Title:

Official Cert Guide: CCDA 640-864
Published: Jun 24, 2011
Pages: 768
ISBN-10: 1-58714-257-0
Category: Networking Technology
Covers: CCDA Certification
Authors: Anthony Bruno, CCIE; Steve Jordan, CCIE
Sample Content: Complete Chapter 4 and Index

Contents at a Glance:

Part I General Network Design

Chapter 1 Network Design Methodology

Chapter 2 Network Structure Models

Part II LAN and WAN Design

Chapter 3 Enterprise LAN Design

Chapter 4 Data Center Design

Chapter 5 Wireless LAN Design

Chapter 6 WAN Technologies

Chapter 7 WAN Design

Part III The Internet Protocol and Routing Protocols

Chapter 8 Internet Protocol Version 4

Chapter 9 Internet Protocol Version 6

Chapter 10 Routing Protocol Characteristics, RIP, and EIGRP

Chapter 11 OSPF, BGP, Route Manipulation, and IP Multicast

Part IV Security, Convergence, Network Management

Chapter 12 Managing Security

Chapter 13 Security Solutions

Chapter 14 Voice and Video Design

Chapter 15 Network Management Protocols

Part V Comprehensive Scenarios and Final Prep

Chapter 16 Comprehensive Scenarios

Chapter 17 Final Preparation

Part VI Appendixes

Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Questions

Appendix B CCDA Exam Updates: Version 1.0

Appendix C OSI Model, TCP/IP Architecture, and Numeric Conversion

Glossary

Elements Available on the CD

Appendix D Memory Tables

Appendix E Memory Tables Answer Key

The Review:

I was thrilled to receive my copy of this text. I was anxious to refresh my long-expired CCDA, and on top of that, my new sought after Cisco Data Center Certification required that I possess a current CCDA. As if that were not enough, I am a big fan of the work of my long time Cisco Press colleague, Anthony Bruno.

This text did not dissapoint in any way shape or form. In fact, I was really glued to the “new” chapters. The more cutting edge design topics that are finally part of this exam, and this text:

• Data Center Design
• Wireless LAN Design
• IPv6
• Voice and Video Design

The text served as excellent preparation for the exam itself, especially in these “new” areas above. In fact, spending time with ALL of the resources in the text and on the CD-ROM that accompanies the text, I think one might be a bit over-prepared for the exam. I will insert a caution here, however, since I might have drawn a more simple batch of exam questions, and I have been working with Cisco Design for well over a decade now.

Like other texts by Anthony Bruno, you should find this an easy read if you are at all interested in the subject matter. For those of you setting your sites on the exam, be absolutely certain that you spend time with the practice exams on the CD-ROM as a way to gauge your readiness.

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

I was actually 15 minutes late for one of my attempts. In fact, ironically enough, it was the exam I passed! I still was a bit shocked and became a bit nervous when I got there and the receptionist told me that the exam doors were locked. She called back to the proctor and he did indeed let me in and show me to my desk.

You see I was so ready with my technology knowledge, my strategy, my psychology, and my physical-wellness, there was not a single doubt in my mind that I would pass. Even if I shorted myself a few minutes at the start. I was more concerned about staying in my normal morning routine – so I went for a run on the treadmill – and took off for a really great breakfast.

For you first time test takers – be sure to get to the exam neighborhood at least a day early – and go find the exact exam location. I am not suggesting that you merely find the Cisco campus, I am telling you go find the exact building the exam is administered from. Some of the campuses are immense, and it is not good enough just to find the campus.

Also, I had a student of mine arrive an hour late once, because they just based the start time off of the previous start time when they had a former attempt. The candidate should have checked their email instructions received from Cisco to see that at that center, they had moved up the starting time by one hour!

Another tragic student story was relying on a shuttle bus driver from the hotel. Sure enough the shuttle bus driver could not find Cisco, and then once he finally did, he could not find the correct building!

Show up to your exam 15 minutes before the published start time. It will be a great way to start your day!

