[300-101] CCNP Route - here we go

negru_tudor

So just re-labbing these topics I started to realize how much stuff can slip by you if you don't refresh the topics:

- EIGRPv6 needs a "no shutdown" on the "ipv6 router eigrp X" in order to kick in

- With Named-EIGRP for IPv6 (address-family ipv6 unicast), A-L-L IPv6 interfaces are automatically enabled for EIGRP.
Use the "af-interface default" to "pacify" them all and do a "no passive" for the "af-interfaces" you need EIGRP to actively run on

- With Named-EIGRP for IPv6 you can totally disable EIGRP on an "af-interface" with the "shutdown" command

Fun times trying to get all of these stick and sink in for real..

Cisco Inferno

negru_tudor wrote: »

Absolutely but some of the Boson questions i got on these technologies (non routing protocol related) go very much into the weeds. So it's not enough to know why Netflow is used and how to turn it on.. You'll get asked questions on Flexible Netflow monitors, configuring them and how you'd diagnose them.

This is very cool stuff to learn and all (I'm all about learning new features if they're useful) but if Boson's ExSim is is somewhat of an accurate approximation of what the exam can throw your way, then anything goes I guess. Some of it seems pretty much like trivia

This is the same with ICND2. The boson exams made me realize how much I needed to brush up on things other than WAN/STP/EIGRP/OSPF. I was blown away at how much they were questioning things like SPAN, SNMP, IPv6 routing and other little things.

I thought this was stupid, but I kept studying those less known topics for exam 2 and 3.



The actual test did have those topics so im glad i studied them. Man a ton on ipv6 for eigrp.

negru_tudor

Cisco Inferno wrote: »

This is the same with ICND2. The boson exams made me realize how much I needed to brush up on things other than WAN/STP/EIGRP/OSPF. I was blown away at how much they were questioning things like SPAN, SNMP, IPv6 routing and other little things.

I thought this was stupid, but I kept studying those less known topics for exam 2 and 3.



The actual test did have those topics so im glad i studied them. Man a ton on ipv6 for eigrp.

IPv6 sure is a biggie. Just doing some labs on OSPFv3 and just looking up the "ospfv3 database" turns your world around especially if you're used to the IPv4 OSPF database layout / LSAs. Guess it takes some degree of practice until it all settles in but I'm not as comfy with it as I am with the OSPFv2 one. Improvement area spotted

I can definitely say that I'm a lot more comfy with IPv6 than I was before starting my ROUTE journey now so that in itself is a cool perk.

ROUTE has to be one of the most interesting things I've studied in the past years - reminds me of CVOICE (642-437) from CCNP Voice. I both dreaded and loved that exam. Still have fond memories of studying for it & learning the "plumbing" of VoIP much like with ROUTE now

negru_tudor

Doing some filtering labs now & (might be obvious to most people with a lot more background on the topic) but:

- only 1 "distribute-list" statement is allowed per direction (IN or OUT)

Goes for EIGRP, OSPF and RIP.. much like "infrastructure ACL"s where you can stick 1 ACL /interface/direction.

Kinda makes more sense why you would want to use route-maps when filtering stuff now that I think about it. More convenient to stick new criteria into route-maps for filtering etc.

EDIT: slightly wrong as you can stick in a more-specific distribute-list for an interface in the same direction. Example:

- "distribute-list 3 out"
- "distribute-list 5 out Gig 0/0"

They both have the same direction but 5 is more specific for Gig 0/0. It will also take precedence on what updates go out over Gig 0/0 (distribute-list 3 will not have any "saying" in this as 5 is more specific for Gig 0/0).

negru_tudor

Refreshing PBR:

- debug ip policy is your go-to tshoot cmd along with the show route-map X used for PBR (shows hits of interesting traffic if any occured)
- debug ip icmp good on the destination device to see if you're getting the traffic / pings (if you have access to the destination)
- traceroute as always is a friend indeed

Onwards and upwards!

negru_tudor

Doing NAT with NVI and found out that GNS3 routers have issues with NAT-ing their own local loopbacks.

If I use an Ethernet interface with a host PC hanging off it, the same NAT rule works wonders. Not if I use Loopbacks as the "source"..



