Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
bad boys for life
Jun 6, 2003

by sebmojo

Powercrazy posted:

2 2600 routers and 2 2900 switchs with maybe a 2500 router for a console server is all you need for the CCNA.

But honestly you don't even need that, just use Dynamips or something. The CCNA can be passed even without even passing the sims.

This isn't true anymore. The new CCNA exam is a bit tougher then it was before, and if you can't do labs, you will fail. I just took it a couple weeks ago, and there were multiple lab questions where you have to find out what is wrong and setup/fix routing.

Adbot
ADBOT LOVES YOU

bad boys for life
Jun 6, 2003

by sebmojo
If youre using cisco switches, bpdu guard may work.

bad boys for life
Jun 6, 2003

by sebmojo

Casimirus posted:

Can anyone compare the QoS exam for the CCIP to the ONT exam for the CCNP? The ONT is very short on material, they pad it out with SDM stuff but it's still short, and I feel like if there was anything more to QoS they'd put it on the ONT. I also see the overlap between MPLS and ISCW, and BGP and BSCI, is the CCIP just a gimme after the CCNP?

The CCNP is going to be overhauled probably early 2010 so if you plan on doing that route, you should try to do it before the end of January. They are probably removing the ONT outright and probably the ISCW and replacing it with a troubleshooting exam.

bad boys for life
Jun 6, 2003

by sebmojo

jbusbysack posted:

June 30, 2010 is the end of the existing 4-exam CCNP track for non-Network Academy people. After that it's more or less mix and match of the old/exams, so really get running on it.

BSCI = ROUTE
BCMSN = SWITCH
ONT + ISCW = TSHOOT

There's a PDF out with the new requirements but I'm not sure if it's ok to upload.

Thanks, wasn't 100% sure on it.

On another note, does anyone have a good checklist for setting up routers and switches? I made my own but I'd like to double check it.

bad boys for life
Jun 6, 2003

by sebmojo
Do you guys have acls allowing it to pass?

bad boys for life
Jun 6, 2003

by sebmojo
Longshot, but is there anyway someones resetting it and it was last written with it admin down?

bad boys for life
Jun 6, 2003

by sebmojo
Ive had IGMP snooping cause this, may want to disable it and see if it helps if its on.

bad boys for life
Jun 6, 2003

by sebmojo
Anyone know if there is a way to deploy configurations from a term server over the lines? I have a large lab at work and it would be nice if I could just copy all the various configurations to the term serv and deploy them from there.

I would use a server, but people screw up the configs so badly that it always loses connectivity to it and ftp/tftp fails.

bad boys for life
Jun 6, 2003

by sebmojo

Less Fat Luke posted:

Does anyone know if there's an ASA or ASA-like Cisco firewall that supports 10GE speeds? We use 5540s now, but more and more of our backend is becoming 10GE and having to go through even teamed 1GE links is starting to suck.

We have 5585-X's deployed for some of our customers. Theyre great boxes with 10G SFP+ interfaces but you need licenses. Depending on what you're doing with them, and the speeds, you also need the correct SSP. SSP-10 for up to 2G, SSP-20 for up to 5G, and so on.

bad boys for life
Jun 6, 2003

by sebmojo

QPZIL posted:

As long you're using IOS 12.2 or higher on both ends, I think you're good.

Yeah, we use /31s on hundreds of devices and it's fine.

On another note, does anyone know of any software for mass deploying base configurations to routers connected to a term server? Im going to have to configure 50 routers at a time and would like to load a base config on each of them, and then apply a specific config file per term server port to them afterwards.

Im writing software to do it myself, but would like to use something commercial long term.

bad boys for life
Jun 6, 2003

by sebmojo

Zuhzuhzombie!! posted:

Anyone else using an ASR9k?

The more we use them the worse the feeling I get about having them as our core.

I work at a large MSO and we have them as our edge routers, CRSs as the core (but were moving to the new version of the CRS, been labbing it).

Make sure youre on newer code, at least 4.2.3, or youre going to run into lots of odd issues.

Ive configured dozens of 9001s, 9006s and 9010s, and we havent had any issues since upgrading the code. We have probably 400 in the network now.

bad boys for life
Jun 6, 2003

by sebmojo
Im not sure where to ask this, but does anyone know of a managed surge protector/power switch that has two 100M or higher ports that acts almost like a switch?

Basically I need a device that looks like an ethernet tap with a managed power outlet.

I would like to terminate a management circuit on it and pass another vlan through it as the data vlan. We have lots of remote devices that are terrible and require reboots every few weeks, and we have to send techs on site to do it. Something like this would save us tons of trouble.

I know there are managed UPSs and managed surge protectors with remote on/off capability, but something that doesnt require us putting a switch out there would be ideal.

bad boys for life
Jun 6, 2003

by sebmojo

Slickdrac posted:

I could understand that from an application or just from the router. I binary packet captured it with nothing but 0s where the header should be.

The ASA is giving it a WTF is this response and dropping it.

