CCIE Study Blog

CCNA: IP Addressing and Subnetting

2009-06-21T11:49:00.000+08:00

CCNA: Wireless LANs

2009-06-20T15:42:00.005+08:00

Wireless LAN Concepts
The wireless-capable customer laptops communicate with a WLAN device called an access
point (AP). The AP uses wireless communications to send and receive frames with the
WLAN clients (the laptops).

WLANs are similar to Ethernet LANs in many ways, the most important being that
WLANs allow communications to occur between devices.

IEEE deﬁnes standards for both, using the IEEE 802.3 family for Ethernet LANs and the 802.11 family for WLANs.

The biggest difference between the two lies in the fact that WLANs use radiated energy
waves, generally called radio waves, to transmit data, whereas Ethernet uses electrical
signals ﬂowing over a cable (or light on optical cabling).

Modes of 802.11 Wireless LANs
WLANs can use one of two modes—ad hoc mode or infrastructure mode.

Ad hoc mode, a wireless device wants to communicate with only one or a few other devices
directly, usually for a short period of time.

Infrastructure mode, each device communicates with an AP, with the AP connecting via
wired Ethernet to the rest of the network infrastructure. It allows the
WLAN devices to communicate with servers and the Internet in an existing wired network.

Infrastructure mode supports two sets of services, called service sets.
The ﬁrst, called a Basic Service Set (BSS), uses a single AP to create the wireless LAN.

The second Extended Service Set (ESS), uses more than one AP, often with overlapping cells to allow roaming in a larger area.
ESS WLANs allow roaming, which means that users can move around inside the coverage area and stay connected to the same WLAN.
All the device has to do is sense when the radio signals from the current AP are getting weaker; ﬁnd a new, better AP with a stronger or better signal; and start using the new AP.

Wireless Transmissions (Layer 1)
WLANs transmit data at Layer 1 by sending and receiving radio waves.
WLAN devices use a radio and its antenna to send and receive the radio waves, making small changes to the waves to encode data.
Similar to electricity on copper wires and light over optical cables, WLAN radio waves
have a repeating signal that can be graphed over time.

*Frequency (the number of times the waveform repeats per second), amplitude (the height of the waveform, representing signal strength), and phase (the particular point in the repeating waveform).

*Frequency, measured in hertz (Hz).

Wireless Encoding and Nonoverlapping DSSS Channels
When a WLAN NIC or AP sends data, it can modulate (change) the radio signal’s
frequency, amplitude, and phase to encode a binary 0 or 1.

Frequency Hopping Spread Spectrum (FHSS) uses all frequencies in the band, hopping
to different ones. By using slightly different frequencies for consecutive transmissions,
a device can hopefully avoid interference from other devices that use the same unlicensed band, succeeding at sending data at some frequencies. The original 802.11 -WLAN standards used FHSS, but the current standards (802.11a, 802.11b, and 802.11g) do not.

Direct Sequence Spread Spectrum (DSSS) followed as the next general class of encoding
type for WLANs. Designed for use in the 2.4 GHz unlicensed band, DSSS uses one of
several separate channels or frequencies. This band can have 11 different overlapping DSSS channels. Known as 802.11b.

The signiﬁcance of the nonoverlapping DSSS channels is that when you design an ESS
WLAN (more than one AP), APs with overlapping coverage areas should be set to use
different nonoverlapping channels.

In this design, the devices in one BSS (devices communicating through one AP) can send at the same time as the other two BSSs and not interfere with each other, because each uses the slightly different frequencies of the nonoverlapping channels. For example, PC1 and PC2 could sit beside each other and communicate with two different APs using two different channels at the exact same time. This design is typical of 802.11b WLANs, with each cell running at a maximum data rate of 11 Mbps. With the nonoverlapping channels, each half-duplex BSS can run at 11 Mbps, for a cumulative bandwidth of 33 Mbps in this case. This cumulative bandwidth is called the WAN’s capacity.

Orthogonal Frequency Division Multiplexing (OFDM). Like DSSS, WLANs that use OFDM can use multiple nonoverlapping channels. Known as 802.11a, 802.11g.

Wireless Interference
WLANs can suffer from interference from many sources.
The radio waves travel through space, but they must pass through whatever matter exists inside the coverage area, including walls, ﬂoors, and ceilings.

Passing through matter causes the signal to be partially absorbed, which reduces signal strength and the size of the coverage area.

One key measurement for interference is the Signal-to-Noise Ratio (SNR). This calculation
measures the WLAN signal as compared to the other undesired signals (noise) in the
same space. The higher the SNR, the better the WLAN devices can send data successfully.

Coverage Area, Speed, and Capacity
Weaker wireless signals cannot pass data at higher speeds, but they can pass data at lower speeds. A device near the AP may have a strong signal, so it can transmit and receive data with the AP at higher rates. A device at the edge of the coverage area, where the signals are weak, may still be able to send and receive data—although at a slower speed.

The main ways to increase the size of the coverage area of one AP are to use specialized
antennas and to increase the power of the transmitted signal.

Media Access (Layer 2)
The solution to the media access problem with WLANs is to use the carrier sense multiple access with collision avoidance (CSMA/CA) algorithm.

The collision avoidance part minimizes the statistical chance that collisions could occur. CSMA/CA does not prevent collisions, so the WLAN standards must have a process to deal with collisions when they do occur.

Because the sending device cannot tell if its transmitted frame collided with another frame, the standards all require an acknowledgment of every frame.

WLAN device listens for the acknowledgment, which should occur immediately after the frame is sent. If no acknowledgment is received, the sending device assumes that the frame was lost or collided, and it resends the frame.

Step 1 Listen to ensure that the medium (space) is not busy (no radio waves currently are
being received at the frequencies to be used).

Step 2 Set a random wait timer before sending a frame to statistically reduce the
chance of devices all trying to send at the same time.

Step 3 When the random timer has passed, listen again to ensure that the
medium is not busy. If it isn’t, send the frame.

Step 4 After the entire frame has been sent, wait for an acknowledgment.

Step 5 If no acknowledgment is received, resend the frame, using CSMA/CA
logic to wait for the appropriate time to send again.

Wireless LAN Implementation Checklist
Step 1 Verify that the existing wired network works, including DHCP services, VLANs,
and Internet connectivity.

Step 2 Install the AP and conﬁgure/verify its connectivity to the wired network, including the AP’s IP address, mask, and default gateway.

Step 3 Conﬁgure and verify the AP’s wireless settings, including Service Set Identiﬁer (SSID), but no security.

Step 4 Install and conﬁgure one wireless client (for example, a laptop), again with no security. With Microsoft operating systems, the wireless NIC may not need to be conﬁgured because
of the Microsoft Zero Conﬁguration Utility (ZCF). This utility, part of the OS, allows the
PC to automatically discover the SSIDs of all WLANs whose APs are within range on the NIC. The user can choose the SSID to connect to.

Step 5 Verify that the WLAN works from the laptop.

Step 6 Conﬁgure wireless security on the AP and client.

Step 7 Verify that the WLAN works again, in the presence of the security features.

Wireless LAN Security
The Cisco-authorized CCNA-related courses suggest several categories of threats:
■ War drivers: The attacker often just wants to gain Internet access for free. This person
drives around, trying to ﬁnd APs that have no security or weak security. The attacker can use easily downloaded tools and high-gain directional antennas.

■ Hackers: The motivation for hackers is to either ﬁnd information or deny services.

■ Employees: Employees can unwittingly help hackers gain access to the Enterprise network in several ways. An employee could go to an ofﬁce supply store and buy an AP for less than $100, install the AP in his ofﬁce, using default settings of no security, and create a small wireless LAN. This would allow a hacker to gain access to the rest of the Enterprise from the coffee shop across the street.

■ Rogue AP: The attacker captures packets in the existing wireless LAN, ﬁnding the SSID and cracking security keys (if they are used).

To reduce the risk of such attacks, three main types of tools can be used on a WLAN:
■ Mutual authentication
■ Encryption
■ Intrusion tools

Wired Equivalent Privacy (WEP)
WEP was the original 802.11 security standard, providing authentication and encryption
services. It provided only weak authentication and encryption.

The main problems were as follows:
■ Static Preshared Keys (PSK): The key value had to be conﬁgured on each client and
each AP, with no dynamic way to exchange the keys without human intervention.

■ Easily cracked keys: The key values were short (64 bits, of which only 40 were the
actual unique key).

Because of WEP’s problems, many vendors included a couple of security-related features
that are not part of WEP.

SSID cloaking, changes the process by which clients associate with an AP.
SSID cloaking is an AP feature that tells the AP to stop sending periodic Beacon frames.
Solve the problem with attackers easily and quickly ﬁnding all APs.

MAC address ﬁltering AP can be conﬁgured with a list of allowed WLAN MAC addresses, ﬁltering frames sent by WLAN clients whose MAC address is not in the list.

CCNA: Ethernet Switch Troubleshooting

2009-06-19T14:42:00.010+08:00

Verifying the Network Topology with Cisco Discovery Protocol
The proprietary Cisco Discovery Protocol (CDP) discovers basic information about
neighboring routers and switches without needing to know the passwords for the
neighboring devices.

CDP discovers several useful details from the neighboring Cisco devices:
■ Device identiﬁer: Typically the hostname
■ Address list: Network and data-link addresses
■ Local interface: The interface on the router or switch issuing the show cdp command
with which the neighbor was discovered
■ Port identiﬁer: Text that identiﬁes the port used by the neighboring device to send
CDP messages to the local device
■ Capabilities list: Information on what type of device it is (for instance, a router or a
switch)
■ Platform: The model and OS level running in the device

CDP can be enabled per interface using the no cdp enable interface subcommand. (The cdp enable interface subcommand re-enables CDP.)

