Just reading up on stuff and came across the I/G and U/L bits in the MAC address. The I/G bit is the first bit of the MAC address, reading MSB to LSB, the U/L bit the second.

I/G: Binary 0 means the address is a unicast; Binary 1 means the address is a multicast or broadcast.
U/L: Binary 0 means the address is vendor assigned; Binary 1 means the address has been administratively assigned, overriding the vendor-assigned address.

Say I’d want to Deny Multicast & Broadcast and also Administratively assigned addresses, then the following ACL would be best (out of the three options, due to ACL length).

mac access-list extended MACL-official-Ucast-only
permit any 0000.0000.0000 00ff.ffff.ffff
!
interface FastEthernet1/0/10
mac access-group MACL-official-Ucast-only in

Categories: CCIE R&S, Main blog
Comments Off on MAC filtering

10th of August is my next lab date. After booking the 14th then the 4th of September, the 10th of August came up and I snapped it up as soon as I could.

For all those wondering whether you can easily change your lab date. It’s easy enough, you just book another date and it moans at you that you already have a date. You’ll have to option to have the system delete your previous date replacing it with the one you’re trying to book. Took me a while to figure that one out but apparently it is listed somewhere on the Cisco CCIE site but I had a hard time finding it, was only after I heard the answer to my question from Cisco that a colleague pointed me to a page with the info I’d been looking for…

Categories: CCIE R&S
Comments Off on 2nd Lab exam coming up!

EEK, just noticed I’d not written anything about attending Networkers yet. Well I had a whale of a time and not just because of a rather cool ‘customer appreciation event’, the former Cisco party. But because I was able to attend a fabulous Techtorial and I managed to discuss a lot of issues with key people from Cisco.

Networkers has really changed my view on Cisco, the technical guys there were really interested in what we, the customers, had to say. They welcomed open discussion during their sessions and handed out business cards galore. I even received mail during the weekend after with answers to questions I posed during face-to-face Design sessions in between the presentations/normal sessions.

I must clarify that I registered my sessions very early and I planned it meticulously. I’ve only been to level 3 sessions which kept me safe from hot air marketing talk etc. Also I agree with Cisco when they say that what you get out of it is what you put into it and it really paid off for me. I’ve got so much info to take back with me and process that I’m glad I made so many notes. It surely was way more valuable than a month of full time classroom training.

Further things that impressed me were: Explanations of road-maps, a few of them even more than 12 months ahead. How approachable everyone was. How I managed to baffle one of the speakers during an MPLS VPN Design session I walked into; MPLS VPN hub-and-spoke via a firewall without using a vlan per vrf. There is no solution…

Better stop here else I’ll never stop. I will probably divulge into one or more of the subjects I attended some time in the future, but I’d better not promise anything… 😉

Categories: CCIE R&S
Comments Off on Blown away: Netwokers EMEA 2007

Oh, lest I forget again. Check out the CCIE R&S pages. Since restarting my studies, I’m updating them regularly again so be prepared to find new gems in there. Or just browse it for some of those “oh yes” moments if ‘new’ it’s so new for you any more. We all forget this stuff if we don’t regularly remind ourselves, I do anyway…

Categories: CCIE R&S
Comments Off on CCIE R&S page updates

I’ve heard reports of the lab containing more and more L3 switches these days. Looks like I need to update my lab hardware to incorporate some L3 switches. The 3550 is EOS but even second hand overly expensive, the 3560 is not cheap either. I’m hoping my employer is willing to get some as I’ve now got two other colleagues gearing up for their CCIE. I might have a trick up my sleeve but you’ll have to come back later if you want to know the outcome of that one.

I currently use a combination between a normal router and a vlan on my L2 switch for all switch related tasks but I guess Cisco is adding NAC (IEEE802.1x) and other advanced L2/L3 switching tasks into the lab. Which is kinda logical seeing as even I’m looking at the L3 switches as Ethernet access cpe’s.

Categories: CCIE R&S
Comments Off on 3550 & 3560…

Right, it’s been a while since my last attempt (2nd of August last year). Joshua, my 3,5 mo old son, is sleeping through the night so I can get back into studying.