My topology is at the bottom with the Ethernet interface instead of the loopback as the reference one.

negru_tudor

Been doing a bigger BGP lab and I was messing around with 2 iBGP edge peers that act as:

- SanJose3: Primary_INGRESS, Backup_EGRESS
- SanJose1: Backup_INGRESS, Primary_EGRESS

Diagram as follows:



I'm only advertising 2 blocks of addresses via BGP to the ISPs. Anything else is being NAT-ed and this is where the problem starts:

- packets always go out via SanJose1 so it will do the NAT-ing
- BGP path selection however, tells the carriers to route all Ingress traffic via the SanJose2 edge router
- when SanJose2 gets the ICMP replies, it drops them because it doesn't know what to do with them; SanJose1 did the NAT translation

Found a feature that might help with getting the 2 x NAT routers to synch their NAT translation tables in order to allow asymmetric traffic to work through NAT.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/15-mt/nat-15-mt-book/iadnat-b2b-ha.html

I'm still having a hard time understanding how to properly configure it though. Most of the examples I see, are using HSRP which doesn't apply to this design as the routers are not on the same L2 domain. Maybe GRE might help but not sure yet.

I guess it's overkill for ROUTE but finally found a reason to pay more attention into "asymmetric routing" issues and I guess this might be a very "real-life" scenario.

Very curious to see if I can get this working.

Welly_59

Way overkill for CCNP but fun none the less

Literally all you need for CCNP in regards to BGP is how to assign neighbour, and difference between external/internal and multihop.

negru_tudor

Welly_59 wrote: »

Way overkill for CCNP but fun none the less

Literally all you need for CCNP in regards to BGP is how to assign neighbour, and difference between external/internal and multihop.

I agree - I wouldn't have come across it though if i didn't do the Primary/Backup INGRESS/EGRESS split which kinda wacky - usually your primary egress point would be your primary ingress.

I know it's overkill but now that I came across it, it'll keep bugging me until I find a way to do it the older IOS versions used something called "stateful NAT" but that's no longer available on IOS 15 so the new "redundancy group" feature needs to be used.

Tried it with a GRE tunnel directly between the 2 routers, they "see" one another but the NAT tables don't synch up. Need to find a fix for it..

negru_tudor

Managed to get the old flavor of Stateful NAT (the old way of synch-ing NAT translation between peering routers) thanks to this blog post:

Jeff Kronlage's CCIE Study Blog: Stateful NAT with Asymmetric Routing

Works with both HSRP (edge routers sharing the same L2 domain) and with dynamic routing (edge routers on different subnets, no common L2 segment).

...the issue is that this "ip nat stateful" method is deprecated and doesn't work on the latest IOS versions and I haven't managed to get the new flavor working ...yet

Won't spend too much time on this for now. If time allows it, I'll revisit and try to make it work with on IOS 15.X

negru_tudor

Been doing some reviews and the notes I managed to grab are great stuff. However, I can't help but feel I've got some gaps on several items so when doing research I came across Chris Bryant's All-in-One CCNP course on udemy.com at a discounted price so pulled the trigger on that - also got his CCNA Security course for free lol tremendous value for the money.

Right now I'm :

- doing note reviews
- labing every single day
- going through Chris' ROUTE course for filling in gaps. I kinda like his style - a LOT. Don't know why I've been so oblivious to his stuff until now.

T-27 days.

negru_tudor

Digging a little deeper into EIGRP summary routes during my refresh run and came across the leak-map feature which is pretty simple but yet very cool.

Helps put in that absolute minimal summary route but still allow certain prefixes leak through if your summary touches networks that you don't necessarily own.

All it is is a route-map (using ACL or prefix-lists to "catch" interesting prefixes) that gets referenced when the summary route gets configured.

Cool stuff to know & leverage for real-world scenarios.

negru_tudor

Chris Bryant's course is great. Been going through his ROUTE stuff for my 2nd review; am on the topic of OSPF AREA TYPES aaand ..another gotcha:

- an area that has a VIRTUAL-LINK can't / isn't allowed to perform STUB routing

negru_tudor

Aand just finished Chris Bryant's course on ROUTE which also marks my 2nd review of these topics. I've been labing along with most of Chris' videos trying to follow along and get the concepts to sink in.

I also managed to use GNS3 appliances to set up a freeRADIUS server for AAA which is pretty cool along with getting a Docker instance running in GNS3 for CACTI to get SNMP monitoring a go with open-source tools.

Feeling a little bit burnt out but overall it was well worth it.

