Data Center Rebuild

Today we redesigned the core of our datacenter. Some of the configuration tasks included:

• HSRP with object tracking
• dot1q trunking to a router
• transparent firewall BPDU passthrough
• BGP advertise-map configuration

One of the primary benefits of this configuration was it allowed us to add some functionality to the network, while replacing a number of layer 3 switches with layer 2 ones. This allows us to use less expensive resources and redeploy the freed up devices to more suitable locations. It also simplifies the network, which is generally a good thing.

Just from my experience with the CCIE lab, I changed my normal plan of attack here. In the past I was more one who prefered to gut everything and replace it all at once. Now, I tend to follow lab strategy and do one piece at a time, verifying as I go.

As with the lab experience, things go much slower this way, but it gets done right. When something doesn't come up I know exactly where to look for the issue instead of having to troubleshoot everything.

As expected, there were a few bugs to work out, but just about everything ended up as designed. The great work up front and during the implementation by the whole team really paid off.

Some of the learning experiences were

• A firewall in transparent mode can pass layer 2 information, but not CDP. A ethertype access list is required to allow BPDUs to pass. This was necessary so that a backup link can be used while letting rstp block the link. If this didn't work, another option would have been the "switchport backup" option for the 2560/3560 series switches, which functions a bit like a layer 2 version of the backup interface router configuration command.
• It always helps when default gateways are set correctly
• When using Hyperterminal to paste commands, make sure to set the character delay to prevent buffer overflows
• Duplicate IP addresses are very bad things

Most of these were minor and corrected quickly.

How the CCIE helped in the first week

On Friday night I had a BGP implementation to do at our India location. There have been a few transatlantic cable breaks of late so we really needed to get a redundant provider up and running. The change began at 10pm with a relatively simple setup. All I want is a default route and I'll use as-path prepending and weight to ensure the primary circuit is preferred.

While one ISP got it correct, the second did not. My router wasn't maxed out on memory, so I needed to ensure I didn't have the entire BGP table. Sure enough, once the BGP adjacency came up, I began to receive more than I bargained for.

Now the race was on. I had to filter everything but the default route before the router ran out of memory. Of course, just about any CCIE should be able to do this.

ip prefix-list DEFAULT permit 0.0.0.0/0
!
route-map NODEFAULT deny
match ip address prefix-list DEFAULT
route-map NODEFAULT permit 20
!
router bgp xxxxx
neigh xxxx route-map NODEFAULT in

It took about 30 seconds. No DocCD needed. I didn't even have to use the ?. It worked right the first time.

This is why the stress and pressure and time constraints exist in the lab. Unexpected things happen. Sometimes you have to act quickly. Consequences can be severe.

A new purpose

It has been almost a week since I passed the CCIE lab exam. There were a number of congratulations and a celebratory dinner alone with my wife. Aside from that it has been life as usual. No ticker tape parades. No job offers for obscene amounts of money.

My life has changed already though. It's Saturday and I did not wake up at 6am. I slept in until nearly 11. My wife and son are out of town this weekend, so I have been watching movies and hanging out with my dog. At some point I need to lower my son's crib since he's very close to pulling himself up.

The next change is that I'm finding it difficult not to brag. I called a few friends and sent a few more emails. But most people would probably not know unless they paid attention to my new email signature. I'm not sure if I'll keep it in there long-term, but I will for at least a week or two.

I'm also not sure what to do next. I'm planning on casually studying for the security track. I'm really not in a rush. It took me 10 years to get the first CCIE, so that should be too difficult to improve upon.

One thing I did notice. There are a lot of blogs of people either talking about studying for the CCIE or helping others to get there. But what are you supposed to do after you're certified?

There is no official blueprint for what to do after you're certified.

So, the new purpose of this blog is to discuss what happens next.

Passed!

Now I need to figure out what to do with all my newfound free time.

Ed Balow

CCIE #20152

CCIE Attempt #2 Task 1/2

Here I am at the hotel in RTP the night before my second attempt. I arrived early enough to have a nice dinner and talk football with the bar patrons for a bit. To my dismay, the Bears traded Berrian to the Vikings. So now they are down two starting wide receivers, and are about to lose Lance Briggs, with only a 1-year extension for Rex that's-just-Gross-Man to show for it. Not looking to be too promising of a season.

The first task of the lab, that many seem to fail, is getting a good night's sleep the night before. I bombed that miserably at my first attempt. I came down to RTP with my family and my dog. My 7 month old son was still collicky at the time and thought he'd help me study until 4am. Unfortunately I don't understand babytalk so all it meant was that I only got about 2 hours of sleep. I ended up getting to the lab about 15 minutes late. By 6 hours in I was feeling pretty drained and didn't have much motivation to do a detailed 2nd verification of everything.

Due to some misconceptions I had that I realized in later studies, I probably would not have passed anyway. But I'm going to do everything I can to get some solid sleep tonight. I did a test drive to the Cisco campus to make sure I know the way. I have a 6am wakeup call scheduled, my cell phone alarm, and hotel room alarm set for that time as well. So I'm calling my sleep preparations task 1/2. Let's just hope I can follow through.

If you happen to read this, Laura, thanks for all of your support this year. You've allowed me to get a heck of a lot of studying done on the weekends and I really appreciate it.

Contingency Plan

I really hope I don't fail. I feel as if I've learned pretty much everything I'm going to learn from the IPExpert an Internetwork Expert labs. I'll be a little unsure as to where to turn next. With the typical CCIE difficulty metric being a 7/10, I feel my knowledge is about 8.5/10 at this point.

I've told my wife I'm only taking 5 attempts. If I don't get it by then I'll give up. That gives me 4 attempts left.

I do get a little frustrated with IPExpert and IE labs. There are a number of mistakes that are obviously from failure to properly upgrade their workbooks over the years. I personally find this to be detremintal to my studying. I've had to get use to assuming things might need to be a little different than they way they are worded. On the actual lab, this is BAD. I need to make sure to assume absolutely nothing.

I don't feel there's anything else to learn with a free retake of the IPexpert bootcamp. Perhaps taking it with Scott for a different perspective would help.

There has been a lot of "testimonials" on the Narbik bootcamp lately. It's to the point that I'm actually steering away from it. From the reviews I'm reading, it's sounding more like he's teaching "stupid router tricks" than anything else. My impression could be wrong, so I'd open up some discussions on Monday if I need to.

I really feel the best preparation for me at this point is the Mock Labs. I've taken all but 2 of the IE mock labs. Another option would be to take the IE Mock Lab bootcamp.

Another possibility would be to swtich to NetMasterClass. A lot of people seem to recommend using them in tandem with IE. Their CheckIt labs are pretty expensive though--$250 each or 3 for $635. They also have a DoIT volume 2 plus 5 CheckIt labs package for $1324, which is about the same cost as a lab attempt.

Since I have been successful at studying at home, I think this would be a good approach to take. It would give me 1 graded lab a weekend and 1 workbook lab a weekend with 5 weekends before another attempt.

So that's my plan of attack. Purchase the $1324 package from NMC and reschedule for a month out.

Knowledge Assessment

So here I am, 2 days out from my second attempt. All in all, I'd say I'm feeling pretty good, but I certainly wouldn't say I'm overconfident. I didn't feel the lab itself was too hard last time. I finished the first run at about 6 hours and was only confused by a couple of tasks. Through further studying, I've realized I did a couple of other tasks wrong and probably should have asked a few other questions.

Here is a list of things that I still feel I could use some work on:
-Catalyst QoS mutation maps
-OSPF NSSA Type 7 suppression
-Reachability Verification--I always seem to miss a BGP route somewhere
-MBGP
-Multicast Troubleshooting--I'm still slower than I'd like to be
-PIM Mapping Agent placement
-CBAC and Reflexive ACLs--I'm still gunshy to implement these
-NTP--remembering to apply the trusted key to the ntp server
-Extended login options