Cisco Live

As was stated in a previous post, I had the opportunity to finally attend  Cisco Live held in San Diego, CA this year.  The conference certainly lived up to the hype and was well worth the trip and time invested.  I think I was about half way into day 1 and I already had new ideas/knowledge that I wanted to lab up and bring home.  The logistics of running an event with 17k people has to be daunting but the staff at Cisco and the San Diego Convention Center did an amazing job in scheduling, herding, feeding and entertaining a rather large group of us geeky network folk.  As expected, the most valuable part of the conference was the personal networking that happened amongst the attendees.  I was able to meet and converse with many of the colorful networking voices that I follow on twitter as well as many others not necessarily associated with that group.

CCNP

One of the registration perks of cisco live is that you receive one free certification exam while at the conference.  I scheduled my CCNP Switch exam for Thursday afternoon just before the closing keynote.  When I had scheduled the exam I still had a month before the conference to study and figured I would have time in the evenings to cram some final concepts before taking the exam.  I couldn’t have been more wrong on both accounts.  We were in the final weeks of a datacenter closure at work which took entirely all of my time before the conference and then yeah…the parties.  Every night was fully occupied and I found myself on my way to the conference Thursday morning not having opened a book for the exam.  In my defense, switching has been my predominate focus in networking over the past few years so I had a good base of information but I was confident that there wasn’t any way I was going to pass the test.  I took about an hour before the exam to bone up on some of the concepts that I was unfamiliar with and then it was time…  I must have done something good (or clean living as a friend likes to put it) because I walked out not only with a pass but with a very respectable score on the exam.  With that out of the way I went off to watch Jamie Hyneman and Adam Savage talk about all the cool stuff they do on Mythbusters.

Being completely overconfident, and ready for the next challenge, I scheduled my TSHOOT exam for the following week.  I figured that Tshoot would be a practical conglomeration of the previous two exams and was excited to see what the test looked like.  My thought process is that if I knew my stuff for Route and Switch that Tshoot should be a breeze.  I wasn’t completely wrong…  I thought Tshoot was the best of the three tests in the CCPN series as it gives real life scenarios in which you must use the knowledge you have to identify the device causing the issue, the technology involved in the issue and what command(s) are needed in order to rectify the problem.  It took a few minutes to get acclimated to the style of the exam (as it is not at all like the other Cisco exams) but once I was familiar with the process the whole exam just felt good.  I ended up acing this exam and successfully completing the CCNP process.

Work

As was briefly mentioned above, we have just completed a 6 month long project focused on closing out one of our primary US datacenters and migrating many of those services to other existing datacenters as well as building a new datacenter a little closer to home.  The project was technically challenging but was a success by every measurable metric.  It looks like more datacenter migrations might be in the future but for now I think all of us are enjoying not having the pressure of migrating business critical IT infrastructure and living in late night maintenance windows for weeks on end.  The next project on the horizon appears to be preparing for an expansion of our VDI platform as well as some general network related work that has been on the back burner while we have been focusing on bigger fish.

What’s Next

I think the most interesting thing on the horizon is that I’m contemplating an attempt at the CCIE Route/Switch certification.  I certainly am weighing all of the components as it is an incredible time commitment that not only would impact me but my family as well.  CCIE is certainly somewhere on the journey for me at some point but if I don’t pursue it now I probably will spend some time working towards non network related certifications…particularly looking at the VMWare’s VCP.

Well that certainly is more than enough blabbering on about myself… I’m hoping that with the completion of some of the time sinks I have been working on that I can start writing up some of the technical/commentary posts that I’ve had brewing in my head over the past few months.  If you’ve made it this far you’re a champ and thanks for reading!

I just received the official word last week that I will be attending Cisco Live 2012 in San Diego, CA this year.  This is a conference that I have been looking to attend for some time now so I am excited to finally be able to take part in it.  I figured I would post my schedule on here for the generally curious and in the off chance that someone reading this might want to connect while there.

If you do want to connect at the conference the best way to get in touch would be to reach out through twitter.

For the most part the test was fair in the topics covered.  In typical Cisco fashion, I felt like someone who speaks english as a second or third language wrote the exam questions.  I much preferred the simulation questions as there are clear objectives and verifiable results.  Now that I have cleared the hurdle of ROUTE I have already started down the path of SWITCH and I am looking forward to the challenge that lies ahead.