Source and destination port of 0 is also flagged as a DDoS attack due to fragmentation attacks/DNS amplification. Youll want to check MTU settings across the path (can ping with various sizes) to determine if you have an issue there.

bad boys for life
Jun 6, 2003

by sebmojo
Speaking of high performing security projects, has anyone looked at firewalls capable of 30G+ of inline IPS?

Were using the 5585-Xs with SSP60s and were about to run out of headroom. We need to be able to scale towards 30-50G within 3 years, with upgrades of about 5-10G each year until that point.

I am about to start looking at Palo Alto, but a starting point from experience would be great.

bad boys for life
Jun 6, 2003

by sebmojo

Ninja Rope posted:

Can I ask what your use case is for doing IPS on that much traffic?

One of the largest school districts in the country. A few hundred thousand users.

bad boys for life
Jun 6, 2003

by sebmojo
http://www.precisionot.com/

We use this company for cheap Cisco compatible SFPs and SFP+s. May want to try them.

bad boys for life
Jun 6, 2003

by sebmojo

Prescription Combs posted:

IIRC, the commands are only in the catalyst switches. No clue on the router side.

I've been able to use them on older routers, but the ISR G2s I have not.

bad boys for life
Jun 6, 2003

by sebmojo

Dalrain posted:

Thanks! I'll probably try and work into NSX a bit, since it's accessible to me right now. I'm currently a CCNP R&S, so it's good to know that the L3 stuff will help. Is there a good way you know of to "lab it up" and really try some of these things at home?

Do you want to do just SDN? Do you want to look at NFV as well? Do you want to work with this in the Enterprise? Datacenter? ISP?

OpenFlow is going to be used in the datacenter more than it is going to be used at an MSO/ISP. NETCONF/Yang are going to be used on SP networks most likely. Enterprise is more up in the air as far as I can tell and will probably mature last as the devices will be last to support OpenFlow/NETCONF, and enterprise networks typically arent as standardized as a datacenter or SP network.

If you have a server with a couple xeon processors, you can spin up a OpenStack/OpenDaylight lab. I would use ESXi or KVM for your NFV lab work since it's free. I would also look at the CSR1000v (you can get a demo license from Cisco) and you can work with those in a virtual environment, with whatever physical equipment you have on hand. But, the issue is going to be getting equipment that supports OpenFlow/NETCONF to setup your lab in the end.

The suggestion to learn layer 3 was a good one - you're also going to need to understand MPLS, and have a deep understanding of MP-BGP. Almost everything is transitioning to BGP and MPLS, and relatively few network engineers really have that down.

SDN is extremely immature right now and there isnt really a set standard for everything. Whatever you end up choosing to study may not be even in use in one year.

bad boys for life
Jun 6, 2003

by sebmojo

Sepist posted:

What's you guys thoughts on the CCIE Written being on your resume? I let my NP expire last month and it's biting me in the rear end. I am taking the IE Exam soon and assume I'll pass, but feel tacky having it on there. I was thinking of just leaving the NP and when I ultimately get the "certs active question" I'll just say I have an active CCIE Written

I do technical interviews for CCIE level engineers and will take the written over an NP candidate any day - but Ill also interview you a lot harder to make sure you didnt braindump it. So if you put that on there, you can potentially expect a more difficult technical interview..

bad boys for life
Jun 6, 2003

by sebmojo
When I do interviews I prefer open ended questions for candidates. Generally I whiteboard a diagram with 2 pcs, connected to layer 2 switches, connected to routers with MPLS.

I then ask them to tell me all the ways they can configure the links to allow the PCs communicate. It lets you gauge how much they know overall instead of individual concepts.

bad boys for life
Jun 6, 2003

by sebmojo

Otis Reddit posted:

Desktop Support guy here at a medium sized MSP that is a Cisco Meraki shop. Looking to make the jump to sys admin hopefully as part of an in-house IT team. Is the CCNA still a good cert to go for? Since we mostly replace ASAs with MX equipment, the overall vibe at my current company is 'not worth it anymore' -- but MSPs love their own partners and discourage all else. What do you goons think?

It's a good cert to have for entry level, and whether you get it or not, it's worth studying for as you'll learn good foundational knowledge. To Bob Morales' point, getting cloud certs is more valuable, but personally I would go for the legacy network cert in the CCNA (NP if youre going to go into a SP/MSO/MSP) and cloud certs if I was just starting again.

Adbot
ADBOT LOVES YOU

bad boys for life
Jun 6, 2003

by sebmojo

Otis Reddit posted:

At times, I feel that if I'm still with this company in any capacity in two months, I'm doing it wrong.

Thanks for the advice goons. I've been reviewing the material for about 6 weeks by now, and have a good grasp on it -- I might as well see it through. Any additional advice or anecdotes are welcome.

Best advice I can give:

Learning networking at first is really hard. Its a whole bunch of concepts that on their own dont make much sense, and dont really until you grasp enough of them together. Then it all clicks and you can kinda move up understanding from there. It will be very, very frustrating at first, and then get much, much easier for awhile.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply