There is obviously more to it than what you see here but for the CCNA this should be pretty good.

You can download it from the link below if you prefer a PDF.

Routing_Protocol_Comparison

Name

There is obviously more to it than what you see here but for the CCNA this should be pretty good.

Stay tuned for more!

Bob put the configuration he planned to use into his favorite configuration editor (notepad), and realized that when he eventually pastes this into the routers, he may have to intervene at times to supply manual input for certificate related tasks, and he was ok with that.  Bob also remembered that it is best to allow time to synchronize with peers when using digital certificates.All the switchports used by R1-4 Fa0/0 were set up correctly as access-ports, and in the same VLAN.  Bob verified that  no L1 or L2 problems were standing between him and success.In contrast to his anticipation of building the “perfect” new solution for his company, Bob had a sneaking suspicion that something in his proposed configuration wasn’t quite right, or maybe was missing something.  Below is the proposed configuration:

R1 Key, NTP and CA Server

enable
conf t
hostname R1
ip domain-name INE.com
no ip domain-lookup
line con 0
no exec-time
logging sync
privi level 15
exit
int fa 0/0
no shut
ip address 10.0.0.1 255.255.255.0
int loop 0
ip address 1.1.1.1 255.255.255.0
exit
ntp master 2
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
clock timezone PST -8
clock summer-time PDT recurring
crypto key generate rsa general-keys  modulus 1024
ip http server
crypto pki server R1-CA_Server
database url nvram:
database level minimum
grant auto
no shutdown
exit
crypto isakmp policy 1
auth rsa-sig
exit
crypto ipsec transform-set TSET esp-aes esp-sha
mode transport
exit
crypto ipsec profile GDOI-PROF
set transform-set TSET
exit
crypto gdoi group group1
identity number 1
server local
address ipv4 10.0.0.1
rekey authentication mypubkey rsa R1.INE.com
rekey transport unicast
sa ipsec 1
profile GDOI-PROF
match address ipv4 100
exit
exit
access-list 100 permit gre 10.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255

R2 DMVPN HUB

enable
conf t
hostname R2
ip domain-name INE.com
no ip domain-lookup
line con 0
no exec-time
logging sync
privi level 15
exit
int fa 0/0
no shut
ip address 10.0.0.2 255.255.255.0
int loop 0
ip address 2.2.2.2 255.255.255.0
exit
clock timezone PST -8
clock summer-time PDT recurring
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
ntp server 10.0.0.1 key 1
ip domain-name INE.com
crypto key generate rsa general-keys modulus 1024
crypto isakmp policy 1
auth rsa-sig
exit
interface Tunnel0
bandwidth 1000
delay 1000
ip address 172.168.0.2 255.255.255.0
no ip redirects
ip mtu 1400
no ip next-hop-self eigrp 1
ip nhrp authentication DMVPN_NW
ip nhrp map multicast dynamic
ip nhrp network-id 2210
ip nhrp holdtime 360
ip tcp adjust-mss 1360
no ip split-horizon eigrp 1
tunnel source Fa0/0
tunnel mode gre multipoint
tunnel key 6738
exit
router eigrp 1
network 172.16.0.0 0.0.255.255
network 2.2.2.2 0.0.0.0
no auto-summary
exit
crypto pki trustpoint R1-CA
enrollment url http://10.0.0.1:80
revocation-check none
exit
cry pki authenticate R1-CA
crypto pki enroll R1-CA
crypto gdoi group group1
identity number 1
server address ipv4 10.0.0.1
exit
crypto map map-group1 10 gdoi
set group group1
interface FastEthernet0/0
crypto map map-group1
end

R3 DMVPN Spoke

enable
conf t
hostname R3
ip domain-name INE.com
no ip domain-lookup
line con 0
no exec-time
logging sync
privi level 15
exit
int fa 0/0
no shut
ip address 10.0.0.3 255.255.255.0
int loop 0
ip address 3.3.3.3 255.255.255.0
exit
clock timezone PST -8
clock summer-time PDT recurring
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
ntp server 10.0.0.1 key 1
ip domain-name INE.com
crypto key generate rsa general-keys modulus 1024
crypto isakmp policy 1
auth rsa-sig
exit
interface Tunnel0
bandwidth 1000
delay 1000
ip address 172.16.0.3 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication DMVPN_NW
ip nhrp map multicast 10.0.0.2
ip nhrp map 10.0.0.2 172.16.0.2
ip nhrp network-id 2210
ip nhrp holdtime 360
ip nhrp nhs 172.16.0.2
ip tcp adjust-mss 1360
tunnel source FA0/0
tunnel mode gre multipoint
tunnel key 6783
exit
router eigrp 1
network 172.16.0.0 0.0.255.255
network 3.3.3.3 0.0.0.0
no auto-summary
exit
crypto pki trustpoint R1-CA
enrollment url http://10.0.0.1:80
revocation-check none
exit
cry pki authenticate R1-CA
crypto pki enroll R1-CA
crypto gdoi group group1
identity number 1
server address ipv4 10.0.0.1
exit
crypto map map-group1 10 gdoi
set group group1
interface FastEthernet0/0
crypto map map-group1
end