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

There are many reasons why these technologies are not widely used it and I will touch on some of them in appropriate sections, but major reasons are (in)security and relative complexity. Since these technologies are in their nature oriented towards network service providers and they tend not to like complexity and especially trusting other networks, it’s easily understood why there are not many applications in real life.

The foundation for this text is laid out in RFC 4364, section 10.

The RFC details three different ways in which two (or more) carriers can interconnect their networks in order to provide end-to-end VPN service for their customer(s). These are widely known as “Option A”, “Option B” and “Option C”. Of course, some of these can be implemented in several ways and I will point that out in due time. However, I would like to immediately split “Option C” into “Option C-1″ and “Option C-2″.

Option A

“Option A”, sometimes also known as back-to-back VRF is by far the simplest solution. Essentially, Carrier 1 will connect to Customer site 1 from a PE router and create VRF. Similarly, Carrier 2 will connect to Customer site 2 from their PE router and create VRF. PE-CE routing is not really relevant and can be anything. Interconnection between carriers will be implemented using dedicated interface (or a subinterface if more such VPN’s are delivered) in their respective VRF’s. Like I mentioned, this is the simplest and possibly the most common form. There are virtually no security or complex implications, as two carriers can treat each other as just another customer connection. Refer to the diagram below for illustration.

Option B

“Option B” is slightly more complex and requires “MPLS interconnection” between service providers. I.e. border routers (dubbed, as one may expect, Autonomous System Border Routers – ASBR) need to exchange labels for given prefixes. These prefixes are Loopback interfaces of PE nodes that VPN is connected to. Labels are usually exchanged using BGP (bgp send-label), which automatically enables MPLS forwarding on the interface. I will visit this in more detail later. What happens within single AS is interesting. Sometimes, these routes are redistributed in IGP and sometimes, iBGP is used for label distribution. Diagram below illustrates this variant.

Option C

“Option C” is, probably, the most complex of the three. Labels are not exchanged between ASBR’s using direct BGP session, but there is MPLS forwarding on the link. Usually using LDP, but other options (RSVP) can be used. PE’s, of course, need to know about each other’s labels, so it’s important that they exchange their labels. This can be done directly between two PE’s in what I call “Option C-1″, or alternatively, eBGP session between route reflectors can be used. The important thing to note here is that in order for this solution to work, one aspect of BGP needs to be “adapted”. In a case of eBGP session, next-hop attribute on received prefixes is replaced with the IP address of the BGP neighbor. This is perfectly fine for IP forwarding, but it will break MPLS. In this case, eBGP session needs to leave next-hop as-is, or as Cisco says, “bgp next-hop-unchanged”. I will address this in the implementation post. For now, consult the diagrams below for “Option C-1″ and “Option C-2″, respectively.

This article was originally posted on my personal blog on August 19, 2009. It is reproduced here with permission.

–
Marko Milivojevic – CCIE #18427
Senior Technical Instructor – IPexpert
Join our Online Study List

Print Friendly

As it is usually the case, those of us working with service providers and carriers are usually left out of the whole thing with, comparably, very little options. Some of the large carriers and content providers are going over multi-month/multi-year projects of redesigning their networks to support IPv6. The challenge is not a small one. Those who run OSPF is IGP are having hard time. The process, probably, calls for OSPFv3 deployment and with protocol changing over time, it’s no easy task. Not to mention that running IPv4 OSPF and IPv6 OSPF essentially means two topologies and higher complexity. Natural workaround for this is to use IS-IS and that may mean higher learning curve for operators used to OSPF.

One, largerly overlooked approach for enabling IPv6 in SP networks is concept outlined in RFC4798 titled “Connecting IPv6 Islands over IPv4 MPLS Using IPv6 Provider Edge Routers”, which is an easy way to enable IPv6 over an existing IPv4+MPLS backbone. Of course, some may even today be scared of MPLS, but I will assume in further text that it is not the case. Enabling MPLS in existing IPv4 networks should be relatively painless.