The no cdp run global command disables CDP for the entire switch, with the cdp run global command re-enabling CDP globally.

Interface Status Codes and Reasons for Nonworking States
You can verify the interface status by show interface and show interface status.

Interface Speed and Duplex Issues
You can verify the speed and duplex status by show interface and show interface status.
The command output lists autonegotiated settings with a preﬁx of a-.
For example, a-full means full duplex as autonegotiated, whereas full means full duplex but as manually conﬁgured.

When the IEEE autonegotiation process works on both devices, both devices agree to the
fastest speed supported by both devices.

When one device has disabled autonegotiation, and the other device uses autonegotiation, the device using autonegotiation chooses the default duplex setting based on the current speed. The defaults are as follows:
■ If the speed is not known, use 10 Mbps, half duplex.
■ If the speed is somehow known to be 10 or 100 Mbps, default to use half duplex.
■ If the speed is somehow known to be 1000 Mbps, default to use full duplex.

*Finding a duplex mismatch can be much more difﬁcult than ﬁnding a speed mismatch, because if the duplex settings do not match on the ends of an Ethernet segment, the switch interface will still be in a connect (up/up) state.

To identify duplex mismatch problems, check the duplex setting on each end of the link,
and watch for incrementing collision and late collision counters

Common Layer 1 Problems on Working Interfaces
First, consider a couple of common reasons why Ethernet frames experience errors during
transmission. When an Ethernet frame passes over a UTP cable, the electrical signal may
encounter problems. The cable could be damaged, for example, if it lies under carpet. If
the user’s chair keeps squashing the cable, eventually the electrical signal can degrade.

Additionally, many sources of electromagnetic interference (EMI) exist; for example, a
nearby electrical power cable can cause EMI.

Regardless of the root cause, whenever the electrical signal degrades, the receiving device
may receive a frame whose bits have changed value. These frames do not pass the error
detection logic as implemented in the FCS ﬁeld in the Ethernet trailer.

Cisco switches list this error as a CRC error (cyclic redundancy check [CRC] is an older
term referring to the frame check sequence [FCS] concept).

Ethernet collision versus a late collision
Collisions occur as a normal part of the half-duplex logic imposed by CSMA/CD, so a switch interface with an increasing collisions counter may not even have a problem, all collisions should occur by the end of the 64th byte of any frame.

When a switch has already sent 64 bytes of a frame, and the switch receives a frame on that same interface, the switch senses a collision. In this case, the collision is a late collision, and the
switch increments the late collision counter.

Three common LAN problems can be found using these counters:
Excessive interference on the cable can cause the various input error counters to keep growing larger, especially the CRC counter. If the CRC errors grow, but the collisions counters do not, the problem may simply be interference on the cable.

Duplex mismatches and jabber can be partially identiﬁed by looking at the collisions
and late collision counters. Jabber refers to cases in which the NIC ignores Ethernet rules
and sends frame after frame without a break between the frames.

Incrementing late collisions counter typically means one of two things:
■ The interface is connected to a collision domain whose cabling exceeds Ethernet cable
length standards.
■ The interface is using half duplex, and the device on the other end of the cable is using
full duplex.

CCNA: Ethernet Switch Configuration

2009-06-18T14:49:00.007+08:00

Securing the Switch CLI
To reach a switch’s enable mode, a user must reach user mode either from the console or
from a Telnet or SSH session, and then use the enable command.

To reach enable mode from a vty (Telnet or SSH), the switch must be conﬁgured with
several items:
■ An IP address
■ Login security on the vty lines
■ An enable password

Configuring Usernames and Secure Shell (SSH)
Telnet sends all data, including all passwords entered by the user, as clear text.
SSH encrypts the data sent between the SSH client and the SSH server.

Step 1 Change the vty lines to use usernames, with either locally conﬁgured usernames
or an AAA server. "Login" command.

Step 2 Tell the switch to accept both Telnet and SSH with the transport input
telnet ssh vty subcommand. (The default is transport input telnet, omitting the ssh parameter.)

Step 3 Add one or more username name password pass-value global conﬁguration commands to conﬁgure username/password pairs.

Step 4 Conﬁgure a DNS domain name with the ip domain-name name global conﬁguration command.

Step 5 Conﬁgure the switch to generate a matched public and private key pair, as well as a shared encryption key, using the crypto key generate rsa global conﬁguration command.

Step 6 Although no switch commands are required, each SSH client needs a copy of the switch’s public key before the client can connect.

Enable Mode Passwords
■ If the global conﬁguration command enable password actual-password is used, it
deﬁnes the password required when using the enable EXEC command. This password
is listed as clear text in the conﬁguration ﬁle by default.

■ If the global conﬁguration command enable secret actual-password is used, it deﬁnes
the password required when using the enable EXEC command. This password is listed
as a hidden MD5 hash value in the conﬁguration ﬁle.

■ If both commands are used, the password set in the enable secret command deﬁnes
which password is required.

Password Encryption
■ When the service password-encryption command is conﬁgured, all existing console,
vty, and username command passwords are immediately encrypted.

■ If the service password-encryption command has already been conﬁgured, any future
changes to these passwords are encrypted.

■ If the no service password-encryption command is used later, the passwords remain
encrypted, until they are changed—at which point they show up in clear text.

Banners
Cisco routers and switches can display a variety of banners depending on what a router or
switch administrator is doing. A banner is simply some text that appears on the screen
for the user.

Logging synchronous and exec-timeout Commands
To make using the console a little easier, you can tell the switch to display syslog messages
only at more convenient times, such as at the end of output from a show command or to
prevent the interruption of a command text input. To do so, just conﬁgure the logging
synchronous console line subcommand.

By default, the switch or router automatically disconnects users after 5 minutes of inactivity, exec-timeout minutes seconds, set the timeout to 0 minutes and 0 seconds, the router never times out the console .

Configuring the Switch IP Address
This interface plays the same role as an Ethernet interface on a PC.
In effect, a switch’s VLAN 1 interface gives the switch an interface into the default VLAN.

Port Security
Use port security to restrict that interface so that only the expected devices can use it.

Reduces exposure to some types of attacks in which the attacker connects a laptop to the wall socket that connects to a switch port that has been conﬁgured to use port security

Step 1 Make the switch interface an access interface using the switchport mode access
interface subcommand.

Step 2 Enable port security using the switchport port-security interface subcommand.

Step 3 (Optional) Specify the maximum number of allowed MAC addresses associated with the interface using the switchport port-security maximum number interface subcommand. (Defaults to one MAC address.)

Step 4 (Optional) Deﬁne the action to take when a frame is received from a MAC address other than the deﬁned addresses using the switchport port-security violation {protect | restrict | shutdown} interface subcommand. (The default action is to shut down the port.)

Step 5A Specify the MAC address(es) allowed to send frames into this interface using the switchport port-security mac-address mac-address command. Use the command multiple times to deﬁne more than one MAC address.

Step 5B Alternatively, instead of Step 5A, use the “sticky learning” process to dynamically learn and conﬁgure the MAC addresses of currently connected hosts by conﬁguring the switchport port-security mac-address sticky interface subcommand.

■ Shutdown—The port immediately is put into the errdisable state, which effectively shuts it
down. It must be re-enabled manually or through errdisable recovery to be used again.

■ Restrict—The port is allowed to stay up, but all packets from violating MAC addresses are
dropped. The switch keeps a running count of the number of violating packets and can send
an SNMP trap and a syslog message as an alert of the violation.

■ Protect—The port is allowed to stay up, as in the restrict mode. Although packets from
violating addresses are dropped, no record of the violation is kept.

VLAN Configuration
Cisco switch interfaces are considered to be either access interfaces or trunk interfaces.
Access interfaces send and receive frames only in a single VLAN, called the access VLAN.

Trunking interfaces send and receive trafﬁc in multiple VLANs.

Step 1 To conﬁgure a new VLAN:
a. From conﬁguration mode, use the vlan vlan-id global conﬁguration command
to create the VLAN and move the user into VLAN conﬁguration mode.

b. (Optional) Use the name name VLAN subcommand to list a name for the VLAN. If not conﬁgured, the VLAN name is VLANZZZZ, where ZZZZ is the four-digit decimal VLAN ID.

Step 2 To conﬁgure a VLAN for each access interface:
a. Use the interface command to move into interface conﬁguration mode for each
desired interface.

b. Use the switchport access vlan id-number interface subcommand to specify the VLAN number associated with that interface.

c. (Optional) To disable trunking so that the switch will not dynamically decide to use trunking on the interface, and it will remain an access interface, use the switchport mode access interface subcommand.

Securing Unused Switch Interfaces
The recommendations for unused interfaces are as follows:
■ Administratively disable the interface using the shutdown interface subcommand.

■ Prevent VLAN trunking and VTP by making the port a nontrunking interface using the
switchport mode access interface subcommand.

■ Assign the port to an unused VLAN using the switchport access vlan number
interface subcommand.

CCNA: Operating Cisco LAN Switches

2009-06-18T10:53:00.007+08:00

Cisco uses the same concept of a command-line interface (CLI) with its router products and
most of its Catalyst LAN switch products. The CLI is a text-based interface in which the
user, typically a network engineer, enters a text command and presses Enter.

The switch does what the command says, and in some cases, the switch replies with some messages stating the results of the command.

Cisco refers to a switch’s physical connectors as either interfaces or ports. Each interface
has a number in the style x/y, where x and y are two different numbers.

Cisco supports two major types of switch operating systems: Internetwork Operating
System (IOS) and Catalyst Operating System (Cat OS). Most Cisco Catalyst switch series today run only Cisco IOS, but for some historical reasons, some of the high-end Cisco LAN
switches support both Cisco IOS and Cat OS.

Switch Status from LEDs
When an engineer needs to examine how a switch is working to verify its current status
and to troubleshoot any problems, the vast majority of the time is spent using commands
from the Cisco IOS CLI.