Items that I still need to review more closely:

- OSPFv3 LSA types
- IPv6 DHCP relay
- PPPoE
- Flexible NetFlow
- ICMP and ICMPv6 details
- URPF and CEF details

I'm going to give it a rest for the day / night. For this week, looking at:

- doing more labs
- reviewing the above topics and my notes
- take randomized Boson tests
- re-take the OCG quizes from the "Do I know this already?" section of each chapter

Kinda starting to feel worn out at this point; might do some BGP tomorrow to cheer up a little bit

negru_tudor

IPv6 DHCP relay all labed up now and working like a charm in GNS3. Got Windows7, Alpine Linux, Ubuntu and a Client Router getting IPv6 addresses via a relay without any hiccups.

Was struggling a little with getting pings out from Ubuntu until I read that Ubuntu uses ping6 for ICMP messages to IPv6 hosts. Talk about "need to get your Linux skills sharp boy"..

negru_tudor

Decided to move the exam date 1 week earlier so it's now booked for the 13th of February (same as when I took SWITCH last year). Been preparing for this since August last year & I feel it's about time to wrestle the beast.

Doing a final run through practice labs, notes and vids.

negru_tudor

...aaaand..moved it to the 5th due to how work's shaping up to be mid-month.

This is going to be a very interesting weekend.

negru_tudor

Boson seem to have an 18% off promo code on the Reddit CCNP forum https://www.reddit.com/r/ccnp/comments/7ujzpg/boson_18_off_promo_code_for_reddit/

If anybody's preparing for CCNP, their stuff might come in handy.

Cisco Inferno

hy negru im rooting for you man. I am going to make an awesome thread like this when I do other certs. Its alot better than a single post review.

negru_tudor

Cisco Inferno wrote: »

hy negru im rooting for you man. I am going to make an awesome thread like this when I do other certs. Its alot better than a single post review.

Thank you!

It does help when you see other kindred spirits following along and dropping in from time to time with suggestions, advice etc.

It's also very useful to come back to some "gotcha" items when I don't have my notebook with me

Will post back as soon as I've sat the exam. Hope I manage to pass it - don't need a 900 score lol - a little over the 790 mark will do

Hitting notes hard right now, doing Boson random tests, watching some INE vids (will re-watch Chris Bryant's stuff as well) and labing up most / as many topics as possible... Just did some "core ****" / "exceptions" in GNS3 1 hour ago and yeah, they work great.

negru_tudor

Stumbled across a very good / concise video for NetFlow:

https://www.youtube.com/watch?v=Qd_K95QUfGQ&index=1&list=PLi4_AmFcCMfZoZ0XUkROPTRT6DNaRsv4b

It covers basic theory along with config examples for NetFlow5,9 along with Flexible Netflow

negru_tudor

Been reviewing stuff for Monday and decided to lab up 2-Way Multipoint Redistribution + Tagging.



Even though R2 (smack in the middle) doesn't do redistribution, I still had to filter TAGs for OSPF routes coming in via EIGRP.

OSPF routes were piggy-backed into EIGRP (R1 & R3 doing redistribution).

R2 was trying to reach 172.45.0.0/24 , 172.35.0.0/24 and 172.14.0.0/24 by going all around the EIGRP domain and breaking out to the OSPF domain via R1 or R3.

...no issue with EIGRP routes (due to lower AD) but still did filtering just to be safe.

Guess another alternative, in this scenario, would be to do one-way redistribution on both R1 and R3 and just inject a default route in the other domain.

HappyBearIT

So R2 would be learning about 172.45.0.0/24 as a Intra-area route in OSPF with an AD of 110 from R4 and R5, and it would be learning about the same route from EIGRP via R1 and R3 due to the OSPF to EIGRP redistribution. Therefore, the 172.45.0.0/24 via EIGRP would have an AD of 170 for the external routes. Why was R2 preferring route s for this network with an AD of 170 over ones with an AD of 110? Or did I misread your scenario?

negru_tudor

HappyBearIT wrote: »

So R2 would be learning about 172.45.0.0/24 as a Intra-area route in OSPF with an AD of 110 from R4 and R5, and it would be learning about the same route from EIGRP via R1 and R3 due to the OSPF to EIGRP redistribution. Therefore, the 172.45.0.0/24 via EIGRP would have an AD of 170 for the external routes. Why was R2 preferring route s for this network with an AD of 170 over ones with an AD of 110? Or did I misread your scenario?

