I completed this lab again and it only took about 4 hours. I'm shocked this lab has a difficulty of 8. The IP core is easy and the l3vpn core is a basic mutli-as option 1 configuration.
About the only difficult step of the entire lab is a multicast vpn task involving multiple mdt's. The problem with this task though is it is buggy as well and difficult to verify. I couldn't get things up even though my config seemed to match the solutions guide. So I'll deduct 5 points for that task, plus the testing task since my pings failed.
Final score 95/100
Now to be clear, I think the INE labs are great labs. I think for the most part they're well put together and cover the wide range of topics well. The problem is they're just too easy for the most part. I didn't remember very much of this lab from the last time I completed in in February, yet it wasn't nearly as complex as the IPX labs.
On to IPX lab 3 tomorrow. 4 days until the real thing.
Sunday, June 21, 2009
Friday, June 19, 2009
IPX Vol 2 Lab 2
Lan and Wan:
PPP address assignment: peer default address
-1 VTP Transparent saves the vlan information in the config
-1 load-interval controls collection rate (drew a blank on this one...I typically know it)
IS-IS and OSPF:
-3 advertise passive-only to only advertise isis passive interfaces in IS-IS
-3 lsp-mtu changes the lsp size. I can't believe I couldn't find this one, it was right in front of me.
BGP:
-3 forgot maximum-paths ibgp
MPLS:
No issues
Multicast:
-4 ip multicast multipath allows for load splitting in multicast
MPLS VPN:
No issues!!! This one was only inter-as option 2, so it wasn't so bad. I ran into a small issue becuase my next-hop-self's weren't set. But once I got that fixed, there wasn't a problem. The thing to keep in mind about option 2 is there are 3 separate mpls domains:
PE----AS1P-----AS2P----PE
1 2 3
MPLS labels must be flooded across the entire domain, so send-lables or ldp must be running between AS1P and AS2P.
But unlike Option 3, in Option 2 AS1P and AS2P DO understand the VPN label. So the top label can be popped and a lookup on the vpn label can occur. Therefore, there are actually more lookups on the VPN label, but this greatly simplifies configuration (for me anyway!).
Multicast VPN:
No issues
QoS:
-2 I'm using Dynamips and the first task is 3550 specific. I probably would have missed the second subtask, so I'm taking off for it.
IOS Services:
-2 missed the snmp ifmib ifalias long knob
Total Score: 81/100 Passed! (Barely)
Strangely, this lab was much easier than the first one. There really weren't too many "gotcha's" here and the vpn and multicast configs were rather painless.
PPP address assignment: peer default address
-1 VTP Transparent saves the vlan information in the config
-1 load-interval controls collection rate (drew a blank on this one...I typically know it)
IS-IS and OSPF:
-3 advertise passive-only to only advertise isis passive interfaces in IS-IS
-3 lsp-mtu changes the lsp size. I can't believe I couldn't find this one, it was right in front of me.
BGP:
-3 forgot maximum-paths ibgp
MPLS:
No issues
Multicast:
-4 ip multicast multipath allows for load splitting in multicast
MPLS VPN:
No issues!!! This one was only inter-as option 2, so it wasn't so bad. I ran into a small issue becuase my next-hop-self's weren't set. But once I got that fixed, there wasn't a problem. The thing to keep in mind about option 2 is there are 3 separate mpls domains:
PE----AS1P-----AS2P----PE
1 2 3
MPLS labels must be flooded across the entire domain, so send-lables or ldp must be running between AS1P and AS2P.
But unlike Option 3, in Option 2 AS1P and AS2P DO understand the VPN label. So the top label can be popped and a lookup on the vpn label can occur. Therefore, there are actually more lookups on the VPN label, but this greatly simplifies configuration (for me anyway!).
Multicast VPN:
No issues
QoS:
-2 I'm using Dynamips and the first task is 3550 specific. I probably would have missed the second subtask, so I'm taking off for it.
IOS Services:
-2 missed the snmp ifmib ifalias long knob
Total Score: 81/100 Passed! (Barely)
Strangely, this lab was much easier than the first one. There really weren't too many "gotcha's" here and the vpn and multicast configs were rather painless.
Wednesday, June 17, 2009
IPExpert SP Volume 2 Lab 1
Layer 2:
-2 Needed to set dlci to ietf encap as well
-3 Forgot to disable inverse arp
ISIS:
No issues, other than a few attributed to poor wording a proctor would be able to clarify. Not deducting points...
OSPF:
-3 Missed ISIS configuration
BGP:
No issues...