R4 Spoke

enable
conf t
hostname R4
ip domain-name INE.com
no ip domain-lookup
line con 0
no exec-time
logging sync
privi level 15
exit
int fa 0/0
no shut
ip address 10.0.0.4 255.255.255.0
int loop 0
ip address 4.4.4.4 255.255.255.0
exit
clock timezone PST -8
clock summer-time PDT recurring
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
ntp server 10.0.0.1 key 1
ip domain-name INE.com
crypto key generate rsa general-keys modulus 1024
crypto isakmp policy 1
auth rsa-sig
exit
interface Tunnel0
bandwidth 1000
delay 1000
ip address 172.16.0.4 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication DMVPN_NW
ip nhrp map multicast 10.0.0.2
ip nhrp map 10.0.0.2 172.16.0.2
ip nhrp network-id 2210
ip nhrp holdtime 360
ip nhrp nhs 172.16.0.2
ip tcp adjust-mss 1360
tunnel source FA0/0
tunnel mode gre multipoint
tunnel key 6783
exit
router eigrp 1
network 172.16.0.0 0.0.255.255
network 4.4.4.4 0.0.0.0
no auto-summary
exit
crypto pki trustpoint R1-CA
enrollment url http://10.0.0.1:80
revocation-check none
exit
cry pki authenticate R1-CA
crypto pki enroll R1-CA
crypto gdoi group group1
identity number 1
server address ipv4 10.0.0.1
exit
crypto map map-group1 10 gdoi
set group group1
interface FastEthernet0/0
crypto map map-group1
end

Your mission, should you choose to accept it, (feel free to hum the tune of mission impossible), is to find the errors regarding this configuration.

Hint: there are 4 specific configuration related issues based on the proposed configuration.

Will you assist Bob in creating a working DMVPN/GET VPN solution?

PS Bob passes on his appreciation for all the help he has received from you in the past! The solutions you provided worked like a charm, and Bob is being treated like a Network Rock Star by his manager. Keep up the great work!

After returning from vacation, Bob (the optimistic firewall technician) decided that he wanted to take some time and get a little bit more familiar with firewall configuration. He was able to get permission to use some spare equipment for practice.

He started with a basic configuration on the firewall:

 hostname INEASA1 password cisco enable password cisco  interface e0/1  nameif inside  no shut  ip address 172.16.16.10 255.255.255.0  security-level 90  interface e0/0  nameif outside  ip address 136.1.122.10 255.255.255.0  security-level 10  no shut 

Bob verified that he could ping both R1 and his PC from the Firewall. Now, he wants to configure the firewall to allow telnet from his PC. He remembers that there was some additional configuration that needed to be done on the firewall to allow this to work, but doesn’t remember exactly what is needed. Since his PC isn’t connected to the internet, he is not able to access the online documentation.

What additional configuration will allow Bob to telnet to the firewall from his PC?

There is more than one possible solution for this challenge. Feel free to post your proposed answer in the comments section. We will try to keep comments hidden from public view, so that the fun isn’t spoiled for others.

____

OK, so let’s look at the problem here. The PC is on the outside of the firewall, and according to multiple responses, you can’t telnet to the outside interface. (or can you?)

A few helpful hints when studying for the CCIE lab.

1. Don’t be afraid to go to the documentation, even for topics you think you know.
2 Re-read the question, to see just what you are asked to do and what your restrictions are.

So, where does the confusion about being able to telnet to the firewall come from? Perhaps it comes from trying in earlier versions, perhaps some confusion about what the documentation says, or perhaps someone read somewhere in the past that it just wouldn’t work.

Let’s start by carefully re-reading the documentation. ASA – Config guide – system administration – managing system access – allowing telnet

This section states:

“…The security appliance allows Telnet connections to the security appliance for management purposes. You cannot use Telnet to the lowest security interface unless you use Telnet inside an IPSec tunnel. …”

So, it doesn’t explicitly mention the outside, it mentions the “lowest security interface”. In most cases that is the outside, but not always.

A few “solutions”

1. Configure the switch so that Bob’s PC is on VLAN 121 instead of VLAN 122, configure the firewall to allow telnet on the inside interface. (Technically would meet requirements, but not much of a challenge.)

2. Change the security levels for the interfaces, making them the same or making the outside higher.

3. Add another interface with a lower security level

int eth0/1.1
vlan 123
nameif DMZ
sec 9

4. Configure a VPN for the firewall, so that the telnet traffic to the lower security (outside) interface is encrypted and therefore allowed.

5. Configure the firewall to allow transit traffic through to R1. Telnet to R1, and then Telnet to the ASA from R1, after configuring the ASA to allow telnet on the inside interface.

CCIE Routing & Switching Techtorial

Yeah, ok, so I’m a day late.. Deal with it!

I’m sitting here in the wonderful world of Cisco Live (aka Networkers) 2009 in San Francisco! Today is the first day of Techtorial and Labtorial sessions. I’ve been spending my time harassing various speakers and Cisco folks along the way, but generally having fun!

Today is the CCIE Routing & Switching Techtorial. l dropped in to see what all was new and exciting with the upcoming changes in the blueprint! We started off talking about the basic stuff that we all already know. The exam (both lab and written) is changing on October 18, 2009! The written exam for v4 will be in beta in August. So those who are looking for an inexpensive recert, watch for this! ($50!)

We also spent some time with the ideas about how CCIE exams are developed. At least the revised process therein. As I had spelled out in an editorial I did for Cisco Learning Network a while back (https://cisco.hosted.jivesoftware.com/docs/DOC-4888), the CCIE team is spending more time by analyzing job tasks and getting real-world input to figure out where the certification should be heading. It’s good to see this reiterated, but should also tell us that interesting changes may be forthcoming for ALL CCIE tracks, not just R&S!

Another good highlight was Maurilio Gorito (CCIE Program Manager for Routing & Switching) talking about test philosophy. “The routing and switching exam tests your ability to apply configuration knowledge, troubleshooting skills and skills to adapt to new situations. It is not a design test, nor is it always a test of ‘best practices’ for use in the field.”

We spent some time talking about the Core Knowledge questions as well, and it was resolved WITHOUT A DOUBT that these questions are currently worth 21 points and the rest of the lab is worth 79 points! Of course, there will be changes when it comes to the addition of Troubleshooting when the v4 blueprint becomes active, and no details were given about points then! (Still under construction?)