Nope, didn't misread - you're right. This is my fault. Thank you for glancing over it

I was using the "ip ospf network point-to-point" command on the Ethernet links but forgot to stick it on the Eth0/2 and Eth0/3 of R2. I was seeing R4 and R5 as DRs but these guys were Point-to-Point.

Managed to pinpoint that yesterday going by R4 & R5's messages of a network mismatch but never reviewed the routing table on R2 - just jumped the gun like a dumb a$$ and figured I needed to do filtering on R2 as well; the EX admin dist of 170 vs 110 of OSPF gave me the slip - I should know better.. Haste makes waste

Gonna try labing some more stuff up, re-reading notes and doing 1 or 2 Boson tests. I'd be happy to pass but I'm sure there's a high chance that I just bomb the freakin' thing tomorrow.

negru_tudor

T-16 hours. Been reading my notes and did 2 Boson ROUTE tests - passed both but by now, I feel like some of the questions I feel familiar with. Also been reading or watching material on:

- DMVPN
- sub-second convergence via BFD
- dynamic 6to4 (2002::/16) tunneling (spun up GNS3 to see this at work; had to use BGP 'cause these dynamic 6to4 tunnels don't like IGPs)
- Netflow
- TCP/UDP operation
- IPv6 and NDP/ICMPv6
- some PPPoE stuff

Not sure what else I can do right about now. I'm a little anxious but it'll all be better in the morning once I've had my coffee

negru_tudor

Just back from the testing center & we have ourselves a PASS!! but it was a very tough test & one sim was 100% bugged - no 2 ways about it.

The first bunch of questions were ok - went through them relatively quick until the 1st sim came along. It took me about 10 minutes to go through the requirements, wording and understand the topology and what was requested.
I eventually got it working exactly the way they asked for things but wasn't sure if there'd be any "specific" commands that had to show up in the config; used to Boson ExSim where if you don't get the config spot on to the tee, you don't get the points.

After the 1st sim, questions started to get harder - some of them went very deep into older tech that isn't necessarily on the ROUTE blueprint. As luck would have it, some of the CCNA notes I reviewed during ROUTE studies helped with this.

Some questions came in for tech that's a little more advanced than ROUTE so those had me read, re-read and try to recall stuff that I've been reading or watching vids on the side for, not necesarily in the ROUTE exam topics.

Then came the one sim that I swear was bugged. It had a config problem which was easy to spot from a mile away but it also had another very simple requirement which for God-knows-what reason did not take effect. I tried different approaches to this but no dice - left a "comment"/note for Cisco in case I needed to file in a complaint in case of failure.. at this point I was doubting I'll make it.

Overall I would say the questions don't go into trivia land (aside from the old tech stuff) and they're, more or less, what you'd expect a Network Engineer to know about - I admit, some of them I wasn't 100% sure; real-life, I'd open up google or tech notes / specs to find stuff up.

I'm not sure if this is against the NDA (if anybody else thinks otherwise, please let me know) but the breakdown would be as follows:

Overall score: 905/1000

- Network Principles: 50%
- Layer 2 Technologies: 67%
- Layer 3 Technologies: 89%
- VPN Technologies: 100%
- Infrastructure Security: 71%
- Infrastructure Services: 77%

It's a rough exam and it will test your patience and attention.

Chris Bryant's CCNP All-in-one udemy course and Boson ExSim are a MUST for anyone trying to nail ROUTE without any tricks; just blood, sweat and coffee

Good luck!

albinorhino187

Awesome job! I've been following along, you definitely earned it. I started route myself back in October, but my progress has taken a HUGE hit (thanks, life) so I'm barely halfway through Bryant's videos. Thanks for keeping me motivated.

negru_tudor

albinorhino187 wrote: »

Awesome job! I've been following along, you definitely earned it. I started route myself back in October, but my progress has taken a HUGE hit (thanks, life) so I'm barely halfway through Bryant's videos. Thanks for keeping me motivated.

It's a big load off my chest, I'll tell you that. Same thing happened to me from mid-October until late December... work absolutely ate up all my time and my formal studies got slowed down a little bit from what I felt they should have been.

Nevertheless, keep grinding and you'll get there - no doubts about it. It's hard but doable.

HappyBearIT

Nice work! Whats the plan for TSHOOT? Lab the real topology to become familiar, and then work the Boson Pre-Test for a week or two?

clarson

congrats

and for all the info on studying for the ccnp. I'm working that cert also.