Tonight is the evening I’ll be picking up the battle axe again and I must say I’m terribly rusty. Been very busy with work and that did not involve in-depth routing protocols. Will start on the basics and get myself familiar again with the basic stuff I got from my CCIE bootcamp. Then I’m planning to go through all the practice labs I have to see whether I’m really at ease with everything I encounter. Some of the points I’ve already mentally listed as crucial are:

• Multicast (PIM-SM, PIM-DM and using GRE tunnels)
• OSPF over various tastes of F/R
• BGP route manipulation (redistribution and tagging)
• ACLs (lock&key, time based & ‘odd’ logging)

I sure hope the other guys I studies with are still around as I’ve not heard from them in a while. My plan is to attempt my next lab in Feb, that is time permitting. Networkers EMEA 2007 will take a nice chunk out of my time as well as work related stuff although that shouldn’t be too much of an issue now that I’ve got some of my long awaited equipment.

Categories: CCIE R&S
Comments Off on Back to CCIE-lab study

For all those who check into this page and are wondering what I’ve been up to…

On the 22nd of September my second son was born, Joshua Marius Geurts. Since my last (and first) lab attempt I’ve been preparing for Joshua’s arrival by redoing the baby room and converting an old cupboard into a 2nd toilet.

Now that Joshua is here I’m busy with day to day life and trying to build a little reserve again. I hope to have to opportunity soon to start preparation again for my second lab attempt.

Categories: CCIE R&S, Main blog
Comments Off on October update

CCIE Routing and Switching Lab Score Report

Candidate: Djerk Geurts
Lab Date: August 2 2006
Lab Site: Brussels
Failed

I really thought I passed, had time to spare, reloaded everything check the routing tables and complete connectivity. I quickly came down to earth when my wife phoned me back saying I’d received a mail from Cisco. Must say it’s pretty quick so I must have either annoyed the proctor or the script  that runs against the configs must have regarded my configs not enough Cisco compliant.

Sad thing is I have no idea what I did wrong and as there’s no way of getting any feedback I’m afraid I’ll make the sam mistakes next time. Maybe next time I’ll be a little more relaxed and focussed. Maybe I was too stressed, didn’t feel it, and missed some important things in the questions. I suppose I’ll never know.

I’ll be focusing on DIY for the moment as I need to prepare for a new baby which is due to arrive soon. Stay tuned!…

Categories: CCIE R&S
Comments Off on CCIE Routing and Switching Lab Score Report (#1)

A nice relaxing day to write some last notes and relax, for my latest addtions have a look in the lab section of my CCIE R&S page. New topics:

• Smurf/fraggle attacks
• EIGRP bandwidth limitation
• DHCP pool options
• F/R with ‘dual’ QoS (thanks to the evil bastard for that one)
• Redistribute BGP default into IGP

Will post again on wednesday evening (bad) or thursday (should be good)

Categories: CCIE R&S
Comments Off on Right, last updates done before D-day…

Pfew, I’m typing this with the last little bit of energy left in me. I started this morning on the mocklab I screwed up during the bootcamp and I actually finished in time. I would not have had 100% score as there were two things I had to look up outside of the “univercd”.

So this has given me a last push to find little thing that I’d forgotten (already!) or hadn’t used yet. Like BGP and EIGRP authentication. I’ve written down some topics I want to work out on my CCIE R&S pages so stay tuned int the next two days.

Time for dinner now , ooh I’m soo happy that I managed this in 8 hours, the 1st mocklab I did took me 14 hours so this is a nice booster for this wednesday when it’s for real.

PS: I’ve bought a set of coloured pens, I really hope the proctor will allow me to use them as my drawings become a mess without them. I’ve used them the entire week and now have a nice colour coding scheme for different things like protocols and special notes. Also I’ve developed the habit of making a separate network drawings for BGP and Multicast, it really helps keeping the different forwarding planes separate and simple.

Categories: CCIE R&S
Comments Off on CCIE R&S mocklab

Found this 3 minute video showing the lab environment and detailing in simple terms what the 8 hour CCIE lab exam is.

Categories: CCIE R&S
Comments Off on Virtual Tour – CCIE Lab

My lab equipment can be seen here:

My hardware: 3x 3640, 3620 (and a broken one), 2620XM, 2x 7204(VXR) NPE-200, 2x 2621, 7507 (dual RSP4), 3548XL, 2948G-L3 and a 2511.

BTW: The two 7304’s, two empty 3660’s and the 7204 under my laptop aren’t part of my CCIE lab.