Internet Access:
No issues
MPLS:
-3 Lots of issues dealing with TE tunnels. Wow, just when I think I have these down, they throw a big curve ball at me. So when doing multi-area OSPF, explicit paths can only be set via loose mode.
mBGP:
No issues
L3VPN:
I FINALLY got inter-as vpnv4 multihop to work!!! Yes, it still took me forever. To the point where I had to sleep on it for a bit. But it actually does work! Sleeping on it during the lab may not be possible though...:).
Here's a little checklist. I'll try it out on the next lab to see how it goes:
1. From the CE router, verify a route exists through the PE router
2. At the PE router, verify a bgp vpnv4 route exists, with a next-hop of a remote PE router
3. At the PE router, verify a label exists for the next-hop, either via sh ip bgp labels or sh mpls for
4. If things appear to be configured correctly, clear mpls ldp neigh *, clear ip bgp * soft, or even reload
Multicast and IOS Services:
Reviewed
Ok, for lab 1, this thing sure was tough! On thing I definitely have to say about the IPX labs is you cannot take getting the IGP and MPLS stuff up for granted. The IE labs tended to throw a pretty vanilla IGP config at you and focus the rest at complex vpn scenarios. But IPX throws a lot of curveballs early on, and not only do you have to figure them out, but you have to adapt the VPN configs around them.
If I were to recommend a study approach, I'd probably suggest something like this:
1. IE CoD
2. IE Vol 1
3. IPX Vol 3 Labs 1-4
4. IE Vol 2 Labs 1-5
5. IPX Vol 2
6. IE Vol 2 Labs 6-10, IPX Vol 3 Lab 5
-2 Needed to set dlci to ietf encap as well
-3 Forgot to disable inverse arp
ISIS:
No issues, other than a few attributed to poor wording a proctor would be able to clarify. Not deducting points...
OSPF:
-3 Missed ISIS configuration
BGP:
No issues...
Internet Access:
No issues
MPLS:
-3 Lots of issues dealing with TE tunnels. Wow, just when I think I have these down, they throw a big curve ball at me. So when doing multi-area OSPF, explicit paths can only be set via loose mode.
mBGP:
No issues
L3VPN:
I FINALLY got inter-as vpnv4 multihop to work!!! Yes, it still took me forever. To the point where I had to sleep on it for a bit. But it actually does work! Sleeping on it during the lab may not be possible though...:).
Here's a little checklist. I'll try it out on the next lab to see how it goes:
1. From the CE router, verify a route exists through the PE router
2. At the PE router, verify a bgp vpnv4 route exists, with a next-hop of a remote PE router
3. At the PE router, verify a label exists for the next-hop, either via sh ip bgp labels or sh mpls for
4. If things appear to be configured correctly, clear mpls ldp neigh *, clear ip bgp * soft, or even reload
Multicast and IOS Services:
Reviewed
Ok, for lab 1, this thing sure was tough! On thing I definitely have to say about the IPX labs is you cannot take getting the IGP and MPLS stuff up for granted. The IE labs tended to throw a pretty vanilla IGP config at you and focus the rest at complex vpn scenarios. But IPX throws a lot of curveballs early on, and not only do you have to figure them out, but you have to adapt the VPN configs around them.
If I were to recommend a study approach, I'd probably suggest something like this:
1. IE CoD
2. IE Vol 1
3. IPX Vol 3 Labs 1-4
4. IE Vol 2 Labs 1-5
5. IPX Vol 2
6. IE Vol 2 Labs 6-10, IPX Vol 3 Lab 5
Thursday, June 11, 2009
IPExpert SP Volume 3 Lab 5
Layer 2:
-4 VTP version 2 is required for a transparent mode switch to forward VTP messages that have not been authenticated.
BGP:
-4 BGP Advertisement interval is different from bgp scan interval
MPLS:
-4 I need a better understanding on targeted hellos
VPN:
Lots of stuff going on here, but no major issues
VPN across non-MPLS core:
Well, as usual I was having issues getting this part working. I REALLY need to get this down before I sit for the lab. I found the underlying issue which was my label switch path was broken at the first intermediary AS router. No matter what I did, I couldn't seem to get it working. Then after WAY too much time troubleshooting, it dawned on me that I had a route map configured and have to set mpls labels on the route-map. Unfortunately once I did this the label still wasn't showing up in the forwarding table, even though it now showed up properly in the bgp labels. I tried to do a reboot and for some reason my configuration did not come back :(.
So I have to write this one off as a failure. I'll definitely need to repeat it before I sit on the 26th. I won't be getting much studying in the next few days because I have family visiting.
-4 VTP version 2 is required for a transparent mode switch to forward VTP messages that have not been authenticated.