Going through the ethernet and frame-relay sections was tedious, but nothing has changed here. IGPs were relatively the same as well. There were a couple examples and interesting diagrams that were worthwhile, but this presentation was geared towards those getting started towards the CCIE, not those who already had it!

The vast majority of the day was dedicated to Ethernet, Frame-Relay, IGP routing protocols, IPv6 and BGP… At the end (when the caffeine was starting to wear off) were the newer topics like MPLS and MPLS-VPNs!

Most of the stuff was straightforward. Some new acronyms were thrown out, mostly to scare people! According to the blueprint, candidates are to be responsible for basic MPLS architecture, LDP interactions, VPNv4 address families as well as IPv4 unicast vrf address families.

In addition, it was clarified that candidates will be responsible for both Layer2 and Layer3 VPNs inside MPLS. But, before the panic ensues, there will be basic pseudowire connectivity (AToM or L2TPv3 are fair game) of ethernet to ethernet links. So we do not need to worry about L2 interworking. We also don’t need to worry about VPLS or H-VPLS due to IOS functionality!

Then we jumped back to old topics for IP Multicast! There was no mention about IPv6 multicast even though it’s on the v4 blueprint. Go figure.

The interesting part came in when talking about troubleshooting… There was a total of 6 slides about it. Not incredibly insightful, but at least there was discussion about the thought-process for troubleshooting generically! That just means we’ll have to stay tuned a little while longer for how best to approach these things (see future blog articles!).

You will be given a series of diagrams (overall network, IPv4 routing, BGP routing, IPv6 routing, or whatever’s appropriate for your lab) to set the stage for troubleshooting. Then you will be given a series of “Incidents”. A simple example given had to do with one router not being able to ping another router’s IPv6 address.

With that you would have to look at your diagram and start looking at router configurations or other show commands in order to further define the actual, underlying problem and then start determining solutions. The success of the troubleshooting section would rely (in this incident) on the two routers being able to ping each other from the interfaces specified.

The same kinds of rules apply in this as to the rest of the lab. No static routes, no default routes, no policy-based routing…. Unless otherwise specified!

One very interesting thing that was noted (good thing I waited because Monday’s session got this!) is that you “may” need to be aware of frame-relay switch configuration within the v4 blueprint. The pre-configured/backbone frame-relay switch will no longer be part of the standard rack configuration.

This turned out to be a session that wasn’t geared as a bridge to v4. It wasn’t geared to those well on their way of studying. It was set as an introduction and a little bit of tossed information about the thought-process for different tasks and what they ask versus what they expect.

All in all, things should be “interesting” with the v4 blueprint. The breadth of knowledge can be staggering, but on the other hand, we get to train everyone to be consultants!

57 people attended.

Now, this is posted about 1:15am, so I’m sure you can guess what all else has been going on. I was in the CCDE Techtorial today, so perhaps I’ll write that one up in the morning when my head clears!

Required Exam: 640-816 ICND2 (Interconnecting Cisco Networking Devices Part 2)

I. Module 1: VLANs

A. Advanced Switching Technologies

B. VLANs

C. VLAN Configuration

D. VLAN Trunking

E. VTP

F. RSTP

G. Advanced Switching Verifications

H. Basic Layer 2 Security

II. Module 2: IP Addressing/Services for Medium-Sized Network

A. VLSM

B. Summarization

C. IPv6 Requirements

D. IPv6 Addressing

E. IP Address Troubleshooting

III. Module 3: IP Routing

A. Routing Methods and Protocols

B. OSPF

C. EIGRP

D. Verification and Troubleshooting

E. Basic Router Security

IV. Module 4: NAT and ACLs

A. Access Control Lists

B. Verification and Troubleshooting of ACLs

C. Network Address Translation

D. Troubleshooting NAT

V. Module 5: Implementing WANs

A. Frame Relay

B. Troubleshooting

C. VPNs

D. PPP

Number of Questions: 77

Required Passing Score: 790

Time Allotted: 2 hours

Question Types: Single Response-Multiple Choice, Multiple Response-Multiple Choice, Drag and Drop, Scenario (Flash Based)

Overall Level of Difficulty: Easy

Exam Sections:

• Evaluate proposed changes to a network
• Implement Layer 2 technologies
• Implement Layer 3 Technologies
• Implement IP Multicast
• Implement Advanced Services
• Troubleshoot a Network
• Optimize the Network

Overview:

Compared to the previous versions of this exam, Cisco has solved one of the major issues with it – time. The previous version featured 105 questions that were to be solved in 2 hours. This was absurdly difficult. Knowing the material as well as I do, I had about 4 minutes to spare in one of my visits to the old exam.

Notice the new exam allows students to breathe a bit as they are sitting the exam. I did not find time to be nearly as much of a pressure with this exam. I completed all questions in 1 hour and 10 minutes. I believe that most students will have no problems finishing the exam in 1 hour and a half.

In addition to the shorter length, I found there were many more questions of CCNA-level and CCNP-level in this exam compared to past exams. Now of course, there are still a fair share of really tough CCIE-level questions, so you actually feel a bit off-balance taking the exam. When you click next, you just never know what you are going to get.

Also, as advertised, there is no longer a BACK button. Be real sure of your answer before you click NEXT. Twice I realized I answered something wrong once it was too late. Remember, time should not be an issue now, so avoid the typical response of rushing. Incidentally, one reason Cisco is not allowing the BACK button any longer is that it would make the exam MUCH easier. Several times I learned of a correct response from a later question but I was prohibited from going back and changing my initial reponse.