Before I dive into implementation details, few notes. In order to be good netizen, all IPv4 addresses in examples are RFC3330 friendly and IPv6 addresses are generated with guidance from RFC4193. BGP AS numbers are, similarly, friendly with RFC1930.

The setup for our story is Internet provider with AS number AS65123. It has an MPLS network with two PE and one P router, with OSPF as IGP. This provider is connected to two upstream carriers for IPv6 – ISP1 (AS65001) and ISP2 (AS65002). Downstream customer, CE (AS65003), wants IPv6 transit from AS65123. Easy enough. Let’s look at the diagram.

Allow me to skip over “basic” configuration of IGP and MPLS. Briefly, do the following:

• Configure OSPF area 0 on all IPv4 interfaces in AS65123
• Enable MPLS LDP on all IPv4 interfaces in AS65123

After you have finished that, you should be able to ping between Loopback0 interfaces on PE1 and PE2.

• Enable unicast IPv6 routing (ipv6 unicast-routing) on PE1, PE2, ISP1, ISP2 and CE
• Enable IPv6 CEF (ipv6 cef) on PE1 and PE2 – you should do this on all IPv6 routers…
• Configure IPv6 on appropriate interfaces on all IPv6 routers (ipv6 address …)

At this point, let’s configure IPv6 BGP between CE and PE2.

CE:

router bgp 65003
 no bgp default ipv4-unicast
 neighbor FD41:5A1C:1A2D:3EB7::2 remote-as 65123
 !
 address-family ipv6
  no synchronization
  network FD99:8649:B59D:420C::/64
  neighbor FD41:5A1C:1A2D:3EB7::2 activate
 exit-address-family
!

To make things more fun, we’ll configure PE2 to announce only default route to CE:

PE2:

pv6 prefix-list default-only seq 10 permit ::/0
route-map CE-out permit 10
 match ipv6 address prefix-list default-only
!
router bgp 65123
 no bgp default ipv4-unicast
 neighbor FD41:5A1C:1A2D:3EB7::CE remote-as 65003
 !
 address-family ipv6
  no synchronization
  neighbor FD41:5A1C:1A2D:3EB7::CE activate
  neighbor FD41:5A1C:1A2D:3EB7::CE default-originate
  neighbor FD41:5A1C:1A2D:3EB7::CE route-map CE-out out
 exit-address-family
!

Similarly to the configuration above, proceed and configure BGP sessions between PE1 and ISP1 & ISP2.

PE1:

router bgp 65123
 no bgp default ipv4-unicast
 neighbor FDA5:2072:2864:A05C::11 remote-as 65001
 neighbor FDCD:1D34:16C6:800B::22 remote-as 65002
 !
 address-family ipv6
  neighbor FDA5:2072:2864:A05C::11 activate
  neighbor FDCD:1D34:16C6:800B::22 activate
 exit-address-family
!

ISP1:

router bgp 65001
 no bgp default ipv4-unicast
 neighbor FDA5:2072:2864:A05C::1 remote-as 65123
 !
 address-family ipv6
  network FDD2:D801:3D4D:3446::/64
  neighbor FDA5:2072:2864:A05C::1 activate
 exit-address-family
!

ISP2:

router bgp 65002
 no bgp default ipv4-unicast
 neighbor FDCD:1D34:16C6:800B::1 remote-as 65123
 !
 address-family ipv6
  network FDB7:802D:4A6F:741B::/64
  neighbor FDCD:1D34:16C6:800B::1 activate
 exit-address-family
!

We now have two IPv6 islands that can’t communicate. One island consists of ISP1, ISP2 and PE1, while the other consists of PE2 and CE.