BGP:
-4 BGP Advertisement interval is different from bgp scan interval
MPLS:
-4 I need a better understanding on targeted hellos
VPN:
Lots of stuff going on here, but no major issues
VPN across non-MPLS core:
Well, as usual I was having issues getting this part working. I REALLY need to get this down before I sit for the lab. I found the underlying issue which was my label switch path was broken at the first intermediary AS router. No matter what I did, I couldn't seem to get it working. Then after WAY too much time troubleshooting, it dawned on me that I had a route map configured and have to set mpls labels on the route-map. Unfortunately once I did this the label still wasn't showing up in the forwarding table, even though it now showed up properly in the bgp labels. I tried to do a reboot and for some reason my configuration did not come back :(.
So I have to write this one off as a failure. I'll definitely need to repeat it before I sit on the 26th. I won't be getting much studying in the next few days because I have family visiting.
Tuesday, June 9, 2009
IE SP Vol 2 Lab 2
Ok, change of page--I decided to attack IE vol 2 lab 2 again.
Layer 2:
No issues, not even with PPPoE--yay!
IGP:
No issues
BGP:
No issues
MPLS:
No issues
VPN:
Ahhh, now here was a nice complicated VPN scenario. Not too many tricks up their sleeves, but i definitely had to do some thinking.
Send-labels was not required, even though the two ASs weren't running MPLS. This is because the vpnv4 routers were back to back so an ipv4 lookup was possible at each AS edge router. Now if the AS edge routers weren't vpnv4 routers, they wouldn't understand the vpn tag and would have dropped the packet. If that were the case, send-labels (and next-hop-unchanged) would have been necessary.
I had a little bit of an issue with VRF Internet Access, but I eventually got it worked out. A stupid mistake where I did "ip nat source" instead of "ip nat inside source".
Finally, the solutions guide used an export map which sets bgp communities and then filters them on the PE routers to filter the management interfaces. Ugh, I thought that was an ugly method. I went with an import map that just filtered the ips out on the PEs without having to mess with communities.
Multicast:
They went with a tunnel, but my mdt worked just fine too.
QoS:
I just couldn't get mpls marking to work. I tried topmost and imposition, and verified the packets were getting marked on their way out, but the never showed up as marked on the other side. The solutions agreed wtih my first method. I'm gonna write this off as a dynamips frame switch issue.
I'm just going to review the rest of the lab since I pretty much know how to do these. Besides, the Management and Services section is more of an easter egg hunting than experience anyway.
Final thoughts: No real issues on the lab at all.
Layer 2:
No issues, not even with PPPoE--yay!
IGP:
No issues
BGP:
No issues
MPLS:
No issues
VPN:
Ahhh, now here was a nice complicated VPN scenario. Not too many tricks up their sleeves, but i definitely had to do some thinking.
Send-labels was not required, even though the two ASs weren't running MPLS. This is because the vpnv4 routers were back to back so an ipv4 lookup was possible at each AS edge router. Now if the AS edge routers weren't vpnv4 routers, they wouldn't understand the vpn tag and would have dropped the packet. If that were the case, send-labels (and next-hop-unchanged) would have been necessary.
I had a little bit of an issue with VRF Internet Access, but I eventually got it worked out. A stupid mistake where I did "ip nat source" instead of "ip nat inside source".
Finally, the solutions guide used an export map which sets bgp communities and then filters them on the PE routers to filter the management interfaces. Ugh, I thought that was an ugly method. I went with an import map that just filtered the ips out on the PEs without having to mess with communities.
Multicast:
They went with a tunnel, but my mdt worked just fine too.
QoS:
I just couldn't get mpls marking to work. I tried topmost and imposition, and verified the packets were getting marked on their way out, but the never showed up as marked on the other side. The solutions agreed wtih my first method. I'm gonna write this off as a dynamips frame switch issue.
I'm just going to review the rest of the lab since I pretty much know how to do these. Besides, the Management and Services section is more of an easter egg hunting than experience anyway.
Final thoughts: No real issues on the lab at all.
Sunday, June 7, 2009
IPExpert SP Volume 3 Lab 4 Complete
Layer 2:
No issues
IGP:
I've never heard of isis mesh-groups before. From the task, it sounded like a split-horizon type of technology, and that's exactly what it does. In essence, don't flood a route out a mesh-group interface if you received the route from another interface in that mesh group.
-2
BGP:
No issues
Multicast:
Messed up MSDP AGAIN!!! Ugh, I was so close this time. I spent some time verifying and was able to see the packets flowing, but they were getting stopped due to null output interface. No RPF issues and the loopbacks were running pim, so I couldn't figure it out. Turns out the external peer didn't have an RP, so the sa cache was empty on the inside peer. Once I statically made the external peer an RP, the internal peer's sa cache populated and pings went through.