I picked ROUTE first as this is the area I have the least amount of experience in and will most likely take the most effort to achieve.  I was previously responsible for a number of larger campus/metro networks that relied heavily on switching concepts and little on routing.  In fact…when I started at the company everything in the network was controlled with static routes…in 2005…

Moving forward to the current day I am still a bit surprised that I’m here.  When I made the move to my current employer about 9 months ago it was as a  SysAdmin with a focus on Virtualization.  I have never been a “Network Engineer” in the truest sense since I have never had a job exclusively focused on packet manipulation.  My manager knew I had some skills in the area but it took my friend Jeff Fry leaving the organization to even give me the opportunity to do work on the network side of things.  Talk about some large shoes to fill…

I’m hoping the the uninterrupted time, combined with some live instruction, is just what is needed to get me moving towards my CCNP.

1. Start with both switch blades out of the enclosure
2. Insert the primary switch and connect to the console port for configuration
3. Enter configuration mode
4. Type the following command to enable stack mode:  console(config)#stack
5. You should now see the following prompt:  console(config-stack)#
6. Type the following commands for each port you want to use for stacking:  console(config-stack)#stack-port tengigabitethernet 1/0/19 stack (replacing 1/0/19 with the correct port number you are using to stack the switches)
7. Restart the primary switch by issuing the reload command
8. Once the primary switch has completely reloaded, insert the secondary switch and connect to the console port.  Do not connect the stacking cables at this point.
9. Repeat steps 3-6 on the secondary switch
10. Connect all stacking ports with appropriate 10Gb/s cabling
11. Restart the secondary switch by issuing the reload command
12. Go get a cup of coffee or stronger beverage if you have been at this for a while.  The secondary switch will renumber all of it’s interfaces as well as some other automated configuration changes.  This boot will take a while.  If you are connected to the console it will look as if the process has frozen…it has not.  In stacked mode you are only able to manage the single management point from the console of the primary switch.

That’s it…unfortunately the admin/config guide doesn’t state anything about the reloads that need to occur to make this happen or the order the commands need to be entered.  This process is in no way something that can be done online so if you are modifying a system that is production ensure that you have an appropriate maintenance window.

Cisco Press

This one is a pretty obvious selection as they publish the official exam study guides for all of the Cisco certification exams.  I’m currently reading CCNP Route  but have also gone through ICND1 and ICND2 for my CCNA studies.  One really great thing about Cisco Press is that they have a an eBook deal of the day which often features the Cisco Press certification guides for CCNA and CCNP tests (in many disciplines, not just R&S).  It’s pretty hard to beat picking up a cert guide eBook for $10.  The only thing to watch out for is that some of the discounted eBooks come with DRM that only allows them to be read on a computer and not on a mobile device like an smart phone or tablet.  They have answered this concern by providing watermarked eBooks but you have to verify which version of the material you are purchasing.

Safari Books Online

This resource goes far beyond just studying for certifications and I can’t recommend having a subscription enough.  Safari is an online library of technical manuals/guides containing just about every technology you could think of.  They have different tiers of access that make it accessible for an occasional user like myself to obtain without corporate backing.  They also publish an iPad application that allows you to access the content from your tablet.

iPad

This is a surprisingly convenient tool when studying for certifications.  Having an independent display (on the go) that can house reference material or lab guidelines leaves your primary laptop/computer free for labbing or note taking.  I also use mine quite regularly to read the certification guides when I’m not sitting at a desk or have my laptop handy.  It’s definitely not a necessity but it has many great uses while studying.

Laptop/computer

You need one…period.  These are technical certifications and I imagine they would be pretty hard to pass without some sort of laptop or computer to work on.  If you are going to be doing virtual labbing with a tool like GNS3 then make sure it isn’t weak.  You can never have too much RAM.

GoodReader

If you are going to read any document on the iPad it is an absolute must.  It makes reading large PDF files easy, remembers where you were when you leave the file/app and can sync files from 3rd party storage locations like dropbox.  It’s $5 in the app store and is worth every penny.