What I Loved:

• Shorter exam
• Troubleshooting questions

What I Disliked:

• Exhibits that were completely illegible
• Only one new Scenario style question in my exam
• Over-emphasis in certain areas, with no coverage, or limited coverage, of other areas

Topic Domains Most Emphasized (In My Question Pool):

• OSPF and EIGRP for IPv6
• IP SLA
• Layer 2 Troubleshooting
• Layer 3 Troubleshooting
• QoS
• PIM Sparse Mode
• MPLS
• Services

As you know, updates have begun to our top-rated CCIE Written R&S Bootcamp product. I am creating the new lessons in an order that reflects exam emphasis. I am also adding a second Practice Exam to the course. It will be available (In Progress) tomorrow, so you do not need to wait to try your skills on new questions immediately.

RETIRED TRACKS:
Total of Design CCIEs: 3
Total of ISP Dial CCIEs: 73
Total of SNA IP CCIEs: 16
Total of WAN Switching CCIEs: 36

Total with 1 certification: 6713
Total with multiple certifications: 782 (34.83 % of Cisco’s official statistic)
Total with 2 certifications: 599
Total with 3 certifications: 138
Total with 4 certifications: 31
Total with 5 certifications: 12
Total with 6 certifications: 2

Total Dutch CCIEs on the list: 152 (73.43 % of Cisco’s official statistic)

Total Inactive CCIEs: 425 (5.67 % of verifiable CCIEs listed on this website)
Total Suspended CCIEs: 233 (3.11 % of verifiable CCIEs listed on this website)

Not verifiable: 723

Being Dutch, it makes sense to list the Dutch CCIEs here.
According to the latest Cisco statistics (26-Jun-09) there are 207 Dutch CCIEs

Total on the list = 152 (includes active, inactive, and suspended).
All statistics are based upon actual verification with the Cisco CCIE/CCDE Verification Tool.