However, the switch hardware does include several LEDs that provide some status and troubleshooting information.

For example, SYST LED
■ Off: The switch is not powered on
■ On (green): The switch is powered on and operational (Cisco IOS has been loaded)
■ On (amber): The switch’s Power-On Self Test (POST) process failed, and the Cisco
IOS did not load.

STAT (status) mode
■ Off: The link is not working.
■ Solid green: The link is working, but there’s no current trafﬁc.
■ Flashing green: The link is working, and trafﬁc is currently passing over the interface.
■ Flashing amber: The interface is administratively disabled or has been dynamically
disabled for a variety of reasons.

Accessing the Cisco IOS CLI
The switch CLI can be accessed through three popular methods—the console, Telnet, and
Secure Shell (SSH).
Two of these methods (Telnet and SSH) use the IP network in which
the switch resides to reach the switch. The console is a physical port built speciﬁcally to
allow access to the CLI.
SSH encrypts all data exchange, including login passwords; Telnet encrypts
nothing.

CLI Access from the Console
Every Cisco switch has a console port, which is physically an RJ-45 port. A PC connects to the console port using a UTP rollover cable, which is also connected to the PC’s serial port.

UTP rollover cable has RJ-45 connectors on each end, with pin 1 on one end connected to pin 8 on the other, pin 2 to pin 7, pin 3 to pin 6, and pin 4 to pin 5.

The default console port settings on a switch are as follows:
■ 9600 bits/second
■ No hardware ﬂow control
■ 8-bit ASCII
■ No stop bits
■ 1 parity bit

User and Enable (Privileged) Modes
User EXEC mode, sometimes also called user mode, allows the user to look around but not break anything.

A more powerful EXEC mode called enable mode (also known as privileged mode or privileged EXEC mode). Enable mode is so named because the enable command is used to reach this mode.

Storing Switch Configuration Files
Cisco switches contain Random Access Memory (RAM) to store data while Cisco IOS is using it, but RAM loses its contents when the switch loses power.

The following list details the four main types of memory found in Cisco switches:
■ RAM: Sometimes called DRAM for Dynamic Random-Access Memory, RAM is
used by the switch just as it is used by any other computer: for working storage. The
running (active) conﬁguration ﬁle is stored here.

■ ROM: Read-Only Memory (ROM) stores a bootstrap (or boothelper) program that is
loaded when the switch ﬁrst powers on. This bootstrap program then ﬁnds the full
Cisco IOS image and manages the process of loading Cisco IOS into RAM.

■ Flash memory: Either a chip inside the switch or a removable memory card, Flash
memory stores fully functional Cisco IOS images and is the default location where the
switch gets its Cisco IOS at boot time.

■ NVRAM: Nonvolatile RAM (NVRAM) stores the initial or startup conﬁguration ﬁle
that is used when the switch is ﬁrst powered on and when the switch is reloaded.

Copying and Erasing Configuration Files

Initial Configuration (Setup Mode)

CCNA: Ethernet LAN Switching Concepts

2009-06-17T21:40:00.008+08:00

Switches segment a LAN into separate parts, each part being a separate collision domain.
By creating a separate collision domain for each interface, switches multiply the amount of available bandwidth in the network.

The IEEE deﬁnes three general categories of Ethernet MAC addresses:
■ Unicast addresses: MAC addresses that identify a single LAN interface card.
■ Broadcast addresses: A frame sent with a destination address of the broadcast address
(FFFF.FFFF.FFFF) implies that all devices on the LAN should receive and process the frame.
■ Multicast addresses: Multicast MAC addresses are used to allow a dynamic subset of
devices on a LAN to communicate.

Primary job of a LAN switch is to receive Ethernet frames and then make a decision:
1. Deciding when to forward a frame or when to ﬁlter (not forward) a frame, based on the
destination MAC address
2. Learning MAC addresses by examining the source MAC address of each frame
received by the bridge
3. Creating a (Layer 2) loop-free environment with other bridges by using Spanning Tree
Protocol (STP)

The key to anticipating where a switch should forward a frame is to examine and
understand the address table. The table lists MAC addresses and the interface the switch
should use when forwarding packets sent to that MAC address.

How Switches Learn MAC Addresses
Switches build the address table by listening to incoming frames and examining the source
MAC address in the frame. If a frame enters the switch and the source MAC address is not
in the MAC address table, the switch creates an entry in the table. The MAC address is
placed in the table, along with the interface from which the frame arrived.

Flooding Frames
The process of sending frames out all other interfaces, except the interface on which the
frame arrived, is called ﬂooding. Switches ﬂood unknown unicast frames as well as
broadcast frames. Switches also ﬂood LAN multicast frames out all ports.

Switches keep a timer for each entry in the MAC address table, called an inactivity timer.
The switch sets the timer to 0 for new entries.

Each time the switch receives another frame with that same source MAC address, the timer is reset to 0.

If the switch ever runs out of space for entries in the MAC address table, the switch can then remove table entries with the oldest (largest) inactivity timers.

Avoiding Loops Using Spanning Tree Protocol
LAN switches is loop prevention, as implemented by Spanning Tree Protocol (STP). Without STP, frames would loop for an indeﬁnite period of time in Ethernet networks with physically redundant links. To prevent looping frames, STP blocks some ports from forwarding frames so that only one active path exists between any pair of LAN segments (collision domains).

To avoid Layer 2 loops, all switches need to use STP. STP causes each interface on a switch
to settle into either a blocking state or a forwarding state.

*Blocking means that the interface cannot forward or receive data frames.
*Forwarding means that the interface can send and receive data frames.

Internal Processing on Cisco Switches
1. Store-and-forward processing:
The switch must receive the entire frame before forwarding the ﬁrst
bit of the frame. This allows the switch to check the FCS before forwarding the frame.

2. Cut-through processing:
Switch starts sending the frame out the output port as soon as possible. This reduces latency, but it also propagates errors. Because the frame check sequence (FCS) is in the Ethernet trailer, the switch cannot determine if the frame had any errors before starting to forward the frame.

3. Fragment-free processing:
The switch forwards the frame after receiving the ﬁrst 64 bytes of the frame, thereby avoiding forwarding frames that were errored due to a collision.

Switches Decision Making
Step 1 Switches forward frames based on the destination address:

a. If the destination address is a broadcast, multicast, or unknown destination
unicast (a unicast not listed in the MAC table), the switch ﬂoods the frame.

b. If the destination address is a known unicast address (a unicast address found
in the MAC table):
i. If the outgoing interface listed in the MAC address table is different from the
interface in which the frame was received, the switch forwards the frame out
the outgoing interface.
ii. If the outgoing interface is the same as the interface in which the frame was
received, the switch ﬁlters the frame, meaning that the switch simply ignores
the frame and does not forward it.

Step 2 Switches use the following logic to learn MAC address table entries:

a. For each received frame, examine the source MAC address and note the
interface from which the frame was received.

b. If they are not already in the table, add the address and interface, setting the
inactivity timer to 0.

c. If it is already in the table, reset the inactivity timer for the entry to 0.

Step 3 Switches use STP to prevent loops by causing some interfaces to block,
meaning that they do not send or receive frames.

Collision Domains
A collision domain is a set of network interface cards (NIC) for which a frame sent by
one NIC could result in a collision with a frame sent by any other NIC in the same
collision domain.

For a single collision domain:
■ The devices share the available bandwidth.
■ The devices may inefﬁciently use that bandwidth due to the effects of collisions,
particularly under higher utilization.

Broadcast Domains
A broadcast domain is a set of NICs for which a broadcast frame sent by one NIC is
received by all other NICs in the same broadcast domain.
When a host receives a broadcast, the host must process the received frame. This means that the NIC must interrupt the computer’s CPU, and the CPU must spend time thinking about the received broadcast frame.

Virtual LAN
A LAN consists of all devices in the same broadcast domain.
Without VLANs, a switch considers all interfaces on the switch to be in the same broadcast
domain.

■ To create more ﬂexible designs that group users by department, or by groups
■ To segment devices into smaller LANs (broadcast domains) to reduce overhead caused
■ To reduce the workload for STP by limiting a VLAN to a single access switch
■ To enforce better security by keeping hosts that work with sensitive data on a separate VLAN
■ To separate trafﬁc sent by an IP phone from trafﬁc sent by PCs connected to the phones

Roles of campus switches:
■ Access: Provides a connection point (access) for end-user devices. Does not forward
frames between two other access switches under normal circumstances.

■ Distribution: Provides an aggregation point for access switches, forwarding frames
between switches, but not connecting directly to end-user devices.

■ Core: Aggregates distribution switches in very large campus LANs, providing very
high forwarding rates.

CCNA: Fundamentals of IP Addressing

2009-06-17T11:08:00.018+08:00

The main job of IP is to route data (packets) from the source host to the destination host.
Because a network might need to forward large numbers of packets, the IP routing process
is very simple. IP does not require any overhead agreements or messages before sending a
packet, making IP a connectionless protocol. IP tries to deliver each packet, but if a router
or host’s IP process cannot deliver the packet, it is discarded—with no error recovery. The goal with IP is to deliver packets with as little per-packet work as possible, which allows
for large packet volumes.

IP header

*A routing protocol learns routes and puts those routes in a routing table.
*A routed protocol deﬁnes the type of packet forwarded, or routed, through a network.

IP addresses consist of a 32-bit number, usually written in dotted-decimal notation. For
instance, 168.1.1.1 is an IP address written in dotted-decimal form; the actual binary version is
10101000 00000001 00000001 00000001.

Each decimal number in an IP address is called an octet. So, for an IP address of 168.1.1.1, the ﬁrst octet is 168, the second octet is 1, and so on.