Mental Case

Mental Case is a flash card application for the mac, iPhone and iPad.  Greg Ferro from packetpushers had tweeted a recommendation about it so I picked it up for my iPad…well worth it.  You can create your own question sets or use public sets available for download from FlashcardExchange.com and Quizlet.com.  The application tracks which questions you have answered correctly and incorrectly and can revisit questions you got wrong automatically.  This definitely another fantastic app that is well worth the money.

GNS3/Dynamips

GNS3 is an emulated routing environment that supports running Cisco IOS and Juniper JunOS.  It’s a godsend for labbing as you no longer need to have physical equipment in order to learn how to configure software components.  It certainly gives greater flexibility in setting up disparate media/connectivity types without needing a drawer full of interface cards and multple routers sitting in your garage/basement.  Unfortunately, emulating IOS is a grey area when it comes to licensing.  Technically every version of IOS you run should be licensed (which is tied to a piece of hardware) and Cisco does not provide a short term trial or limited version of their software for testing/studying.  Cisco isn’t alone in that as Juniper and the other major network vendors have similar stances on licensing but the reality is that you  don’t need 4 to 6 routers running in your house and drawing power when it can be emulated at far lest cost/aggravation…not to mention the benefits of bringing your lab with you wherever you go.  As far as I know Cisco has not ever pursued any type of punitive action against those using IOS outside of the normal contract for studying purposes (which has to be in the thousands) but you do so at your own risk.

GNS3Vault

If you do choose to go the emulation route this website is a great resource.  Rene Molenaar runs this site which provides labs for the different technologies learned while going through the study guides.  Some labs are better than others but having free access to lab guides can help validate that you’ve learned the material and provide the practice necessary to really commit it to memory.  Additionally there are many videos on YouTube explaining how to complete the lab requirements.

1. Open up the Windows Server Update Services mmc (Start->Administrative Tools->Windows Server Update Services) on the server you want to configure.
2. Navigate to the Options window
3. Click on Update Files and Languages
4. Check the Download files from Microsoft Update; do not download from upstream server box
   
5. Click on OK

That’s it…very simple to do bot not necessarily the most intuitive place to put the configuration (I was looking for the setting in Update Source and Proxy Server)

Step 1: Create the key chain

Key chains have three necessary components and two optional componenets. The necessary components are the key chain name, key number and key string (aka password). Optionally you can include an accept-lifetime and a send-lifetime parameter that will dictate which keys on the key chain are used when. Lets get started on the initial configuration…

You’ll need to start in global configuration mode and then enter the following command where <unique_key_chain_name> is any name of your choosing:

key chain <unique_key_chain_name>

You should now be in key chain configuration mode. Create a key with the following command:

key <unique_number>

The number you choose here is important as the sequence of keys play into what keys will be used for particular functions. Assuming that this is a new key chain you will almost always start with key 1. The last step that needs to be accomplished for a functioning key chain is setting the key string. This is essentially the same thing as a shared secret phrase or a password and will need to match the key-strings configured on neighboring routers:

key-string <unique_string>

Of all of the above components the two thing that need to match identically to neighboring devices is the key number and key string. The key chain name is only locally relevant and is not used in the authentication process. So long as the key number and key-string match authentication should work correctly.

So that is all good…we now have a key chain and it is configured with a key and key-string but it doesn’t do us much good until we apply that to something and that brings us to step 2…

Step 2: Apply the key chain to an interface

Authentication is configured in interface configuration mode (not router configuration mode as you might expect). Any interface that has authentication configured on it will not form neighbor relationships out that interface unless the neighbor passes the authentication process. To apply key chain authentication on an interface you must issue the following two commands in interface configuration mode:

ip authentication mode eigrp <ASN> md5
ip authentication key-chain eigrp <ASN> <unique_key_chain_name>

**Note: While configuring authentication, if a neighbor relationship already exists it will be torn down when the first of these two commands is issued on an interface. The neighbor relationship will only re-establish itself when authentication is removed from the interface or the neighbor is configured with a complementary authentication scheme.**

So that’s it for the basics of how to configure EIGRP authentication for neighbor relationships. Let’s take a look at the entire configuration start to finish and then cover some additional configuration items as well as some of the caveats of how the authentication works:

R1>en
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#key chain JKM
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string jordanmartin.net
R1(config-keychain-key)#int fa0/0
R1(config-if)#ip authentication mode eigrp 61 md5
R1(config-if)#
*Mar 1 00:30:49.987: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 61: Neighbor 192.168.1.2 (FastEthernet0/0) is down: authentication mode changed
R1(config-if)#ip authentication key-chain eigrp 61 JKM

R2>en
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#key chain HEM
R2(config-keychain)#key 1
R2(config-keychain-key)#key-string jordanmartin.net
R2(config-keychain-key)#int fa0/0
R2(config-if)#ip authentication mode eigrp 61 md5
R2(config-if)#ip authentication key-chain eigrp 61 HEM
R2(config-if)#
*Mar 1 00:32:57.723: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 61: Neighbor 192.168.1.1 (FastEthernet0/0) is up: new adjacency

Accept-lifetime and Send-lifetime

The accept-lifetime and send-lifetime are configuration parameters that are available while configuring a key of a key string. These two commands are pretty self-eplanitory but essentially they establish a time frame for the validity of a key. One of the primary uses for expiring keys is to change key combinations for security reasons.  By configuring multiple keys with different expiration time frames you can configure the key change in advance without impacting your current authentication methods.  The proper way to configure the commands are:

accept-lifetime 01:00:00 Nov 7 2011 13:00:00 Nov 7 2011
send-lifetime 01:00:00 Nov 7 2011 13:00:00 Nov 7 2011

The above commands would use make the key valid between 1AM and 1PM on November 7th only.  This process is obviously very dependent on synchronized clocks between routers.  If you are going to set accept-lifetime and send-lifetime values for your authentication keys it is highly recommended to make use of a central time server to ensure clock synchronization.  To understand completely what happens when multiple keys are valid at the same time we need to take a look at how EIGRP selects the keys to use when authenticating.

Key Selection

When authentication is configured EIGRP identifies potential neighbors and then goes directly into the authentication process. To select which key it sends to it’s neighbor, the router looks through it’s entire list of keys and sends the key-string of the lowest key number that is currently valid. Assuming that today is November 8th, 2011, key 2 and key 3 would be the only valid keys of the four keys in the chart below. Since key 2 is the lowest numbered key, this is the key that will be used to attempt authentication with the neighboring router.

Based on the same information above, if this router were to receive a key string as part of the authentication process, it would try to validate that key against all currently valid keys. If the received key matched either key 2 or key 3 then the authentication would have been validated and the neighbor relationship would be established.

If you have been checking here occasionally, as I know some of you have, I apologize for the false start.  I do still intend to get this blog rolling but there just are other things that need my attention at the moment.  Thank you for your support.

Change #1 – New Daughter

That’s right, on 5/23 my second daughter, Lydia Joy, was born around 8:30 AM.  Everything went as smooth as possible and like many others before me, this week has been a week of settling in and adjusting to the demanding schedule that a newborn requires.  This time around was a lot easier from a preparation standpoint as we already had all of the necessities from our first.  That being said, my wife and I took the more traditional route and didn’t know the gender before birth.  I guess we lucked out as their was no required mad rush to the store to buy boys clothing.  I’m enjoying the process a little more this time as it is familiar and couldn’t be more excited that Hannah (our first) wants nothing more than to be a great helper.  I’ll spare you any more details and just post the picture like any proud father should:

Change #2 – New Job

After 6 years at my current employer, KidsPeace, I have decided that the timing is right to pursue new opportunities elsewhere.  I am extremely grateful for the opportunities I’ve had while working at KidsPeace and am excited to bring the experience I have gained there to new projects and challenges.  As I’m sure you can imagine, the past two weeks have been daunting with transitioning current responsibilities to my team members and having a baby during the process.  It certainly has not been boring and am glad that the bulk of the craziness is done for a while.  I will be joining the systems team at kgb starting tomorrow which I’m sure will bring a bevy of new topics to cover on this blog.  I am still planning on pursuing my CCNP (even though it falls out of the purview of my new responsibilities) and even possibly VCP in the near future as virtualization will be a large component of my position.

So now that the news is out of the way, I promise that my next post will be a technical one.  Until then…