Categories: CCIE R&S
Comments Off on My CCIE lab equipment

Maybe this post will enable me to remember this feature. I hadn’t heard of it untill I was at Heinz’s CCIE R&S bootcamp last June.

The idea is that a user can log into a system and then that system will grant access to some traffic for a period of time. Nice heh, well be carefull it uses extended access-lists so the normal anti spoofing measures still need to be taken. So how do we do this then? Simply follow these steps:

# use a local account instead of the vty password:
line vty 0 4
login local
!
# User account to open the ACL dynamically:
username djerk password 123456
# User is allowed to open the ACL, sadly you can’t specify the ACL so all ACL’s will be opened by this user!
# The timeout value is the idle timeout!
username djerk autocommand access-enable host timeout 2
!
# The lock&key ACL:
ip access-list extended NACL-lock&key
remark *** Permit user:djerk to open this ACL (lock&key) ***
# Permit user access if he has to traverse this ACL
permit tcp host 1.1.1.1 2.2.2.2 eq telnet
# Careful: timeout of the dynamic rule is in minutes
# The rule in the dynamic line will be installed into the ACL once the user has authenticated
dynamic DYN-lock&key timeout 10 permit tcp any any eq telnet
deny tcp any any eq telnet
permit ip any any
!
# Apply the ACL to the interface:
interface F0/0
ip access-group NACL-lock&key in

The idle timeout of the access list is configured in the autocommand. It is overridden by the absolute timeout in the dynamic access list.

The above config is from CCO minor changes and comments by me 🙂

Categories: CCIE R&S
Comments Off on autocommand access-enable (lock&key)

frame-relay fragment
Enables dual-FIFO, but how to get VoIP into the voice queue? Is rtp heasder compression enough to do this or is LLQ needed with a priority class?

I’d be inclined to think that RTP header compression has no influence over FRF.12 fragmentation, unless it matches RTP traffic into the propper FIFO queue (dual-FIFO). Seeing that FRF.12 enables dual-FIFO I can only assume this matching to be the case, I’ve not yet found a doc stating this without doubt. So please leave a note if you do.

Anyway I think it’s good to know both options. Dual-FIFO applies fragmentation only to the ‘data’ queue, I know this from Multiclass Multilink PPP (MC-MLPPP) which is also dual-FIFO. I use MC-MLPoA for QoS on DSL lines.

——- (Without FRTS)
# One config:
Int S0/0
frame-relay fragment 40 end-to-end
!
Int S0/0.1
frame-relay interface-dlci 1
frame-relay ip rtp header-compression

——- (With FRTS)
# Other config:
Class-map match-any voip
match protocol rtp audio
Policy-map FR-voip
class voip
# Enable PQ so the router can differentiate between flows (dual-FIFO)
priority
class class-default
!
map-class FR-voip+FRF12
service-policy output FR-voip
frame-relay fragment 40
!
Int S0/0
frame-relay traffic-shaping
!
Int S0/0.1
frame-relay interface-dlci 1
class FR-voip+FRF12

CCO: VoIP o F/R with QoS

Categories: CCIE R&S
Comments Off on F/R dual-FIFO

In OSPF you can’t filter routes. This is only true inside an area, due to OSPF being a Link State protocol. LSA’s are flooded throughout the area and the protocol is based upon everyone in the area having the exact same database. There are no such things as communities like in BGP to aid in something of a route installment selection process.

What is available is filtering on an ABR or ASBR. ABR filtering is somewhat less known but here’s how it works on Cisco:

Let’s create a range (OSPF summary) and filter the summarised routes so that only the range is advertised to the other areas.

Router_A(config-router)#do srr
router ospf 1
# Filtering the range’s subnets (type 3 LSA filter) when they enter area 0
area 0 filter-list prefix PFL-10.10.10.0/8-subnets in
# The range to create the summary:
area 1 range 10.0.0.0 255.0.0.0

Router_B#srr
router ospf 1
# Filtering the range’s subnets (type 3 LSA filter)
area 0 filter-list prefix PFL-subnets in

# On both:
ip prefix-list PFL-subnets description *** Filter subnets out of the 10.0.0.0/8 range ***
ip prefix-list PFL-subnets seq 5 deny 10.0.0.0/8 ge 9
ip prefix-list PFL-subnets seq 10 permit 0.0.0.0/0 le 32

Categories: CCIE R&S
Comments Off on OSPF filtering