for VPN

Configure GRE, mGRE

Configure L2TP

Configure advanced Cisco VPN features

When it comes to VPN things get a little more difficult. VPN is covered in SND, which i mentioned in the above section. However, the coverage in SND is only Router-to-Router VPN. You do get some WebVPN on the routers, as well as Easy VPN on the Routers. If you want VPN on the ASA you have to look at the SNAA course. This is the “Advanced” version of the ASA course, bit really it should be called ASA VPNs. The reason I say this is that it is mostly VPNs (Anyconnect, Clientless SSL, Easy VPN Server and Client, DAP, CSD, and IPSec) but it does include a few other topics- Advanced Nat, Routing and Switching, and Layer 7 MPF. You also get to cover the SSMs in this course. The details can be found here.

The IPS topics are pretty straight forward. They include the following:

Configure Cisco IPS to mitigate network threats

Configure IPS 4200 Series Sensor Appliance

Initialize the Sensor Appliance

Configure Sensor Appliance management

Configure virtual Sensors on the Sensor Appliance

Configure security policies

Configure promiscuous and inline monitoring on the Sensor Appliance

Configure and tune signatures on the Sensor Appliance

Configure custom signatures on the Sensor Appliance

Configure blocking on the Sensor Appliance

Configure TCP resets on the Sensor Appliance

Configure rate limiting on the Sensor Appliance

Configure signature engines on the Sensor Appliance

Use IDM to configure the Sensor Appliance

Configure event action on the Sensor Appliance

Configure event monitoring on the Sensor Appliance

Configure advanced features on the Sensor Appliance

Configure and tune Cisco IOS IPS

Configure SPAN & RSPAN on Cisco switches

For these topics you want to look at Implementing Cisco Intrusion Prevention Systems v6.0. Every one of these topics is covered in the IPS course in great detail. This is another course that was written by Ascolta for Cisco. You can get the details here.

The next section is going to spread things out a bit.

Implement Identity Management

Configure RADIUS and TACACS+ security protocols

Configure LDAP

Configure Cisco Secure ACS

Configure certificate-based authentication

Configure proxy authentication

Configure 802.1x

Configure advanced identity management features

Configure Cisco NAC Framework

Now the Radius and TACACS+ is covered in SNAF, SND, and IINS but they only cover the topics related to the respective course. In otherwords, SNAF covers RADIUS and TACACS+ and Cisco Secure ACS for the ASA. SND and IINS cover RADIUS and TACACS+, Cisco Secure ACS, Certificate Based Authentication, Proxy Authentication, and 802.1x for the Cisco Routers. SND covers the Switches. NAC is coverd in a NAC course but I dont even see it on the Ascolta Course list and I haven’t had to teach it in about 3 years. It was a good course though. There is a course called Implementing Cisco NAC Appliance v2.1 (CANAC), but its the NAC appliance and not the stuff Cisco used to call “Cisco NAC.”

As far as Advanced Identity Management features go…that could mean anything. And I only know of 1 class- CIPT1 that has LDAP information in it but it is not related to Security at all.

On to the next topic:

Implement Control Plane and Management Plane Security

Implement routing plane security features (protocol authentication, route filtering)

Configure Control Plane Policing

Configure CP protection and management protection

Configure broadcast control and switchport security

Configure additional CPU protection mechanisms (options drop, logging interval)

Disable unnecessary services

Control device access (Telnet, HTTP, SSH, Privilege levels)

Configure SNMP, Syslog, AAA, NTP

Configure service authentication (FTP, Telnet, HTTP, other)

Configure RADIUS and TACACS+ security protocols

Configure device management and security

This is a mish-mash of topics. You’re going to find a ton of them in SND. I can’t recall is the Service Authentication is in SND though. Everything else is.

Second to last topic….

Configure Advanced Security

Configure mitigation techniques to respond to network attacks

Configure packet marking techniques

Implement security RFCs (RFC1918/3330, RFC2827/3704)

Configure Black Hole and Sink Hole solutions

Configure RTBH filtering (Remote Triggered Black Hole)

Configure Traffic Filtering using Access-Lists

Configure IOS NAT

Configure TCP Intercept

Configure uRPF

Configure CAR

Configure NBAR

Configure NetFlow

Configure Anti-Spoofing solutions

Configure Policing

Capture and utilize packet captures

Configure Transit Traffic Control and Congestion Management

Configure Cisco Catalyst advanced security features

Much of this is covered in SND. I dont think that RTBH filtering (Remote Triggered Black Hole) is in any of the Cisco courses but I may be wrong. NBAR and CAR are in the QOS class as well as Policing on the routers. SNAF covers policing on the ASA. Antispoofing is covered in SND and Netflow is kinda covered in the MARS class but I wouldnt take the MARS class for Netflow alone. It’s very light on the Netflow but it does cover it. BCMSN has a pretty good security section for the switches so if you combine the information in there with the information in the SND course you should have it covered. BCMSN in part of the CCNP program.

And finally….

Identify and Mitigate Network Attacks

Identify and protect against fragmentation attacks

Identify and protect against malicious IP option usage

Identify and protect against network reconnaissance attacks

Identify and protect against IP spoofing attacks

Identify and protect against MAC spoofing attacks

Identify and protect against ARP spoofing attacks

Identify and protect against Denial of Service (DoS) attacks

Identify and protect against Distributed Denial of Service (DDoS) attacks

Identify and protect against Man-in-the-Middle (MiM) attacks

Identify and protect against port redirection attacks

Identify and protect against DHCP attacks

Identify and protect against DNS attacks

Identify and protect against Smurf attacks

Identify and protect against SYN attacks

Identify and protect against MAC Flooding attacks

Identify and protect against VLAN hopping attacks

Identify and protect against various Layer2 and Layer3 attacks

This information is going to primarily be covered in SND. You will find some of it spread through the other classes I mentioned.

Wow thats a ton of information right? Yeah. I know. But let me just be clear on one thing. While the courses I mentioned are a great source of information on these CCIE Security topics they are not designed to teach you what you need to know to be a CCIE. They should however give you a solid foundation to build upon with a great deal of study of the Cisco Documentaion as well as Lab time.

Can you knock out half of the CCNP in a week? Your probably thinking..yeah right! Actually, I have met a few...
CCIE Security Adds Core Knowledge Questions For a short while now those working on routing and...
VLAN 1 on a Cisco Switch In the many years I have been teaching Cisco courses...

Related posts brought to you by Yet Another Related Posts Plugin.