Classes of Networks
IP deﬁnes three different network classes for addresses used by individual hosts—addresses called unicast IP addresses. These three network classes are called A, B, and C. TCP/IP deﬁnes
Class D (multicast) addresses and Class E (experimental) addresses as well.

By deﬁnition, all addresses in the same Class A, B, or C network have the same numeric
value network portion of the addresses. The rest of the address is called the host portion of
the address.

Class A, B, and C networks each have a different length for the part that identiﬁes the network:
■ Class A networks have a 1-byte-long network part. That leaves 3 bytes for the rest of
the address, called the host part.

■ Class B networks have a 2-byte-long network part, leaving 2 bytes for the host portion
of the address.

■ Class C networks have a 3-byte-long network part, leaving only 1 byte for the host part.

*The Valid Network Numbers column shows actual network numbers. Networks 0.0.0.0 (originally defined for use as a broadcast address) and 127.0.0.0 (still available for use as the loopback address) are reserved.

IP Subnetting

Three parts of an IP address (network, subnet, and host), are called classful addressing. The term classful addressing refers to how you can think about IP addresses—speciﬁcally, that they have three parts.

IP addresses called classless addressing. Instead of three parts, each address has two parts:
■ The part on which routing is based
■ The host part

Finally, IP addressing with subnetting uses a concept called a subnet mask. A subnet mask
helps deﬁne the structure of an IP address.

Host Routing
Hosts actually use some simple routing logic when choosing where to send a packet. This
two-step logic is as follows:

Step 1 If the destination IP address is in the same subnet as I am, send the packet directly
to that destination host.

Step 2 If the destination IP address is not in the same subnet as I am, send the
packet to my default gateway (a router’s Ethernet interface on the subnet).

Router Forwarding Decisions and the IP Routing Table

Step A PC1 sends the packet to its default gateway.
Step B R1 processes the incoming frame and forwards the packet to R2.
Step C R2 processes the incoming frame and forwards the packet to R3.
Step D R3 processes the incoming frame and forwards the packet to PC2.

IP Routing Protocols
The routing (forwarding) process depends heavily on having an accurate and up-to-date
IP routing table on each router. IP routing protocols ﬁll the routers’ IP routing tables with
valid, loop-free routes.
■ To dynamically learn and ﬁll the routing table with a route to all subnets in the network.
■ If more than one route to a subnet is available, to place the best route in the routing table.
■ To notice when routes in the table are no longer valid, and to remove them from the routing table.
■ If a route is removed from the routing table and another route through another
neighboring router is available, to add the route to the routing table. (Many people view
this goal and the preceding one as a single goal.)
■ To add new routes, or to replace lost routes, with the best currently available route as
quickly as possible. The time between losing the route and ﬁnding a working replacement route is called convergence time.
■ To prevent routing loops.

Network Layer Utilities
■ Address Resolution Protocol (ARP)

■ Domain Name System (DNS)

■ Dynamic Host Conﬁguration Protocol (DHCP)

■ Ping
Ping (Packet Internet Groper) uses the Internet Control Message Protocol (ICMP), sending a message called an ICMP echo request to another IP address. The computer with that IP address should reply with an ICMP echo reply.

CCNA: Fundamentals of WANs

2009-06-16T22:23:00.014+08:00

OSI Layer 1 Point-to-point WANs
The big distinction between LANs and WANs relates to how far apart the devices can be
and still be capable of sending and receiving data. WAN connections typically run longer distances than Ethernet.

To create such long links, or circuits, the actual physical cabling is owned, installed, and
managed by a company that has the right of way to run cables under streets. Because a
company that needs to send data over the WAN circuit does not actually own the cable or
line, it is called a leased line.

Companies that can provide leased WAN lines typically started life as the local telephone company, or telco, generic term service provider.

Point-to-point WAN links provide basic connectivity between two points. To get a point-to-
point WAN link, you would work with a service provider to install a circuit. What the phone
company or service provider gives you is similar to what you would have if you made a
phone call between two sites, but you never hung up.

The telco seldom actually runs a 1000-mile cable for you between the two sites. Instead, it has built a large network already and even runs extra cables from the local central ofﬁce (CO) to your building (a CO is just a building where the telco locates the devices used to create its own network).

Typically, routers connect to a device called an external channel service unit/data service
unit (CSU/DSU). The router cable and typically the CSU/DSU are owned by the telco’s customer, and the wiring to the CO and the gear inside the CO are owned by the telco. So, the telco uses the term demarc, which is short for demarcation point, to refer to the point at which the telco’s responsibility is on one side and the customer’s responsibility is on the other.

The device that provides clocking, typically the CSU/DSU, is considered to be the data communications equipment (DCE). The device receiving clocking, typically the router, is referred to as data terminal equipment (DTE).

*DCE cable needs to supply clock rate.

Customer premises equipment (CPE) refers to devices that are at the customer site,
from the telco’s perspective. For instance, both the CSU/DSU and the router are CPE
devices in this case.

Serial Cabling

WAN Speed
Original mechanism used for converting analog voice to a digital signal is called pulse
code modulation (PCM).

PCM deﬁnes that an incoming analog voice signal should be sampled 8000 times per second, and each sample should be represented by an 8-bit code.
So, 64,000 bits were needed to represent 1 second of voice.

OSI Layer 2 Point-to-Point WANs
High-Level Data Link Control (HDLC) and Point-to-Point Protocol (PPP)

HDLC
HDLC needs to determine if the data passed the link without any errors;
HDLC discards the frame if errors occurred. HDLC deﬁnes framing.

HDLC header includes an Address ﬁeld and a Protocol Type ﬁeld, with the trailer containing a frame check sequence (FCS) ﬁeld.

PPP
PPP behaves much like HDLC. The framing looks identical to the
Cisco proprietary HDLC framing. There is an Address ﬁeld, but the addressing does not
matter. PPP does discard errored frames that do not pass the FCS check.

Frame Relay and Packet Switching
Packet-switching service, physical WAN connectivity exists, similar to a leased line. However, a company can connect a large number of routers to the packet-switching service, using a single serial link from each router into the packet-switching service.

Two types of packet-switching service: Frame Relay and Asynchronous Transfer Mode (ATM).

Frame Relay, has many advantages over point-to-point links, particularly when you connect many sites via a WAN.
Frame Relay is cheaper. Frame Relay networks are multiaccess networks, which means that more than two devices can attach to the network.

A leased line is installed between each router and a nearby Frame Relay switch; these links are called access links.

The difference between Frame Relay and point-to-point links is that the equipment in the
telco actually examines the data frames sent by the router. Frame Relay deﬁnes its own
data-link header and trailer. Each Frame Relay header holds an address ﬁeld called a data-
link connection identiﬁer (DLCI).

Frame Relay switches are called DCE, and the customer equipment—routers, in this case—are called DTE.

DCE refers to the device providing the service, and the term DTE refers to the device
needing the frame-switching service. At the same time, the CSU/DSU provides clocking to
the router.

Frame relay virtual circuit, the logical path that a frame travels between each pair of routers.
Service provider preconﬁgures all the required details of a VC; these VCs
are called permanent virtual circuits (PVC). VCs share the access link and the Frame Relay network.

Frame Relay is designed with the concept of a committed information rate (CIR). Each VC has a CIR, which is a guarantee by the provider that a particular VC gets at least that much bandwidth.

When R1 needs to forward a packet to R2,
it encapsulates the Layer 3 packet into a Frame Relay header and trailer and then sends
the frame. R1 uses a Frame Relay address called a DLCI in the Frame Relay header,
with the DLCI identifying the correct VC to the provider. This allows the switches to
deliver the frame to R2, ignoring the details of the Layer 3 packet and looking at only
the Frame Relay header and trailer.

CCNA: Fundamentals of LANs

2009-06-16T16:52:00.016+08:00

Carrier sense multiple access with collision detection (CSMA/CD) algorithm
CSMA/CD algorithm works like this:

Step 1 A device with a frame to send listens until the Ethernet is not busy.
Step 2 When the Ethernet is not busy, the sender(s) begin(s) sending the frame.
Step 3 The sender(s) listen(s) to make sure that no collision occurred.
Step 4 If a collision occurs, the devices that had been sending a frame each send a jamming signal to ensure that all stations recognize the collision.
Step 5 After the jamming is complete, each sender randomizes a timer and waits that long before trying to resend the collided frame.
Step 6 When each random timer expires, the process starts over with Step 1.

CSMA/CD does not prevent collisions, but it does ensure that the Ethernet works well even
though collisions may and do occur.

*Ethernet carrier sense multiple access with collision detection (CSMA/CD) logic is that collisions should be detected within the ﬁrst 64 bytes of a frame.

Collision Domain
Deﬁnes the set of devices whose frames could collide. All devices on a 10BASE2, 10BASE5, or any network using a hub risk collisions between the frames that they send, so all devices on one of these types of Ethernet networks are in the same collision domain.

To avoid collisions, and to recover when they occur, devices in the same collision domain use CSMA/CD or Buffering.

Common Types of Ethernet

Ethernet UTP Cabling
The three most common Ethernet standards used today—10BASE-T (Ethernet),
100BASE-TX (Fast Ethernet, or FE), and 1000BASE-T (Gigabit Ethernet, or GE)—use
UTP cabling.

RJ-45 connector has eight Ethernet UTP Cabling speciﬁc physical locations into which the eight wires in the cable can be inserted, called pin positions, or simply pins.

Although RJ-45 connectors and ports are popular, engineers might want to purchase Cisco
LAN switches that have a few physical ports that can be changed without having to
purchase a whole new switch. Many Cisco switches have a few interfaces that use either
Gigabit Interface Converters (GBIC) or Small-Form Pluggables (SFP). Both are small removable devices that ﬁt into a port or slot in the switch.

