Isn't it Ironic?

I find it ironic that the word asymmetric is spelled with only a single s but double m's. I keep trying to spell it assymmetric, but I guess it sticks better to the meaning of the word the correct way.

So, not much MPLS studying was completed last week due to an asymmetric routing issue I ran into at work that took a bit of time to figure out. There is a great article here that explains it.

Asymmetric routing happens when a packet leaves a network through one path and comes back in through a different path. Take a look at the following picture, disregarding the Multicast lingo.

Imagine if a packet comes into the switch on the left, leaves the router on the left to the cloud. Then, a return packet enters the router on the right, back to the switch on the right, and finally back to the switch on the left.

Now, when the packet enters the switch on the left originally, the switch updates its cam table with the source mac address. The packet passes up to the router on the left, and out to the cloud.

When the packet returns, it comes through the router on the right, and down to the switch on the right. This is where there is a problem.

Since the outbound packet never went out the switch on the right, the switch never loaded it's mac address. And what does a switch do when it doesn't know the mac address? By default it floods the packet out all interfaces associated with that vlan (extra credit for CCIE students who know how to turn this floding off). This includes access links, trunk links, etherchannels, and whatever else. So if there is a chain of 15 switches, this packet is likely to get flooded across all interfaces of all of those downstream switches.

Now how do we stop this from occurring? We need a little help from ARP. When the host wanted to send an outbound packet, it had to send an ARP request. An arp request is a broadcast IP packet that sends an IP address and awaits the response of the MAC address associated with that IP address.

Since this is a broadcast packet, it is flooded throughout the broadcast domain (i.e. vlan). This causes all of the switches to update their cam tables and stop flooding the packet.

So why does this happen to begin with? One of the main reasons is due to mac aging-time. A router by default generally has a mac aging time of 4 hours. A switch by default generally has an aging time set to 5 minutes. So, when a router learns a MAC addresses, it doesn't need to relearn it for 4 hours. However, when a switch associates a MAC address with a port, it loses this information after 5 minutes. After 5 minutes, the only way a switch that's not in the path can update its cam tables once again, is for another broadcast to occur.

A switch will not send an arp request when it loses an entry from its cam table, however, a router must since it needs the mac address to send traffic to the host. At default mac aging settings of 4 hours for routers and 5 minutes for switches, asymmetric traffic will be flooding for 3 hours and 55 minutes of every 4 hours. This is probably not desired operation. Therefore, when asymmetric routing exists, routers and switches need to have their mac aging times set identically.

MPLS Study Materials

I've been bouncing around this week evaluating different study materials and I think I've finally settled on a book that works.

MPLS Fundamentals (ISBN 1-58705-197-4) seems to be the most readable of what I've seen. In general, I just find the whole MPLS topic to be extremely dry--I'm not sure why. Possibly since most of my career has been spent as an ISP customer, the inner workings of MPLS was never really relevant to me.

It could be worse, I could be studying storage...

MPLS Exam Cram

This is the start of notes on my cramming for the MPLS exam. It will consist of new or interesting MPLS information that I need to commit to memory.

• Multiple labels can be inserted, and the bottom-of-stack bit is set on the last label
• Labels consist of a 20 bit label, 3 bit experimental field, 1 bit bottom-of-stack indicator, and 8 bit TTL
• Ethertypes: 0x0800 is IP, 0x8847 is unicast with at least one label, 0x8848 is multicast with at least one label
• More than one label is used for VPNs and TE
• An LSR can push, swap, or pop labels
• MPLS is split into the control plane and data plane
• FEC: Packets forwarded based upon a common characteristic
• For Unicast IP Routing, an IP routing protocol and a Label distribution protocol are required
• Label distribution protocols match labels with networks
• FEC is the destination network
• PIM can be used for multicast, and the FEC is the destination multicast address
• TE requires OSPF or IS-IS with extensions
  
• RSVP or CR-LDP establishes tunnels and propagates labels
• With QoS, the FEC is the destination network and CoS
• In VPNs, two labels are used: Top points to egress router, second points to the outgoing interface on the egress router, or a routing table
  
• FEC is the site descriptor or VPN routing table

BSCI Complete

The exam ended up more or less as I was expecting. Some parts were relatively easy, some were a pain, and always an overabundance of annoying questions that seem more to be out to test attention to detail rather than knowledge.

My score was a bit higher than on QoS, and passing, but still low enough where I'm not concerned that I overstudied for the exam.

On to BGP+MPLS, which will complete the CCIP. After that it's finally onto the SP Written, which will renew my CCIE certification.

Even though I'm planning on doing the SP lab after that, it is a little tempting to just knock out all of the professional level exams. I have enough experience in Voice and Security as well where I could probably hit an exam every couple of weeks and have the CCVP and CCSP complete by the end of the year.

The CCIE lab is just such a time and energy suck. But I'm leaning toward going ahead and studying for the lab sonner rather than later. There are three main reasons for this.

First, I'll be freshest on the lab material after just studying for the CCIP and written. If I switch tracks I'll probably have to relearn a few things.

Second, assuming I eventually pass the Service Provider lab, I can then jump right into the CCSP, which would give me a break before working on the Security lab. I'm definitely saving voice for fourth just because it has the reputation for being the toughest. Storage would be last since I have absolutely no experience with it and it will probably take me a lot longer.

BSCI Exam - 642-901

Ok, the very fact that I have to take this exam is a little strange. I have been a CCNP since 2004 and am a CCIE. Why don't these fill the "routing" exam requirements?"

According to the certification progress website, the version of BSCI exam I passed over 4 years ago is too outdated to count. So I have to knock this exam out instead.

As far as I can tell, there is only one topic that isn't covered by the R&S written: IS-IS. I'm guessing they're just going to be asking questions about the intricacies of L1, L2, and L1/L2 behavior.

Aside from that, I'll need to brush up on all the "booksmart" material such as timers and metric computation.

I think I'm going to shoot to have this knocked out by Friday.

I have my weekends back

On Friday I completed my final presentation for my Master's Project at Towson University in Maryland. For the first time in over 5 years I don't have any studying or homework to worry about over the weekend. All the more time to spend studying for CCIE #2? Nah, I think I'm going to be taking a few weekends for myself until I knock out the written and am ready to start working on the lab.

CCIE Worldwide Statistics

It's official, North America no longer holds most CCIEs. As of the recently released statistics here, Asia now has more.