CCIE #1183 – MICHAEL STOLWIJK (1,Routing and Switching)
CCIE #1184 – RENE VAN DER HAUW (1,Routing and Switching)
CCIE #1271 – WILLEM BALK (1,Routing and Switching)
CCIE #1324 – ANTON VAN DER LEUN (1,Routing and Switching)
CCIE #1725 – MARCEL VAN RIJSWIJK (1,Routing and Switching)
CCIE #1759 – ROB WOLTERS (1,Routing and Switching)
CCIE #1959 – LEO HENKES (1,Routing and Switching)
CCIE #1961 – WOUTER TILLEMANS (1,Routing and Switching)
CCIE #2641 – MICHEL AARSSEN (1,Routing and Switching)
CCIE #2918 – PIETER VAN ZYL (1,Routing and Switching)
CCIE #2920 – JAN VAN VEEN (1,Routing and Switching)
CCIE #2926 – ROB BLEEKER (1,Routing and Switching)
CCIE #3233 – EDWIN TROMP (1,Routing and Switching)
CCIE #3270 – MARCO DE HEUVEL (1,Routing and Switching)
CCIE #3293 – RICHARD JONKER (1,Routing and Switching)
CCIE #3500 – RUUD LOUWERSHEIMER (1,Routing and Switching)
CCIE #3596 – EDO PAPPOT (1,Routing and Switching)
CCIE #3635 – PETER HARTMAN (1,Routing and Switching)
CCIE #3667 – JAN MARTIJN METSELAAR (1,Routing and Switching)
CCIE #3813 – RONALD STUY (1,Routing and Switching)
CCIE #4186 – ERIC VAN DEN BERG (1,Routing and Switching)
CCIE #4491 – HENK SMIT (1,Routing and Switching)
CCIE #4537 – HUBERTUS WILHELMUS PETERS (2,Routing and Switching, Voice)
CCIE #4550 – FRANS BRINKMAN (1,Routing and Switching)
CCIE #5177 – PETER VAN OENE (1,Routing and Switching)
CCIE #5284 – ROBERT TEEUW (1,Routing and Switching)
CCIE #5320 – MARK SIBERING (1,Routing and Switching)
CCIE #5468 – EDUARD METZ (1,Routing and Switching)
CCIE #5614 – ANDRE ENGERINGH (1,Routing and Switching)
CCIE #5677 – DENNIS DUBBELMAN (1,Routing and Switching)
CCIE #5703 – MICHEL BIJNSDORP (1,Routing and Switching)
CCIE #5704 – PIET WILLEMSEN (1,Routing and Switching)
CCIE #5730 – JASPER VAN ‘T WOUT (not verifiable)
CCIE #6020 – JOS VULTO (1,Routing and Switching)
CCIE #7162 – WALTER VAN DE GARDE (1,Routing and Switching)
CCIE #7229 – DIEDERIK VAN DIGGELEN (1,ISP Dial)
CCIE #7403 – BOUDEWIJN VISSER (3,ISP Dial, Routing and Switching, Service Provider)
CCIE #7456 – AD VISSER (1,Routing and Switching)
CCIE #7471 – HENK BLACQUIERE (1,ISP Dial)
CCIE #7503 – OLIVER HOGENKAMP (1,Routing and Switching)
CCIE #7688 – GEERT HAMPE (1,Routing and Switching)
CCIE #8023 – OSCAR KOOT (1,Routing and Switching)
CCIE #8143 – GERARD VAN WEE (1,Routing and Switching)
CCIE #8272 – WILLY SCHOOTS (2,Routing and Switching, Service Provider)
CCIE #8372 – FRED SPIKKER (1,Routing and Switching)
CCIE #8440 – SIJBREN BEUKENKAMP (1,Routing and Switching)
CCIE #8605 – WIL HESEN (1,Routing and Switching)
CCIE #8643 – GERARD VAN BON (1,Routing and Switching)
CCIE #8700 – HARM KANTERS (1,Routing and Switching)
CCIE #8717 – DENNIS WELTEN (1,Routing and Switching)
CCIE #8811 – HUUB JANSEN (1,Routing and Switching)
CCIE #8886 – JOHN ZWAANSWIJK (1,Routing and Switching)
CCIE #8917 – JAN WILLEM VAROSSIEAU (2,Routing and Switching, Security)
CCIE #8922 – GERRIT VAN DER CRUIJSEN (1,Routing and Switching)
CCIE #8923 – HENK VAN ROOIJ (1,Routing and Switching)
CCIE #8938 – DANNY VAN DEN EIJNDE (2,Routing and Switching, Service Provider)
CCIE #8980 – EDDY OSTERHOLT (1,Routing and Switching)
CCIE #9027 – MARCEL KOKS (1,Routing and Switching)
CCIE #9652 – TAMES VAN DER DOES (1,Security)
CCIE #10368 – GERT GARDENIER (1,Routing and Switching)
CCIE #10369 – BAS DE GRAAF (1,Routing and Switching)
CCIE #10514 – FRED KOK (1,Routing and Switching)
CCIE #10605 – CHRISTO VAN JAARSVELD (1,Routing and Switching)
CCIE #10815 – BENJAMIN LAMMERS (1,Routing and Switching)
CCIE #10918 – JEROEN DE GRAAFF (1,Routing and Switching)
CCIE #10964 – RICK POSTMA (1,Routing and Switching)
CCIE #11028 – PAUL VAN DER ZEL (1,Routing and Switching)
CCIE #11031 – TOM LIJNSE (1,Routing and Switching)
CCIE #11033 – PIETER JAN BAKHUIJZEN (2,Routing and Switching, Security)
CCIE #11340 – PATRICK VAN SANDWIJK (1,Routing and Switching)
CCIE #11416 – EVGENY TANTSURA (1,Routing and Switching)
CCIE #12161 – GOKHAN SURUCU (1,Routing and Switching)
CCIE #12562 – RONALD VAN DOMMELEN (1,Routing and Switching)
CCIE #12587 – JEROEN VAN DONZEL (1,Routing and Switching)
CCIE #12793 – RUUD GEELEN (1,Security)
CCIE #13084 – IWAN HOOGENDOORN (3,Routing and Switching, Security, Service Provider)
CCIE #13097 – JASPER VAN NEDERPELT (1,Routing and Switching)
CCIE #13236 – DAVE SCHIPPER (1,Routing and Switching)
CCIE #13339 – ERIK BRAAT (1,Routing and Switching)
CCIE #13656 – FRANCIS JUNGSCHLAGER (1,Routing and Switching)
CCIE #13711 – WILLIAM BEERNINK (1,Security)
CCIE #13832 – MARC VAN HOOF (1,Routing and Switching)
CCIE #14017 – MICHAEL VAN DER ZWAN (1,Routing and Switching)
CCIE #14031 – JOS GRUIJTERS (1,Routing and Switching)
CCIE #14134 – PETER PRONK (1,Routing and Switching)
CCIE #14159 – JOEP REMKES (1,Routing and Switching)
CCIE #14186 – PAUL REKELHOF (3,Routing and Switching, Security, Service Provider)
CCIE #14286 – ROBERT JAN KUIK (1,Routing and Switching)
CCIE #14323 – BERT DE KRIJGER (1,Routing and Switching)
CCIE #14652 – JEROEN VAN VEEN (1,Routing and Switching)
CCIE #15032 – JORG BUESINK (3,Routing and Switching, Service Provider, Security)
CCIE #15497 – ROEL CUPPEN (1,Routing and Switching)
CCIE #15845 – NASIR SHAIKH (1,Routing and Switching)
CCIE #15872 – HIELKE HAGENDOORN (1,Routing and Switching)
CCIE #15998 – HENK DE TOMBE (1,Routing and Switching)
CCIE #16363 – SIEBE BOTH (1,Security)
CCIE #16437 – KOEN ZEILSTRA (2,Routing and Switching, Service Provider)
CCIE #16742 – PAUL SCHUURING (1,Routing and Switching)
CCIE #16797 – PETER PLAK (1,Routing and Switching)
CCIE #17133 – FRANK WETZELS (1,Security)
CCIE #17182 – JAN HONDEBRINK (1,Routing and Switching)
CCIE #17274 – MOHAMED MAJDOUBI (1,Routing and Switching)
CCIE #17384 – VALENTIJN VAN VEEN (1,Routing and Switching)
CCIE #17637 – MICHAEL AMSTELVEEN (1,Routing and Switching)
CCIE #17684 – MAUREEN SCHAAR (1,Routing and Switching)
CCIE #17796 – JOOST HAGE (1,Security)
CCIE #17842 – ERIK LENTEN (1,Security)
CCIE #18235 – ERIK ORIE (1,Routing and Switching)
CCIE #18256 – MICHEL PLOEG (1,Routing and Switching)
CCIE #18281 – J. VAN WIJNGAARDEN (1,Routing and Switching)
CCIE #18351 – JARI BONTE (1,Routing and Switching)
CCIE #18402 – ROB RENET (1,Routing and Switching)
CCIE #18613 – WIM VAN DER MEEREN (1,Routing and Switching)
CCIE #18641 – MARTIJN VUIK (2,Routing and Switching, Service Provider)
CCIE #18704 – PATRICK NIJSTERS (1,Service Provider)
CCIE #18837 – COEN SCHILPEROORD (1,Routing and Switching)
CCIE #19205 – PETER BUIJSSE (1,Voice)
CCIE #19544 – HAROLD GRAUWDE (1,Routing and Switching)
CCIE #19603 – MICHEL LAUTENSLAGER (1,Routing and Switching)
CCIE #19612 – K.J.B. BLOM (1,Routing and Switching)
CCIE #19845 – MARCO VAN DER VLUGT (1,Routing and Switching)
CCIE #19847 – MAARTEN KRUYSWIJK (1,Security)
CCIE #19958 – JOOST VAN DER MADE (1,Voice)
CCIE #19996 – XANDER BRAND (1,Routing and Switching)
CCIE #20093 – BART DE JAGER (1,Voice)
CCIE #20441 – SILVESTER VERDONKSCHOT (1,Routing and Switching)
CCIE #20700 – ROBERT STEENEKEN (1,Routing and Switching)
CCIE #21047 – CHRIS VAN DEN BRINK (1,Routing and Switching)
CCIE #21058 – JOHN-PAUL STRAVER (1,Routing and Switching)
CCIE #21206 – SERDAR ERSOY (1,Routing and Switching)
CCIE #21235 – EELCO NIEUWSTAD (1,Routing and Switching)
CCIE #21472 – JAN VOGELAAR (1,Routing and Switching)
CCIE #21574 – MARCEL SCHAAPER (1,Routing and Switching)
CCIE #21589 – DENNIS WULFF (1,Routing and Switching)
CCIE #21946 – RICK MUR (2,Routing and Switching, Service Provider)
CCIE #21954 – EDO DE LEEUW (1,Routing and Switching)
CCIE #22324 – MAARTEN SNEEKES (1,Security)
CCIE #22886 – DIRK SMIT (1,Routing and Switching)
CCIE #23078 – JOLIE-COEUR WOUTER (1,Security)
CCIE #23135 – PASCAL VAN ELST (1,Security)
CCIE #23290 – PETER BEUKENKAMP (2,Routing and Switching, Service Provider)
CCIE #23324 – HANS VERKERK (1,Routing and Switching)
CCIE #23876 – BART RAAT (1,Routing and Switching)
CCIE #23879 – JEROEN SCHALKWIJK (1,Routing and Switching)
CCIE #23942 – DENNIS KUIS (1,Security)
CCIE #24128 – MELVIN MUNGRA (1,Routing and Switching)
CCIE #24404 – RADBOUD  VELD (1,Routing and Switching)
CCIE #24748 – SIEBRAND BROUWER (1,Routing and Switching)
CCIE #24776 – JAN BOUMAN (1,Routing and Switching)
CCIE #25394 – MICHAEL LUCAS (1,Service Provider)
CCIE #25628 – WOUTER PRINS (1,Routing and Switching)