Ethernet Cable Standard

Straight-through Cable
- Host to Switch or hub
- Router to Switch or hub

Crossover Cable
- Switch to switch
- Hub to hub
- Host to host
- Hub to Switch
- Router to host

Full duplex/half duplex
Full duplex means that an Ethernet card can send and receive concurrently.With only the switch and one device connected to each other, collisions cannot occur. When you implement full duplex, you disable CSMA/CD logic on the devices on both ends of the cable.ﬁrst half of the address identiﬁes the manufacturer of the card is called the organizationally unique identiﬁer (OUI). second half of the address being assigned a number that this manufacturer has never used on another card.

Ethernet addressing (MAC, Media address control 802.3)
Ethernet LAN addressing identiﬁes either individual devices or groups of devices on a
LAN. Each address is 6 bytes long, is usually written in hexadecimal. Unicast Ethernet addresses identify a single LAN card. Computers use unicast addresses to identify the sender and receiver of an Ethernet frame.

First half of the address identiﬁes the manufacturer of the card is called the organizationally unique identiﬁer (OUI).

Second half of the address being assigned a number that this manufacturer has never used on another card.

Each LAN card comes with a burned-in address (BIA, 6-byte address assigned by vendor) that is burned into the ROM chip on the card.

IEEE deﬁnes two general categories of group addresses for Ethernet:

■ Broadcast addresses: The most often used of the IEEE group MAC addresses, the
broadcast address, has a value of FFFF.FFFF.FFFF (hexadecimal notation). The
broadcast address implies that all devices on the LAN should process the frame.

■ Multicast addresses: Multicast addresses are used to allow a subset of devices on a
LAN to communicate. When IP multicasts over an Ethernet, the multicast MAC
addresses used by IP follow this format: 0100.5exx.xxxx.

LAN Header Format

*Ethernet Frame Check Sequence (FCS) ﬁeld in the Ethernet trailer—the only ﬁeld in
the Ethernet trailer—allows a device receiving an Ethernet frame to detect whether the bits
have changed during transmission.

CCNA: TCP/IP and OSI Model

2009-06-16T16:14:00.014+08:00

How sure are you know about these? :)

TCP/IP deﬁnes a large collection of protocols that allow computers to communicate.
TCP/IP deﬁnes the details of each of these protocols inside documents called Requests for
Comments (RFC).

TCP/IP architecture layer:
1. Application layer:
Provide services to the application software running on a computer. The application layer does not deﬁne the application itself, but rather it deﬁnes services that applications need.
Example protocols: HTTP, POP3, SMTP

2. Transport layer
TCP/IP needs a mechanism to guarantee delivery of data across a network. Because many application layer protocols probably want a way to guarantee delivery of data across a network, TCP provides an error-recovery feature to the application protocols by using acknowledgments.
Example protocols: TCP, UDP

3. Internet layer
IP deﬁnes addresses so that each host computer can have a different IP address. Similarly, IP deﬁnes the process of routing so that devices called routers can choose where to send packets of data so that they are delivered to the correct destination.
Example protocols: IP

4. Network access layer
Deﬁnes how to physically connect a host computer to the physical media over which data can be transmitted. IP relies on the network access layer to deliver IP packets across a physical network.
Example protocols: Ethernet, Frame Relay

Same-layer interaction on different computers
The two computers use a protocol to communicate with the same layer on another computer.

Adjacent-layer interaction on the same computer
On a single computer, one layer provides a service to a higher layer.

Data Encapsulation Terminology
Encapsulation refers to the process of putting headers and trailers around some data. The process by which a TCP/IP host sends data can be viewed as a ﬁve-step process.

Step 1 Create and encapsulate the application data with any required application layer headers. For example, the HTTP OK message can be returned in an HTTP header, followed by part of the contents of a web page.

Step 2 Encapsulate the data supplied by the application layer inside a transport layer header. For end-user applications, a TCP or UDP header is typically used.

Step 3 Encapsulate the data supplied by the transport layer inside an internet layer (IP) header. IP is the only protocol available in the TCP/IP network model.

Step 4 Encapsulate the data supplied by the internet layer inside a network access layer header and trailer. This is the only layer that uses both a header and a trailer.

Step 5 Transmit the bits. The physical layer encodes a signal onto the medium to transmit the frame.

Finally, take particular care to remember the terms segment, packet, and frame, and the meaning of each. segment for the transport layer, packet for the internet layer, and frame for the network access layer.

The OSI Reference Model
OSI is the Open System Interconnection reference model for communications. OSI model can be used as a standard of comparison to other networking models.

Application Layer: Interfaces between network and application software. Also includes authentication services.

Presentation Layer: Deﬁnes the format and organization of data. Includes encryption, such as ASCII text, EBCDIC text, binary, BCD, and JPEG.

Session Layer: The session layer deﬁnes how to start, control, and end conversations (called sessions).

Transport Layer: including connection establishment and termination, ﬂow control, error recovery, and segmentation of large data blocks into smaller parts for transmission.

Network Layer: Logical addressing, routing, and path determination.

Data Link Layer: Formats data into frames appropriate for transmission onto some physical medium. Deﬁnes rules for when the medium can be used. Deﬁnes means by which to recognize transmission errors. Typically deﬁnes a Frame Check Sequence (FCS) ﬁeld, which allows the receiving device to detect transmission errors.

Physical Layer: Deﬁnes the electrical, optical, cabling, connectors, and procedural details required for transmitting bits, represented as some form of energy passing over a physical medium.

TCP/IP Layer 4 Protocols: TCP and UDP
The key difference between TCP and UDP is that TCP provides a wide variety of services
to applications, whereas UDP does not.
TCP provides for retransmission (error recovery) and help to avoid congestion (ﬂow control), whereas UDP does not.

TCP provides error recovery, but to do so, it consumes more bandwidth and uses more processing cycles. UDP does not perform error recovery, but it takes less bandwidth and uses fewer processing cycles.

TCP and UDP both use a concept called multiplexing. Multiplexing by TCP and UDP involves the process of how a computer thinks when receiving data. The computer might be running many applications, such as a web browser, an e-mail package, or an Internet VoIP application (for example, Skype). TCP and UDP multiplexing enables the receiving computer to know which application to give the data to.

Multiplexing relies on a concept called a socket. A socket consists of three things:
■ An IP address
■ A transport protocol
■ A port number

Because a socket on a single computer should be unique, a connection between two sockets should identify a unique connection between two computers. This uniqueness means that you can use multiple applications at the same time, talking to applications running on the same or different computers.

Error Recovery (Reliability)
TCP provides for reliable data transfer, which is also called reliability or error recovery, To accomplish reliability, TCP numbers data bytes using the Sequence and Acknowledgment ﬁelds in the TCP header. TCP achieves reliability in both directions, using the Sequence Number ﬁeld of one direction combined with the Acknowledgment ﬁeld in the opposite direction. Implies the next byte to be received; this is called forward acknowledgment.

Flow Control Using Windowing
TCP implements ﬂow control by taking advantage of the Sequence and Acknowledgment
ﬁelds in the TCP header, along with another ﬁeld called the Window ﬁeld. This Window
ﬁeld implies the maximum number of unacknowledged bytes that are allowed to be
outstanding at any instant in time. The window starts small and then grows until errors
occur. The size of the window changes over time, so it is sometimes called a dynamic
window, sometimes called a sliding window。

3-Way TCP Connection Establishment

TCP signals connection establishment using 2 bits inside the ﬂag ﬁelds of the TCP header.
Called the SYN and ACK ﬂags.
TCP initializes the Sequence Number and Acknowledgment Number ﬁelds to any number
that ﬁts into the 4-byte ﬁelds.

4-Way Establishment Termination
This four-way termination sequence is straightforward and uses an additional ﬂag, called the FIN bit. (FIN is short for “ﬁnished").
Before the device on the right sends the third TCP segment in the sequence, it notiﬁes the application that the connection is coming down. It then waits on an acknowledgment from the application before sending the third segment in the ﬁgure.

■ Connection-oriented protocol: A protocol that requires an exchange of messages
before data transfer begins or that has a required preestablished correlation between
two endpoints

■ Connectionless protocol: A protocol that does not require an exchange of messages
and that does not require a preestablished correlation between two endpoints

Each different type of data-link protocol typically has a limit on the maximum transmission
unit (MTU) that can be sent inside a data link layer frame. In other words, the MTU is the
size of the largest Layer 3 packet that can sit inside a frame’s data ﬁeld. For many data-link
protocols, Ethernet included, the MTU is 1500 bytes.

UDP
UDP is connectionless and provides no reliability, no windowing, no reordering of the received
data, and no segmentation of large chunks of data into the right size for transmission. UDP does not require waiting on acknowledgments or holding the data in memory until it is acknowledged.

Popular TCP/IP Applications
World Wide Web (WWW) application exists through web browsers accessing the
content available on web servers.

Domain Name System (DNS) allows users to use names to refer to computers, with
DNS being used to ﬁnd the corresponding IP addresses.

Simple Network Management Protocol (SNMP) is an application layer protocol used
speciﬁcally for network device management.

Trivial File Transfer Protocol (TFTP). TFTP deﬁnes a protocol for basic ﬁle transfer—hence the word “trivial.”

Simple Mail Transport Protocol (SMTP) and Post Ofﬁce Protocol version 3 (POP3), both used for transferring mail, require guaranteed delivery, so they use TCP.

VoIP trafﬁc has several other QoS demands on the network before the VoIP trafﬁc will sound good:
■ Low delay: VoIP requires a very low delay between the sending phone and the
receiving phone—typically less than 200 milliseconds (.2 seconds). This is a much
lower delay than what is required by typical data applications.
■ Low jitter: Jitter is the variation in delay. VoIP requires very low jitter as well, whereas
data applications can tolerate much higher jitter. For example, the jitter for consecutive
VoIP packets should not exceed 30 milliseconds (.03 seconds), or the quality degrades.
■ Loss: If a VoIP packet is lost in transit because of errors or because a router doesn’t
have room to store the packet while waiting to send it, the VoIP packet is not delivered
across the network. Because of the delay and jitter issues, there is no need to try to
recover the lost packet. It would be useless by the time it was recovered. Lost packets
can sound like a break in the sound of the VoIP call.