To connect these two islands, we could enable IPv6 routing in AS65123 using OSPFv3, or we can implement 6PE feature. At this point in the configuration, enabling 6PE is very easy. We need to enable IPv6 peering between Loopback0 interfaces on PE1 and PE2 and make sure that they exchange MPLS labels for advertised prefixes. Careful reader will notice that neither PE1 nor PE2 have IPv6 addresses on Loopback0 interfaces. That’s of no importance, in fact, that’s a feature. Remember that we are implementing IPv6 over IPv4+MPLS backbone. Here we go.

PE1:

router bgp 65123
 neighbor 192.168.0.2 remote-as 65123
 neighbor 192.168.0.2 update-source Loopback0
 !
 address-family ipv6
  neighbor 192.168.0.2 activate
  neighbor 192.168.0.2 next-hop-self
  neighbor 192.168.0.2 send-label
!

PE2:

router bgp 65123
 neighbor 192.168.0.1 remote-as 65123
 neighbor 192.168.0.1 update-source Loopback0
 !
 address-family ipv6
  neighbor 192.168.0.1 activate
  neighbor 192.168.0.1 next-hop-self
  neighbor 192.168.0.1 send-label
!

At this point, pinging between Loopback6 on CE and Loopback6 interfaces on ISP1 and ISP2 should work like a charm. Due to space constraints, I’ll skip that here.

This is a very neat, simple and straightforward solution for service providers who wish to enable IPv6 in their MPLS networks without added complexity of actually running IPv6 backbone.

If you would like to test this for yourself and examine full configurations, you can get GNS3/Dynagen NET file, diagram and configurations here.

This article was originally posted on my personal blog on August 9, 2009. It is reproduced here with permission.

–
Marko Milivojevic – CCIE #18427
Senior Technical Instructor – IPexpert
Join our Online Study List

Print Friendly

The format is still being worked out, but will closely resemble something like: “Respond to an RFP (or come up with some sort of design) and then defend it technologically, economically, and politically within your organization before a panel of Cisco Engineers (possibly a Cisco Distinguished Engineer).

Possibly more importantly is the statement that soon the CCDE will be a requirement for some Cisco Partners …. now how soon? for which partners? for which specializations? Those are all questions to be sorted. But for the time, certainly interesting to know that is most probably coming down the pike at some point.

More updates from Cisco Networkers to come – stay tuned!

Cheers,

Mark Snow

Print Friendly

Well, below are some screenshots taken of what appears to be a slip on the part of the web developers for the Cisco Learning Network Portal site, which by the time you read this and click on it – may very well have been taken off. But I am sure the first hundred or so folks that read this blog and click on it will be able to verify that it was there. UPDATE: Link Taken Down!! That didn’t take long (like within 5 minutes of my posting this). Something is afoot!

(Forgive the break in the picture – I had to scroll down to get the whole site to show it was actually the real site :))

Of particular curiosity is this “Expert” section:

And when we click on it? – Well of course:

Stay tuned to this blog where we will be blogging and tweeting live from Cisco Live! – Networkers.

Gentlemen (and Ladies), let the rumor mill begin!

Cheers!

-Mark

Print Friendly

Over the past 13 years, Ryan has passed three CCIE labs (CCIE #5924), holding certifications in Routing and Switching, SNA/IP Integration, and Security. He is also a MCSE with experience as a COBOL and C programmer and holds a Bachelors degree in Business Administration (focused on Information Technology at Colorado Technical University).

Recently, Ryan earned the title as the worlds first CCDE (#20080001)

• Note #1: He passed on his first attempt.
• Note #2: He became the first CCDE in the world!

Not resting on his CCDE accomplishment, he is now studying for the CCIE Service Provider and CCIE Voice labs, while also hosting Austins Network Engineer Users Group.

Several weeks ago we asked for your questions pertaining to Ryan’s CCDE experience – and here are his answers.

Hey Ryan, Great job! What is your background in the IT industry? How much real-world experience do you have and what is your primary job function?