-3
MPLS:
No issues
L2/L3 VPN:
The basic VPN topology is still way too simple. No issues until the end when I got to the L2 part. I never would have dreamed of encapsulating a q-in-q tunnel inside of l2vpn--very cool!
I cheated and used a vlan other than 49 instead, so -2 for breaking the rules of one of the tasks.
QoS and Security:
Blew setting DSCP for RSVP
-3
Lots of really ambiguous working on the other tasks in this section. I would have been able to ask a proctor for clarification if this were real, so I'm not deducting points. On two tasks, I chose the wrong option.
Management:
Chose the wrong banner. More ambiguity. I'll take these points off though. -2
Wrong telnet config, -2
Wrong interface buffer config, -2
Lab complete, 86%
The lab definitely got more complicated this time. The VPN is still a bit on the easy side, but everything else is about right now. A lot of ambiguity that I probably could have got points on with a proctor to talk to.
Speed is good too. Total time was 6 hours, with quite a few short breaks.
No issues
IGP:
I've never heard of isis mesh-groups before. From the task, it sounded like a split-horizon type of technology, and that's exactly what it does. In essence, don't flood a route out a mesh-group interface if you received the route from another interface in that mesh group.
-2
BGP:
No issues
Multicast:
Messed up MSDP AGAIN!!! Ugh, I was so close this time. I spent some time verifying and was able to see the packets flowing, but they were getting stopped due to null output interface. No RPF issues and the loopbacks were running pim, so I couldn't figure it out. Turns out the external peer didn't have an RP, so the sa cache was empty on the inside peer. Once I statically made the external peer an RP, the internal peer's sa cache populated and pings went through.
-3
MPLS:
No issues
L2/L3 VPN:
The basic VPN topology is still way too simple. No issues until the end when I got to the L2 part. I never would have dreamed of encapsulating a q-in-q tunnel inside of l2vpn--very cool!
I cheated and used a vlan other than 49 instead, so -2 for breaking the rules of one of the tasks.
QoS and Security:
Blew setting DSCP for RSVP
-3
Lots of really ambiguous working on the other tasks in this section. I would have been able to ask a proctor for clarification if this were real, so I'm not deducting points. On two tasks, I chose the wrong option.
Management:
Chose the wrong banner. More ambiguity. I'll take these points off though. -2
Wrong telnet config, -2
Wrong interface buffer config, -2
Lab complete, 86%
The lab definitely got more complicated this time. The VPN is still a bit on the easy side, but everything else is about right now. A lot of ambiguity that I probably could have got points on with a proctor to talk to.
Speed is good too. Total time was 6 hours, with quite a few short breaks.
Saturday, June 6, 2009
Study Schedule
Here is my study schedule up to the lab date:
6/7-8: IPX Vol 3 Lab 4
6/9-10: IPX Vol 3 Lab 5
6/11-12: IPX Vol 2 Lab 1
6/13-14: IPX Vol 2 Lab 2
6/15-16: IPX Vol 2 Lab 3
6/17-18: IPX Vol 2 Lab 4
6/18-19: IPX Vol 2 Lab 5
6/20: INE Vol2 Lab 2
6/21: INE Vol2 Lab 3
6/22-23: INE Vol2 Lab4
6/24: INE Vol2 Lab5
6/25: INE Vol2 Lab6
Hopefully that will do the trick. There are two pieces I really need to focus on. First is Multi-AS MPLS VPNs, I always have a really tough time spotting the issues and getting them up.
Second is vpn multicast in general, especially msdp and mdt verification. It's usually some stupid mistake preventing me from getting them up and running.
6/7-8: IPX Vol 3 Lab 4
6/9-10: IPX Vol 3 Lab 5
6/11-12: IPX Vol 2 Lab 1
6/13-14: IPX Vol 2 Lab 2
6/15-16: IPX Vol 2 Lab 3
6/17-18: IPX Vol 2 Lab 4
6/18-19: IPX Vol 2 Lab 5
6/20: INE Vol2 Lab 2
6/21: INE Vol2 Lab 3
6/22-23: INE Vol2 Lab4
6/24: INE Vol2 Lab5
6/25: INE Vol2 Lab6
Hopefully that will do the trick. There are two pieces I really need to focus on. First is Multi-AS MPLS VPNs, I always have a really tough time spotting the issues and getting them up.
Second is vpn multicast in general, especially msdp and mdt verification. It's usually some stupid mistake preventing me from getting them up and running.
Subscribe to:
Posts (Atom)
Posts