My Study Plan

2009-06-16T14:21:00.002+08:00

I decided to study all over again to brush up my memory. It is probably to spend at least 6 months for this serious action. Anyway, below is my book list which is recommended by Jared from IPexpert:

1. CCNA Official Exam Certification Library (CCNA Exam 640-802), 3rd Edition by Wendell Odom

2.CCIE Routing and Switching Exam Certification Guide, 3rd Edition By Wendell Odom, Rus Healy, Naren Mehta.

3.Routing TCP/IP, Volume 1, 2nd Edition By Jeff Doyle, Jennifer Carroll.

4.CCNP BCMSN Official Exam Certification Guide, 4th Edition By Dave Hucaby.

5.Internet Routing Architectures, 2nd Edition by Sam Halabi

6.Routing TCP/IP, Volume II By Jeff Doyle, Jennifer DeHaven Carroll.

7.Developing IP Multicast Networks, Volume I By Beau Williamson.

8.Cisco QOS Exam Certification Guide (IP Telephony Self-Study), 2nd Edition By Wendell Odom, Michael J. Cavanaugh.

9.Cisco QOS for 3560 and 3550 series.

I think these books should be enough for the CCIE written exam. By the way, i will also look into some video and extra materials from CBT Nugget and IPexpert.

Dynamips is my primary study tools along the way. Anyway, wish me luck on study!

Another good recommendation

2009-06-16T14:11:00.001+08:00

So Much Information: Part Two

By Jared Scrivener on Thursday, April 9, 2009 10:47

Well, I’ve had a lot of requests for the follow up to my post last year, So Much Information: Part One. The focus of that post, which I strongly recommend you read, was on how to properly prepare for the CCIE Written exam for the Routing and Switching track so that you take away from that preparation enough knowledge to begin practicing for your lab exam.

The purpose of this post is to articulate the various resources that I would suggest the use of in preparing for your lab exam. This includes a variety of resources including the Cisco online documentation, various Cisco Press titles that didn’t fit in to my previous article and of course, IPexpert training materials.

I’d like to create a study path here to reference, that continues on from the point of passing the written exam and would be a feasible pace for most students. I am aware that it’s difficult to make a one size fits all plan as everyone has their own constraints with respect to their path, so I’ve opted to articulate a plan that is very similar to the path that I’ve taken for each of my CCIE labs, tailored to the R&S track. Using this approach let’s consider how to go from passing the written, to taking the lab.

So let’s assume that you’ve just returned home from the testing center, with your written exam results in hand and it’s time to consider setting aside the time and money to convert that written exam into a CCIE number. Before scheduling a lab date, take some time to get a sense of the cost of the lab exam. By that I don’t just mean the cost of the lab exam itself. I mean the cost of the materials, the travel, the accommodation, the training and the costs of potentially taking multiple attempts (the average is around 3 attempts to pass). These costs can add up, but remember the other cost – time.

The journey from the written exam to the lab can take anywhere from 3 months to many years. The amount of time you can commit on a daily or weekly basis will play a large role in how long that process will take. Everyone has different family, work and social commitments that factor into their calculation of time and different expectations for how long the process may take. Understand what time horizons are acceptable for you and keep them in the back of your mind as you design a study path. Set yourself a rough date (i.e October 2009) for when you’d like to achieve your lab and then read through this article to work out what methods may assist to prepare you in that time.

The first study tool I’d suggest using, as I did, is the IPexpert Blended Learning Solution, which contains all of our self study products – technology focused labs, multiprotocol labs, mock labs, video and audio classes on demand, video solutions, the works. Every CCIE student needs a set of lab workbooks written to give them opportunities to learn both specific technologies and how they’ll integrate together into a mock lab. From IPexpert, I generally recommend purchasing the complete set of workbooks bundled together with the other self-study products due to the savings associated with bundling.

Phase One: Once your workbooks arrive open them up and skim through them to get a grasp of the topics that you’ll be learning in the coming months. Focus predominantly on the technology focused workbook, reading through the different topics and noticing the topics where you have strengths and those where you need practice. To begin your preparation I suggest starting on those labs that correlate to your weaker topics as that will give you the most value from your study hours.

Work through the technology focused labs, allow yourself to refer to the accompanying solution guide (IPexpert provides these with each lab) when you get stuck or aren’t sure of the answer to a question. Configure each section as required using each of the “show” commands to verify your answers. As you configure each section, look up each and every command in the Command Reference and where possible, the Configuration Guide for that topic on the Cisco Documentation starting from http://www.cisco.com/web/psa/products/index.html just like in your actual lab.

While you repeat this process for each technology focused lab, over a month or two you’ll gain significant benefits both from comfort with the commands for each technology and from fluency in navigating the documentation. When you’ve done this for each technology you need configuration experience with, read through the solutions guide for each of the other technology focused labs that you don’t need to configure as you may find a few unfamiliar commands buried within them.

Phase Two: The purpose of Phase One was to gain fluency with the documentation whilst simultaneously gaining experience in unfamiliar topics. The purpose of Phase Two is to start integrating technologies together and to hone in on weaknesses and supplement them. The products I’d suggest you use here are multiprotocol labs in an 8-hour format similar to your actual lab. These are included inside IPexpert’s Blended Learning Solution and can be purchased separately. Work through each of these labs starting from the first one. As you discover new commands look each of them up on Cisco’s website as was done in Phase One. Pay attention to the areas that catch you out. In addition to the books listed in my prior article, there are a few that will offer some supplemental benefit at this stage of your preparation.

If you are finding that you are having challenges with routing protocols, the following book is excellent with respect to its methodology and detail in helping troubleshoot routing protocol issues.

Troubleshooting IP Routing Protocols (CCIE Professional Development Series) by Zaheer Aziz, Johnson Liu, Abe Martey, Faraz Shamim.

If you are finding that you are having challenges with WAN technologies, the following book is a great resource by providing a process for troubleshooting them and detailed explanations.

Troubleshooting Remote Access Networks (CCIE Professional Development) by Plamen Nedeltchev.

Finally, for additional help with switching read the latest IOS Configuration Guide for the 3560 switch (and the QOS section for the 3550 switch).

This phase involves the configuration of about 5 to 10 multiprotocol labs over the course of a few weeks to a few months depending on how comfortable you become.

Phase Three: The third phase of lab preparation is where the prior preparation gets integrated into lab readiness. For those who can afford to this is where I’d highly recommend attendance in a boot camp. Whilst I have an inherent bias towards the IPexpert Instructor Led Boot Camp which I used both as a student and teach now, there are a few things to look for from a course. The purpose of a boot camp at this point in your preparation is to tie together the knowledge and experience you have already gained and to polish and prepare you for the final stage before your lab exam. Ideally, the course will be about 4-8 weeks prior to your real lab date so that you have time to polish or rectify any areas identified by yourself and the instructor after the course that you need improvement on.

A boot camp should provide you with a detailed strategy for taking the lab exam, it should explain to you the many different technologies you’ll encounter in the lab and how they interact with other protocols and it should give you a chance to demonstrate configuration of each technology with an instructor to assist you. This environment combining theory, hands-on and strategy is the best way to integrate your knowledge and prepare you to be ready to take a lab exam.

For those of you who don’t have the opportunity to take a class, I’d suggest continuing to work through multiprotocol labs and additionally watching the Video Class on Demand utilizing frank self assessment to recognize your progress or knowledge gaps.

Phase Four: The final phase which normally lasts 2-8 weeks is the period after a boot camp or immediately prior to your exam where you should polish any topics that you feel least comfortable on. This might require going back to your textbooks for additional reading, posting questions in forums (such as www.onlinestudylist.com) or configuring some ad hoc labs to specifically test and understand the technologies you need confidence on. I generally spend most of this phase reading through lab solutions guides to get comfortable with the wording of questions and to maintain my fluency at recognizing commands and what function they achieve. I’d suggest doing a handful (maybe 5 to 10) of the most difficult mock labs you can find during this period to ensure that you’ve tested yourself as strictly as possible prior to your lab date.

This approach I’ve articulated should take about 2-8 weeks for Phase One, about 2-8 weeks for Phase Two, about 2-4 weeks for Phase Three and about 2-8 weeks for Phase Four. That’s a timeline of about 3 to 7 months from passing the written exam to passing your lab exam.

If you have any questions please email me at jscrivener@ipexpert.com.

Cheers,

Jared

A good recommendation CCIE book lists

2009-06-16T14:09:00.001+08:00

So Much Information: Part One
By Jared Scrivener on Friday, November 21, 2008 17:30

Well, those of you in the process of studying for your R&S CCIE are probably going through (or have gone through) the challenge of assimilating thousands of pages worth of information. Many of you will have seen Cisco’s reading list and considered it potentially insurmountable. How can one human brain possibly contain all that information?

Often I find that when I teach R&S boot camps, many of my students haven’t read the entire book list. In fact, I haven’t encountered any who have as of yet - and you don’t need to. What puzzles me is when I find that the same areas that students report to be weak on tend to correlate most strongly to the books that they haven’t read. To me, common sense would indicate that if you don’t know something it needs to be researched - lab time is not an appropriate method to learn why things work - just HOW they work. That’s why there are two exams to pass to achieve a CCIE, a written and a lab. Unfortunately, Cisco set a pass mark for the written exam that is far too low, that allows too many people to pass with serious knowledge gaps: this makes it difficult for students to recognize that gap until their lab ends in disaster.