I have been in the IT industry since I graduated with my first Associates degree from a local community college in 1995. My degree was for programming, but I also studied their networking program, which at the time was Novel Netware. I have written a few small programs, but almost immediately went to work for Dell Computers doing server hardware support. During this time I learned a lot about hardware architectures specific to servers and achieved my Novel CNE and Microsoft MCSE (3.51) there. I got my first taste of Cisco networking at my next job. Following around the printer admin was boring, and when the Internet went down, I found myself wandering into the network room to see what was going on. The network folks were huddled around a Unix terminal trying to work on a router, but really didnt understand routing. I knew routing, but didnt know Cisco commands. Together we got it working and they moved me into their group. My first task was the configuration of a Cisco AS5300 for ISDN and analog dialin and dialout (via the remote reverse-telnet software). They gave me 3 days. Having never touched the stuff before and worried for my job I studied non-stop trying to get it to work. It took me a week and I had never learned more! After that I have done various jobs involving teaching, consulting, and network implementation. I have touched a great many of the available technologies from mainframe to 3G. Today I am a Senior Network Architect for Calence/Insight Networking. I do implementations as well as designs. I also mentor our other engineers as needed.

Well done on your accomplishment! My question is, what ratio would you say you require, “experience vs. reading the book list” to pass the practical exam?

The CCDE requires a significant knowledge base to draw from, requiring in a lot of case both book knowledge and experience. There are some things you are just not likely to learn in a book, and no one is likely to have tried everything. The key factor that differentiates the CCDE from other tests is that factual knowledge (no matter the source) is insufficient to pass the exam. Instead you must have the ability to creatively apply that knowledge to a unique situation. Critical thinking is as important as your ability to implement a best-practice design, since the customer (test) is likely to through business requirements into play that will cause you to deviate from a textbook design.

Hello Ryan, First… congratulations on your CCDE. I’d like to know what books you used to study. Also, do you have a recommended list of links from Cisco’s website or any other website(s)?

I read everything from Cisco Press that had the word design in the title and then some. During the initial phases of the beta process Cisco provided us with a draft blueprint and reading list. The reading list looked almost like any book having anything to do with Routing, Switching or service provider technologies that had ever been published. If I had to single out a favorite book it was Advanced IP Network Design. This book is currently out of print, because of its partial obsolescence. The same authors released Optimal Routing Design with a similar format and content streamlined a bit and updated. The thing I liked about these books was the why. I used the first one for my original CCIE back in 2000, and the updated one for the CCDE (written) in 2007. Understanding why you should do something or why something does or doesnt work is at the heart of how a network architect must think. You should be able to predict the behavior of protocols given a set of circumstances and that takes in-depth knowledge of those protocols, but more specifically their behaviors. Dont waste your time studying commands; instead study what kind of options a protocol has and how it does its job.

Hi Ryan, What has been your primary source of preparation to the practical CCDE exam? Thanks.

Since the CCDE was beta and no one had really seen it, options were limited to self-study of the recommended books and my experience. I also attended the sessions at Cisco Live! in both 2007 and 2008. I also closely looked at the blueprints and asked myself what could they possibly ask me about network management in a design context. I read any postings from Russ White on the Cisco Learning Network, and studied the format of the sample test posted in the documents section of the Cisco Learning Network.

Ryan, what was harder, the CCIE lab or the CCDE? If its the lab, what lab was the hardest for you?

Thats easy. I felt the CCDE was much harder. I had this desire to poke myself in the eye by the end of the test. The CCIE Lab has real equipment. Most questions you KNOW that you did it right or wrong almost instantly. I mean the route shows up at the other end or it doesnt, right? The CCDE questions can be open to interpretation. The authors have attempted to limit the possible answers, but since very few people would build a network the same way given the same constraints one must assume there is more than one correct answer. The lack of ability to know when you did something right, compounded by the test almost telling you did the previous question wrong (since some questions may build on previous ones) may be disheartening. If you allow the test to bring down your energy or confidence or you start second guessing yourself, your may not make it. Its shard to ignore bad signs (real or imagined) and continue to answer each question like it is the first one.