20070001 – RUSS WHITE
20070002 – JOHN CAVANAUGH
20070003 – BRUCE PINSKY
20070004 – KHALID RAZA
20070005 – WILLIAM PARKHURST
20070006 – ALVARO RETANA
20070007 – MOSADDAQ TURABI
20070008 – STEVE BARNES
20080001 – RYAN HICKS
20080002 – MICHAEL MORRIS
20080003 – REINHOLD FISCHER
20090001 – THOMAS WHALEY
20090002 – RADU HAMBASAN
20090003 – JEREMY FILLIBEN
20090004 – CLAUS HOLBECH

Total on the list  = 8218 (includes active, inactive, and suspended).
All statistics are based upon actual verification with the Cisco CCIE/CCDE Verification Tool.
Last Updated: 07-OCT-09

CCIE #1025 – STUART BIGGS (1,Routing and Switching)
CCIE #1026 – TERRANCE SLATTERY (1,Routing and Switching)
CCIE #1027 – JOSEPH OBERMEIER (1,Routing and Switching)
CCIE #1029 – STEVE CUNNINGHAM (1,Routing and Switching)
CCIE #1030 – IMRAN QURESHI (1,Routing and Switching)
CCIE #1031 – BAHMAN SOHRABI (1,Routing and Switching)
CCIE #1034 – PHILLIP REMAKER (2,Routing and Switching, ISP Dial)
CCIE #1035 – RANDY WORD (1,Routing and Switching)
CCIE #1036 – MARK ALLEN (1,Routing and Switching)
CCIE #1037 – GREGORY AKERS (1,Routing and Switching)
CCIE #1038 – ALAN CLAUGHAN (1,Routing and Switching)
CCIE #1040 – JOSEPH WENKER (1,Routing and Switching)
CCIE #1041 – THIERRY MARTENS (1,Routing and Switching)
CCIE #1043 – MICHAEL PARZYCH (1,Routing and Switching)
CCIE #1044 – JAMES LUKESH (1,Routing and Switching)
CCIE #1045 – BRUCE PINSKY (1,Routing and Switching)
CCIE #1048 – NGA VU (1,Routing and Switching) – INACTIVE
CCIE #1050 – ROBERT WRIGHT (1,Routing and Switching)
CCIE #1055 – GEORGES BIRO (1,Routing and Switching)
CCIE #1063 – ATIF KHAN (1,Routing and Switching)
CCIE #1065 – RICHARD MESSINGER  (1,Routing and Switching)
CCIE #1066 – JOHN CAVANAUGH (1,Routing and Switching)
CCIE #1067 – JOE NOVAK (1,Routing and Switching)
CCIE #1069 – KENT SCHWARTZ (1,Routing and Switching)
CCIE #1078 – CRAIG WASSON (1,Routing and Switching)
CCIE #1079 – KEVIN MACRITCHIE (1,Routing and Switching)

More…..

Required Passing Score: 790

Time Allotted: 2 hours

Question Types: Single Response-Multiple Choice, Multiple Response-Multiple Choice, Drag and Drop, Scenario (Flash Based)

Overall Level of Difficulty: Easy

Exam Sections:

• Evaluate proposed changes to a network
• Implement Layer 2 technologies
• Implement Layer 3 Technologies
• Implement IP Multicast
• Implement Advanced Services
• Troubleshoot a Network
• Optimize the Network

Overview:

Compared to the previous versions of this exam, Cisco has solved one of the major issues with it – time. The previous version featured 105 questions that were to be solved in 2 hours. This was absurdly difficult. Knowing the material as well as I do, I had about 4 minutes to spare in one of my visits to the old exam.