What I’m going to outline here is my suggested reading list. None of these books are authored by me, but every one of them I’ve bought and read in the context of my studies. Not all of them need to be read cover to cover, but some do, so I’ll make it clear which are which. There are many reading lists that are flagged as “recommended” by the author of the list. In my opinion this leads people to believe that certain reading is optional. It isn’t. So far as I’m concerned my reading list is a *required* reading list and like all suggestions I make to students I don’t waste your time by listing books that are redundant.

So here’s my recommended strategy to assimilate information from the start of the process until the point where you start to do technology labs. You’ll note that I assume a lot of this reading is done before the written exam. For those of you who passed that based in the ridiculously easy nature of that test without fully studying, please read the books that I list anyway - you’ll thank me for it.

My reading list assumes CCNA level knowledge - if you don’t have that then read the following first and go and get your CCNA, get a year or two’s worth of experience (if you don’t have that already) then come back to your CCIE after that:

CCNA Official Exam Certification Library (CCNA Exam 640-802), 3rd Edition by Wendell Odom

From the start of your CCIE the first book to read is a general book to create a mental frame work to put your theory in. When studying, always begin by reading something that covers all the topics - don’t delve into a particular topic in detail first. This is because your brain formulates information from data based on context - so you’ll gather more information from reading the same book if you have a context to put it in.

So, book one is your overall theory book:

CCIE Routing and Switching Exam Certification Guide, 3rd Edition By Wendell Odom, Rus Healy, Naren Mehta.

This book, once finished, will give you a good overview of the topics that you’ll need to learn for your CCIE. Read it as the first book, then re-read it (as required) before your written exam.

Book two is your routing book:

Routing TCP/IP, Volume 1, 2nd Edition By Jeff Doyle, Jennifer Carroll.

This book is like the bible for the R&S CCIE student. It’s a tough read but superbly written with an elegant logical sequence. It will teach you all you need to know about the operation of your IGP routing protocols for IPv4 and IPv6. It’s also my favorite textbook of all time.

Book three is your switching book:

CCNP BCMSN Official Exam Certification Guide, 4th Edition By Dave Hucaby.

This book isn’t on the Cisco CCIE reading list, which astounds me. The Cisco list prefers “Cisco LAN Switching” but that is almost 10 years old and the information (whilst well written and detailed) is too old to be a useful reference due to massive technology improvements. This book is the latest exam certification guide for BCMSN (the CCNP switching course). Feel free to skip any topics that aren’t relevant to your lab, but ensure you read all the switching material as well as material on high availability protocols and multicast (it’ll serve as a good primer for the sixth book).

Book four and five are your BGP books:

Internet Routing Architectures, 2nd Edition by Sam Halabi

and

Routing TCP/IP, Volume II By Jeff Doyle, Jennifer DeHaven Carroll.

Sam’s book is an excellent book covering BGP in many situations. It is dated a little bit, but BGP hasn’t changed much in that time. Routing TCP/IP Vol 2 has a good BGP section too, so between them you should be able to learn most if not all of the theory you need to understand the protocol.

Book six is your multicast book:

Developing IP Multicast Networks, Volume I By Beau Williamson.

It’s unfortunate that Beau has never had the time to update this masterpiece, but read it anyway as it explains multicast better than any other book to date. Supplement it with the information from books three and five if you need to get a bit of extra information.

Book seven is your QOS book:

Cisco QOS Exam Certification Guide (IP Telephony Self-Study), 2nd Edition By Wendell Odom, Michael J. Cavanaugh.

This book (again not on the list from Cisco) is the best written QOS book that you’ll find. What it doesn’t cover (or that Wendell didn’t add to in book one) you should gather from the Cisco website 3550 and 3560 Configuration Guide QOS sections.

So that’s seven books cover-to-cover to have *expert* level knowledge. Seem fair? The only major areas I haven’t covered are WAN technologies and IPv6, but they are better covered later in your studies due to their less theoretical and more practical nature (what you need to know for the written is in book one).

Read them, go pass your written (or read them if you already passed but need more information) and move on to technology scenarios. Next week, I’ll cover the remaining supplemental books to read as I guide you through the study process leading up to your lab.

Have a good weekend.

CCIE ® Routing and Switching Lab Exam Topics (Blueprint) v4.0

2009-06-16T13:06:00.003+08:00

The following topics are general guidelines for the content likely to be included on the lab exam. However, other related topics may also appear on any specific delivery of the exam.

Lab Equipment and IOS Version

The lab exam tests any feature that can be configured on the equipment and the IOS versions indicated below. You may see more recent IOS versions installed in the lab, but you will not be tested on the new features of a release unless indicated below.

3725 series routers - IOS 12.4 mainline – Advanced Enterprise Services
3825 series routers - IOS 12.4 mainline – Advanced Enterprise Services
Catalyst 3550 series switches running IOS version 12.2 – IP Services
Catalyst 3560 Series switches running IOS version 12.2 - Advanced IP Services

Beginning October 18, 2009, v4.0 exams will feature:

Cisco 1841 Integrated Service Router, running IOS 12.4(T) Advanced Enterprise Services
Cisco 3825 Integrated Service Router, running IOS 12.4(T) Advanced Enterprise Services
Cisco Catalyst 3560 switch, running IOS 12.2 Advanced IP Services

Exam Sections and Sub-task Objectives

1.00	Implement Layer 2 Technologies	√
1.10	Implement Spanning Tree Protocol (STP)
	(a) 802.1d
	(b) 802.1w
	(c) 801.1s
	(d) Loop guard
	(e) Root guard
	(f) Bridge protocol data unit (BPDU) guard
	(g) Storm control
	(h) Unicast flooding
	(i) Port roles, failure propagation, and loop guard operation
1.20	Implement VLAN and VLAN Trunking Protocol (VTP)
1.30	Implement trunk and trunk protocols, EtherChannel, and load-balance
1.40	Implement Ethernet technologies
	(a) Speed and duplex
	(b) Ethernet, Fast Ethernet, and Gigabit Ethernet
	(c) PPP over Ethernet (PPPoE)
1.50	Implement Switched Port Analyzer (SPAN), Remote Switched Port Analyzer (RSPAN), and flow control
1.60	Implement Frame Relay
	(a) Local Management Interface (LMI)
	(b) Traffic shaping
	(c) Full mesh
	(d) Hub and spoke
	(e) Discard eligible (DE)
1.70	Implement High-Level Data Link Control (HDLC) and PPP
2.00	Implement IPv4
2.10	Implement IP version 4 (IPv4) addressing, subnetting, and variable-length subnet masking (VLSM)
2.20	Implement IPv4 tunneling and Generic Routing Encapsulation (GRE)
2.30	Implement IPv4 RIP version 2 (RIPv2)
2.40	Implement IPv4 Open Shortest Path First (OSPF)
	(a) Standard OSPF areas
	(b) Stub area
	(c) Totally stubby area
	(d) Not-so-stubby-area (NSSA)
	(e) Totally NSSA
	(f) Link-state advertisement (LSA) types
	(g) Adjacency on a point-to-point and on a multi-access network
	(h) OSPF graceful restart
2.50	Implement IPv4 Enhanced Interior Gateway Routing Protocol (EIGRP)
	(a) Best path
	(b) Loop-free paths
	(c) EIGRP operations when alternate loop-free paths are available, and when they are not available
	(d) EIGRP queries
	(e) Manual summarization and autosummarization
	(f) EIGRP stubs
2.60	Implement IPv4 Border Gateway Protocol (BGP)
	(a) Next hop
	(b) Peering
	(c) Internal Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP)
2.70	Implement policy routing
2.80	Implement Performance Routing (PfR) and Cisco Optimized Edge Routing (OER)
2.90	Implement filtering, route redistribution, summarization, synchronization, attributes, and other advanced features
3.00	Implement IPv6
3.10	Implement IP version 6 (IPv6) addressing and different addressing types
3.20	Implement IPv6 neighbor discovery
3.30	Implement basic IPv6 functionality protocols
3.40	Implement tunneling techniques
3.50	Implement OSPF version 3 (OSPFv3)
3.60	Implement EIGRP version 6 (EIGRPv6)
3.70	Implement filtering and route redistribution
4.00	Implement MPLS Layer 3 VPNs
4.10	Implement Multiprotocol Label Switching (MPLS)
4.20	Implement Layer 3 virtual private networks (VPNs) on provider edge (PE), provider (P), and customer edge (CE) routers
4.30	Implement virtual routing and forwarding (VRF) and Multi-VRF Customer Edge (VRF-Lite)
5.00	Implement IP Multicast
5.10	Implement Protocol Independent Multicast (PIM) sparse mode
5.20	Implement Multicast Source Discovery Protocol (MSDP)
5.30	Implement interdomain multicast routing
5.40	Implement PIM Auto-Rendezvous Point (Auto-RP), unicast rendezvous point (RP), and bootstrap router (BSR)
5.50	Implement multicast tools, features, and source-specific multicast
5.60	Implement IPv6 multicast, PIM, and related multicast protocols, such as Multicast Listener Discovery (MLD)
6.00	Implement Network Security
6.01	Implement access lists
6.02	Implement Zone Based Firewall
6.03	Implement Unicast Reverse Path Forwarding (uRPF)
6.04	Implement IP Source Guard
6.05	Implement authentication, authorization, and accounting (AAA) (configuring the AAA server is not required, only the client-side (IOS) is configured)
6.06	Implement Control Plane Policing (CoPP)
6.07	Implement Cisco IOS Firewall
6.08	Implement Cisco IOS Intrusion Prevention System (IPS)
6.09	Implement Secure Shell (SSH)
6.10	Implement 802.1x
6.11	Implement NAT
6.12	Implement routing protocol authentication
6.13	Implement device access control
6.14	Implement security features
7.00	Implement Network Services
7.10	Implement Hot Standby Router Protocol (HSRP)
7.20	Implement Gateway Load Balancing Protocol (GLBP)
7.30	Implement Virtual Router Redundancy Protocol (VRRP)
7.40	Implement Network Time Protocol (NTP)
7.50	Implement DHCP
7.60	Implement Web Cache Communication Protocol (WCCP)
8.00	Implement Quality of Service (QoS)
8.10	Implement Modular QoS CLI (MQC)
	(a) Network-Based Application Recognition (NBAR)
	(b) Class-based weighted fair queuing (CBWFQ), modified deficit round robin (MDRR), and low latency queuing (LLQ)
	(c) Classification
	(d) Policing
	(e) Shaping
	(f) Marking
	(g) Weighted random early detection (WRED) and random early detection (RED)
	(h) Compression
8.20	Implement Layer 2 QoS: weighted round robin (WRR), shaped round robin (SRR), and policies
8.30	Implement link fragmentation and interleaving (LFI) for Frame Relay
8.40	Implement generic traffic shaping
8.50	Implement Resource Reservation Protocol (RSVP)
8.60	Implement Cisco AutoQoS
9.00	Troubleshoot a Network
9.10	Troubleshoot complex Layer 2 network issues
9.20	Troubleshoot complex Layer 3 network issues
9.30	Troubleshoot a network in response to application problems
9.40	Troubleshoot network services
9.50	Troubleshoot network security
10.00	Optimize the Network
10.01	Implement syslog and local logging
10.02	Implement IP Service Level Agreement SLA
10.03	Implement NetFlow
10.04	Implement SPAN, RSPAN, and router IP traffic export (RITE)
10.05	Implement Simple Network Management Protocol (SNMP)
10.06	Implement Cisco IOS Embedded Event Manager (EEM)
10.07	Implement Remote Monitoring (RMON)
10.08	Implement FTP
10.09	Implement TFTP
10.10	Implement TFTP server on router
10.11	Implement Switch-module Configuration Protocol (SCP)
10.12	Implement HTTP and HTTPS
10.13	Implement Telnet