Hello Ryan. Thanks for taking time to answer our questions! I[d like to know what certification you will go after next.

Well, I will answer that in past tense. My company is doing a lot more wireless work, which I have had to participate in as well. To that end we were asked to take a look at CCNA Wireless, so I did. But I want to look at CCIE Service provider and/or voice. I had taken the voice written in July 2007, but put preparations for that on hold due to CCDE and a new job.

What do you think the most valuable certification is to have (out of any vendor out there)?

At the moment  CCDE unfortunately, the commercial recognition of the CCDE hasnt gotten to a high enough level to garner the pay and respect that CCIEs get (well outside the Cisco candidates community that is). Some of the most important ones to me, in no particular order are:

CISSP: A measure of how well one understands security concepts, not implementation.
CCIE: Technical competence installing and configuring hardware/software in their chosen track.

The value of a given certification is based on how many there are, how hard they are to get, and what the candidates chosen field is. Obviously CCIE isnt going to mean anything to a Linux system engineers career. VMware is up and coming as a certification and data center virtualization is a hot technology. I see a lot of people jumping into that one, but I dont like the official training class requirement to get it, since I dont have time to attend every training class out there, especially if I already have experience in something.

What is the next certification you’re going to tackle?

I will probably go for a different CCIE. I was going to help my wife by doing the VMware VCP with her, but I cant since I have not time/budget for the class at this time. Instead service provider is looking interesting, since we have a few ISPs as customers, and various local government entities use MPLS and optical technologies.

Ryan, Awesome job!!! Id like to know if people treat you differently. Also, did you know that you passed after you took the lab or did you think you failed?

Yes, I have noticed a bit of difference. Around my office nothing much changed. The announcement of my passing was met with congratulations for everyone, but everything else was business as usual. I guess that is because we have a pretty tight team as it is and we already draw off of each others skills. I have seen a bit more outside recognition which is nice, but different and taking a bit of adjustment on my part. I hope to handle it better than some others (locally) that I have seen in the lime light before, who strike me as arrogant and pretentious.

I didnt think I passed the test the first try. We had a lot of great minds at the test, all of which I hold in high regard. I never could have guessed the outcome. I am extremely proud but humbled at the same time. After the high energy of the test wore off, I certainly felt the doubt that seemingly conflicting questions and answers created.

Ryan, Was the CCDE practical harder than you thought it would be?

Not really. I had every expectation that it would be very difficult. Fortunately the sample questions were a great introduction to the format of the real exam.

Print Friendly

Our March newsletter is now available online. Topics Include:

• “CCIE Stimulus” Pricing for CCIE Lab Classes – ILT Starting at $2,999 and Self-Study End-to-End Programs starting at $999! (Payments Plans Also Available)
• Studying for the New Version 3 Voice or Version 3 Security Lab? We’ve Got Products Available NOW!
• IPexpert Announces CCENT, CCNA, CCNP, CCSP and CCVP Classroom Training Offerings
• Interested in the CCDE? Register for a CCDE Written Boot Camp Today!
• IPexpert’s End-to-End Self-Study Bundle – 3 Volumes of Lab Books w/ Detailed Solution Guides, Audio Lecture, 40+ Hours of VOD & 10 Hours of Video Solutions x 10 Labs – Only $999
• Are You Preparing For The Version 2.0 Voice Blueprint? If So, You Might Be Interested in This….
• Congratulations To…..

Print Friendly

Have you passed your CCDE written exam?  Individuals that have completed the written portion of the CCDE exam can register immediately to take the practical portion of the exam. The next CCDE practical exam is scheduled for Wednesday, February 11, 2009, in Chicago, Illinois, US and London, UK. The cost of the exam is $1,400USD.  Candidates must have passed the CCDE qualification exam prior to registration.

If you’re looking for great “inside info” (of course, without breaking of the NDA) – be sure to participate in the “Ask Ryan” initiative that we’re currently taking questions for!!

Print Friendly