Notice the new exam allows students to breathe a bit as they are sitting the exam. I did not find time to be nearly as much of a pressure with this exam. I completed all questions in 1 hour and 10 minutes. I believe that most students will have no problems finishing the exam in 1 hour and a half.

In addition to the shorter length, I found there were many more questions of CCNA-level and CCNP-level in this exam compared to past exams. Now of course, there are still a fair share of really tough CCIE-level questions, so you actually feel a bit off-balance taking the exam. When you click next, you just never know what you are going to get.

Also, as advertised, there is no longer a BACK button. Be real sure of your answer before you click NEXT. Twice I realized I answered something wrong once it was too late. Remember, time should not be an issue now, so avoid the typical response of rushing. Incidentally, one reason Cisco is not allowing the BACK button any longer is that it would make the exam MUCH easier. Several times I learned of a correct response from a later question but I was prohibited from going back and changing my initial reponse.

What I Loved:

• Shorter exam
• Troubleshooting questions

What I Disliked:

• Exhibits that were completely illegible
• Only one new Scenario style question in my exam
• Over-emphasis in certain areas, with no coverage, or limited coverage, of other areas

Topic Domains Most Emphasized (In My Question Pool):

• OSPF and EIGRP for IPv6
• IP SLA
• Layer 2 Troubleshooting
• Layer 3 Troubleshooting
• QoS
• PIM Sparse Mode
• MPLS
• Services

As you know, updates have begun to our top-rated CCIE Written R&S Bootcamp product. I am creating the new lessons in an order that reflects exam emphasis. I am also adding a second Practice Exam to the course. It will be available (In Progress) tomorrow, so you do not need to wait to try your skills on new questions immediately.

CCNA Study Labs:

Basic Two Router Lab
Three Router Static Route Lab
Cisco 2950 Switch VLan & Trunking Lab
Three Router Frame-Relay Lab
Four Router IS-IS Lab
Cisco:CIDR（Classless Inter-Domain Routing）
Configuring a Cisco Cable/DSL Modem Router

Cisco Router & Switch Commands and Procedures:

Connecting your PC to your Cisco Switch or Router
Cisco Router IOS Upgrade Procedure Simplified!
Cisco Router with Multiple Partitions
Cisco Router Commands
Summary of Cisco Router Interfaces
Cisco Switch Commands
Summary of Cisco Switch Features
Terminal Server Setup
Linksys Routers and CCNA Home Lab Setup

CCNA Test Topics:

CCNA Certification Overview
Preparing for the CCNA exam
Cisco CCNA Certification Knowledge to Pass the Exam
Taking the CCNA Exam
Two Part CCNA Exam Option

TCP/IP Topics

Cisco TCP/IP Overview
Cisco 3 Layer Model
The 7 Layer OSI Model
TCP/IP Address Overview
Implementing Subnet Planning
Configuring IP Addresses
TCP Overview
UDP Overview
HDLC Overview
ARP, IARP, RARP & Proxy ARP
Bridging
Subnet Classes and number of Hosts
Managing your Network Devices
Ethernet Technologies

Introduction to Cisco Routers and Switches

Introduction to Cisco Routers
Cisco Router Memory
Cisco Router Basics
Boot Sequence for Routers
Cisco Router Modes
Entering a Cisco Router’s User Mode
Entering a Cisco Router’s Privilieged Mode
Configuring the Router
Cisco Router & Switch passwords
Capturing Text Output from Hyperterminal

Routing Protocols and More!

Routed Protocols vs Routing Protocols
RIP Overview
Enabling RIP
OSPF Overview
Overview of IGRP
Why RIP v1 and IGRP do not support VLSM
Why RIP v1 and IGRP don’t support discontiguous networks
EIGRP Overview
Dynamic Routing Overview
Distance Vector Routing
Configuring Network Routing

Cisco Switch Concepts

Switch Startup
Catalyst Switch Operations
Spanning Tree Protocol
All about STP
Configuring VLans
VLAN Operation Overview
Configuring a VLAN
Cisco VLAN Trunking Protocol
EtherChannel Overview

Access Lists

Access Lists and their Application
Access List Configuration
All About Access Control Lists(ACL)

WAN Protocols and More!

WAN Concepts and Terminology
X.25 Overview
HDLC Overview
PPP Overview
Frame Relay Overview
Configuring Frame Relay
Introduction to NAT
All about Access Control Lists(ACLs)

Cisco Cabling

LAN & WAN Cabling for Cisco Devices
Console and AUX Cabling Guide

Cisco CCNA Cliff Notes

Cisco CCNA Ethernet Cliff Notes
Cisco CCNA Routing Cliff Notes
Cisco CCNA Switching Cliff Notes
Cisco CCNA VLANs Cliff Notes
Cisco CCNA Access Lists Cliff Notes
Cisco CCNA WAN Cliff Notes
Cisco CCNA Wireless Cliff Notes

Module 1 Lesson 1 Advanced Switching Technology

Module 1 Lesson 2 VLANs

Module 1 Lesson 3 VLAN Configuration

Module 1 Lesson 4 VLAN Trunking

Module 1 Lesson 5 VTP

Module 1 Lesson 6 RSTP

I have listened to your feedback as I create these new lessons. As such, they include:

• Much more detail for each new topic.
• More Core Knowledge questions based on each topic (these Core Knowledge questions are unique – they appear in no other INE products).
• More simulated exam questions.

I have started the updates with a new QoS topic for the exam – Auto QoS. Enjoy. You will find the new lesson is automatically added to your Member’s area for the course. Just scroll down to the new section called Version 4.X Updates.