CCIE ® Routing and Switching Written Exam Topics (Blueprint) v4.0

2009-06-16T11:11:00.002+08:00

The comprehensive CCIE R&S Written Exam (#350-001) has 100 multiple-choice questions and is two hours in duration. The topic areas listed are general guidelines for the type of content that is likely to appear on the exam. Please note, however, that other relevant or related topic areas may also appear.

Exam Sections and Sub-task Objectives

1.00	Implement Layer 2 Technologies	√
1.10	Implement Spanning Tree Protocol (STP)
	(a) 802.1d
	(b) 802.1w
	(c) 801.1s
	(d) Loop guard
	(e) Root guard
	(f) Bridge protocol data unit (BPDU) guard
	(g) Storm control
	(h) Unicast flooding
	(i) Port roles, failure propagation, and loop guard operation
1.20	Implement VLAN and VLAN Trunking Protocol (VTP)
1.30	Implement trunk and trunk protocols, EtherChannel, and load-balance
1.40	Implement Ethernet technologies
	(a) Speed and duplex
	(b) Ethernet, Fast Ethernet, and Gigabit Ethernet
	(c) PPP over Ethernet (PPPoE)
1.50	Implement Switched Port Analyzer (SPAN), Remote Switched Port Analyzer (RSPAN), and flow control
1.60	Implement Frame Relay
	(a) Local Management Interface (LMI)
	(b) Traffic shaping
	(c) Full mesh
	(d) Hub and spoke
	(e) Discard eligible (DE)
1.70	Implement High-Level Data Link Control (HDLC) and PPP
2.00	Implement IPv4
2.10	Implement IP version 4 (IPv4) addressing, subnetting, and variable-length subnet masking (VLSM)
2.20	Implement IPv4 tunneling and Generic Routing Encapsulation (GRE)
2.30	Implement IPv4 RIP version 2 (RIPv2)
2.40	Implement IPv4 Open Shortest Path First (OSPF)
	(a) Standard OSPF areas
	(b) Stub area
	(c) Totally stubby area
	(d) Not-so-stubby-area (NSSA)
	(e) Totally NSSA
	(f) Link-state advertisement (LSA) types
	(g) Adjacency on a point-to-point and on a multi-access network
	(h) OSPF graceful restart
2.50	Implement IPv4 Enhanced Interior Gateway Routing Protocol (EIGRP)
	(a) Best path
	(b) Loop-free paths
	(c) EIGRP operations when alternate loop-free paths are available, and when they are not available
	(d) EIGRP queries
	(e) Manual summarization and autosummarization
	(f) EIGRP stubs
2.60	Implement IPv4 Border Gateway Protocol (BGP)
	(a) Next hop
	(b) Peering
	(c) Internal Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP)
2.70	Implement policy routing
2.80	Implement Performance Routing (PfR) and Cisco Optimized Edge Routing (OER)
2.90	Implement filtering, route redistribution, summarization, synchronization, attributes, and other advanced features
3.00	Implement IPv6
3.10	Implement IP version 6 (IPv6) addressing and different addressing types
3.20	Implement IPv6 neighbor discovery
3.30	Implement basic IPv6 functionality protocols
3.40	Implement tunneling techniques
3.50	Implement OSPF version 3 (OSPFv3)
3.60	Implement EIGRP version 6 (EIGRPv6)
3.70	Implement filtering and route redistribution
4.00	Implement MPLS Layer 3 VPNs
4.10	Implement Multiprotocol Label Switching (MPLS)
4.20	Implement Layer 3 virtual private networks (VPNs) on provider edge (PE), provider (P), and customer edge (CE) routers
4.30	Implement virtual routing and forwarding (VRF) and Multi-VRF Customer Edge (VRF-Lite)
5.00	Implement IP Multicast
5.10	Implement Protocol Independent Multicast (PIM) sparse mode
5.20	Implement Multicast Source Discovery Protocol (MSDP)
5.30	Implement interdomain multicast routing
5.40	Implement PIM Auto-Rendezvous Point (Auto-RP), unicast rendezvous point (RP), and bootstrap router (BSR)
5.50	Implement multicast tools, features, and source-specific multicast
5.60	Implement IPv6 multicast, PIM, and related multicast protocols, such as Multicast Listener Discovery (MLD)
6.00	Implement Network Security
6.01	Implement access lists
6.02	Implement Zone Based Firewall
6.03	Implement Unicast Reverse Path Forwarding (uRPF)
6.04	Implement IP Source Guard
6.05	Implement authentication, authorization, and accounting (AAA) (configuring the AAA server is not required, only the client-side (IOS) is configured)
6.06	Implement Control Plane Policing (CoPP)
6.07	Implement Cisco IOS Firewall
6.08	Implement Cisco IOS Intrusion Prevention System (IPS)
6.09	Implement Secure Shell (SSH)
6.10	Implement 802.1x
6.11	Implement NAT
6.12	Implement routing protocol authentication
6.13	Implement device access control
6.14	Implement security features
7.00	Implement Network Services
7.10	Implement Hot Standby Router Protocol (HSRP)
7.20	Implement Gateway Load Balancing Protocol (GLBP)
7.30	Implement Virtual Router Redundancy Protocol (VRRP)
7.40	Implement Network Time Protocol (NTP)
7.50	Implement DHCP
7.60	Implement Web Cache Communication Protocol (WCCP)
8.00	Implement Quality of Service (QoS)
8.10	Implement Modular QoS CLI (MQC)
	(a) Network-Based Application Recognition (NBAR)
	(b) Class-based weighted fair queuing (CBWFQ), modified deficit round robin (MDRR), and low latency queuing (LLQ)
	(c) Classification
	(d) Policing
	(e) Shaping
	(f) Marking
	(g) Weighted random early detection (WRED) and random early detection (RED)
	(h) Compression
8.20	Implement Layer 2 QoS: weighted round robin (WRR), shaped round robin (SRR), and policies
8.30	Implement link fragmentation and interleaving (LFI) for Frame Relay
8.40	Implement generic traffic shaping
8.50	Implement Resource Reservation Protocol (RSVP)
8.60	Implement Cisco AutoQoS
9.00	Troubleshoot a Network
9.10	Troubleshoot complex Layer 2 network issues
9.20	Troubleshoot complex Layer 3 network issues
9.30	Troubleshoot a network in response to application problems
9.40	Troubleshoot network services
9.50	Troubleshoot network security
10.00	Optimize the Network
10.01	Implement syslog and local logging
10.02	Implement IP Service Level Agreement SLA
10.03	Implement NetFlow
10.04	Implement SPAN, RSPAN, and router IP traffic export (RITE)
10.05	Implement Simple Network Management Protocol (SNMP)
10.06	Implement Cisco IOS Embedded Event Manager (EEM)
10.07	Implement Remote Monitoring (RMON)
10.08	Implement FTP
10.09	Implement TFTP
10.10	Implement TFTP server on router
10.11	Implement Switch-module Configuration Protocol (SCP)
10.12	Implement HTTP and HTTPS
10.13	Implement Telnet
11.00	Evaluate proposed changes to a Network
11.01	Evaluate interoperability of proposed technologies against deployed technologies
	(a) Changes to routing protocol parameters
	(b) Migrate parts of a network to IPv6
	(c) Routing Protocol migration
	(d) Adding multicast support
	(e) Migrate spanning tree protocol
	(f) Evaluate impact of new traffic on existing QoS design
11.02	Determine operational impact of proposed changes to an existing network
	(a) Downtime of network or portions of network
	(b) Performance degradation
	(c) Introducing security breaches
11.03	Suggest Alternative solutions when incompatible changes are proposed to an existing network
	(a) Hardware/Software upgrades
	(b) Topology shifts
	(c) Reconfigurations