Here are the links for all the posts in the series:

IPv6 Transition Mechanisms Part 1: Manual Tunnels

IPv6 Transition Mechanisms Part 2: GRE/IPv4 Tunnels

IPv6 Transition Mechanisms Part 3: 6to4 Tunnels

IPv6 Transition Mechanisms Part 4: ISATAP Tunnels

IPv6 Transition Mechanisms Part 5: NAT-PT

Remember, when you are ready to test your Tier 2 and Tier 3 knowledge of these important topics, be sure to check out our many CCIE R&S products. If you have any questions about which product would be perfect for you, contact one of our Customer Success Managers.

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) is most recently specified in RFC 5214. Notice the topology below that we will use to detail the workings of this transition approach. This internal network has RouterB in place that is not IPv6 capable . ISATAP provides a solution for the hosts behind this device! Dynamic tunneling will be done from these hosts to the ISATAP router (RouterA). Obviously, your job in the CCIE R&S Lab Exam might be to configure or troubleshoot this important device.

Here is how ISATAP actually works. The networks DNS server is updated with a well-known name entry of “ISATAP” that resolves to the IPv4 address used in the tunnel on the ISATAP router (RouterA). HostA initializes and notes that it has been configured with ISATAP capabilities for IPv6. HostA then sends a request to the DNS server for the address associated with “ISATAP”. DNS responds with the IPv4 address of the ISATAP router. HostA tunnels a router discovery packet (using an IPv6-in-IPv4 encapsulation approach) and sends this packet to the ISATAP router. RouterA responds with a router advertisement that includes the IPv6 prefix the host (HostA) should use. HostA takes this prefix and automatically constructs its own unique IPv6 address. It uses a reserved identifier for ISATAP (0:5efe) and its own IPv4 address to do this. Now the host is fully able to communicate beyond its local network using IPv6 and ISATAP.

One of the exciting things about the ISATAP soltuion is the fact that HostA will automatically transition to native IPv6 communications once the network is upgraded (in our case, once RouterB is replaced or upgraded). The minute HostA begins receiving unsolicited, native router advertisements, it ignores its ISATAP capabilities.

The configuration of the ISATAP router is very simple. Here is an example:

RouterA:
configure terminal
!
interface Tunnel 0
ip address 2001:80f0:4:300::/64 eui-64
no ipv6 nd suppress-ra
tunnel source 172.16.1.20
tunnel mode ipv6ip isatap

The prefix assigned to the tunnel interface is the prefix that will be assigned to hosts. Notice the no ipv6 nd suppress-ra command is required to ensure that router advertisements are sent over the tunnel to hosts. By default, these messages are not used on tunnel interfaces.

After setting the tunnel mode, your tunnel interface should launch. To verify that your tunnel has been assigned the appropriate ISATAP IPv6 address space, you can use show ipv6 interface brief as follows:

RouterA#show ipv6 interface brief
FastEthernet0/0            [up/up]
FastEthernet0/1            [administratively down/down]
Tunnel0                    [up/up]
 FE80::5EFE:AC10:114
 2001:80F0:4:300:0:5EFE:AC10:114

Awesome! We will investigate another transition option in the next part of this series. Thanks for tuning in! If you want more training targeted at this subject, check out any workbook practice, while Tier 3 would be Poly-labs or Graded Mock Labs.

22.In which modes does selective packet discard(SPD)operate?(choose3)
A:normal
B:discard
C:random
D:full
Correct Answers: A, C, D

23.As described in rfc 3270,short-pipe mode operstion, what are the PE to CE egress polices based on?
A: Qos groups/discard class
B: customer marking
C: remarked IP tos value
D: MDRR quantam
Correct Answers: B

24.Which LSA type includes routes redistributed into an OSPF ASBR?
A: LSA type 3
B: LSA type 4
C: LSA type 5
D: LSA type 6
Correct Answers: C

25.In a frame ,what is the MPLS label imposed?
A: Within the Layer 3 header
B: After the Layer2 header and before Layer3 header
C: Before the layer 2 header
D: After the Layer3 header and before Layer2 header
Correct Answers: B

26.which two statements best describe urpf loose mode?
A:It is typically used on multipoint interfaces or on routers where asymmetrical routing is used(packets are received on one interface but the return path is not on the same interface);loose mode verifies a source address by looking in forwarding information base(FIB). Created by routing protocols, to verify there is a return route to the source and to venrify that the path uses a valid interface
B:If a packet fails the uRPF loose mode check, the packet is then transmitted and creates a log message
C:If a packet fails the uRPF loose mode check ,the packet is then dropped
D:None of above
Correct Answers: A, C

27.Which IOS feature is able to block IP spoofing attacks?
A: Cisco Express forwarding
B: MPLS traffic Engineering
C: IS-IS routing
D: Unicast Reverse Path Forwarding (uRPF)
Correct Answers: D

28.Which two of the following technologies could improve convergence time following a link failure in a service provider network?
A: MPLS TE FR
B: SNMP
C: BFD
D: VPLS
Correct Answers: A, C

29.For the following items, which is the BGP synchronization rule?
A: BGP neighbor peerings are established and sychronized using the TCP 3-way handshake.
B: Routing information received through an IBGP session is not forwarded to another IBGP neighbor, only to EBGP neighbors.
C: Routing information received through an EBGP session is not forwarded to another EBGP neighbor, only to IBGP neighbors.
D: BGP shall not advertise a route until that route has been learned via an IGP also.
Correct Answers: D

30.Which three AVPs (Attribute-Value Pair) must be present in the ICRQ?
A:Message Type
B:Called Number
C:Assigned Session ID
D:Call Serial Number
Correct Answers: A, C, D