Monday, March 31, 2008

A couple of good advice for Cisco CCIE Lab first taker

Found 2 good links on Netpro forum for CCIE lab first taker:

LAB VISIT - Good Advice !!! (Part 1)
http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Career%20Certifications&topic=Certifications&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd6c507

Quoted from the link:

I recently visited RTP's CCIE Lab. I strongly recommend making the visit before your first time at a test site. Knowing the route, the building and speaking with one of the proctors who answered many questions helps. This has been reviewed by someone at Cisco (so no fear of NDA violation) I hope this info is helpful.

How do I access the rack?
- RTP's desks are located right next to the open rack. It's reassuring to see physical layout & cabling, but DO NOT TOUCH. I wasn't told this, but common sense that candidates keep hands off. If you think there's a problem with connections or the equipment, tell proctor immediately, and leave it to them. If there's a problem, they'll work with you, but if you mess with the equipment' Just Don't Touch.
- The PC can telnet to a comm sever (looked like 25xx) pre-configured to access your rack. A good thing about this: keep several telnet windows open (using Secure CRT) without need to 'CTRL-SHIFT-6, x' between sessions.

What version of the Doc CD is used?
- RTP has filtered access to online documentation site: http://www.cisco.com/univercd/home/home.htm. The search page, HW & SW docs and any link that starts with http://www.cisco.com/univercd/ will work, but some of CCO (white papers & tech notes) are blocked.

What's the desk like? (may vary by site)
- Desks are roughly 48'x30', with low cubicle wall on 3 sides.
- RTP uses 17' CRT's with the res locked down (1280x1024, I think)
- Keyboards are std 104-key keyboards like this one: http://www.execgroup.net/images/IBMkey.jpg
- There's no way to save files; if you use notepad for copy/paste, you can't save file.
- No printers, you can't print configs or debug/show output to review or make notes on.

What materials are provided or allowed?
- White, ltr-size copy paper is provided; you're started with 2 sheets, but proctor will provide as needed.
- Absolutely no outside items are permitted in the lab. Several pencils, of various colors, are provided. No pens, pencils, markers or highlights are allowed to be brought into the lab.
- No notebooks, pads, paper, Post-it notes or flags are allowed in the lab.
- There are no lockers to keep personal items during the exam, so leave everything home or in car.

LAB VISIT - Good Advice !!! (Part 2)
http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Career%20Certifications&topic=Certifications&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd6c509

Quoted from the link:

I recently visited RTP's CCIE Lab. I strongly recommend making the visit before your first time at a test site. Knowing the route, the building and speaking with one of the proctors who answered many questions helps. This has been reviewed by someone at Cisco (so no fear of NDA violation) I hope this info is helpful.

What about the exam booklet?
- The exam is in a 3-ring binder, with diagrams and test enclosed in sheet protectors. You may take pages out of the binder, but are not permitted to remove the paper from the protector.
- Any writing directly on the sheet protector, or the paper itself will result in DISQUALIFICATION and one year ban from the test, (other violations provide for up to a lifetime ban http://www.cisco.com/en/US/learning/le3/ccie/exam/violation_rules.html)

Time / breaks
- Start time is practically written in stone. Don't be late, a briefing is done as a group, everyone starts at the same time. If you arrive late, you will have less than 8 hours to finish the lab.
- There is a wall clock (matches PC's clock) Based on time proctor started the exam, end time will be written on a white-board.
- The lunch break is 20-30 minutes, (proctor will give a 5 min warning) Lunch is from a local catering company, if you have food requirements, you may be best off bagging it. Beverages may be brought to the desk, but be careful.
- The proctor will provide a warning about 15 min before the end of the lab (helpful for those candidates who have completely zoned, and may have lost track of the time.)

Comments
- Provide comments and descriptions in the config at least where required by the exam. Additional remarks may be personally helpful, but if you are trying to explain why you chose one feature or command over any other, remember that scoring depends only on whether an objective was met, not how, so the comments will not sway the proctor's scoring.

Good exam strategy:
- Review the entire test before doing any configurations
- Group questions by comfort level, and knock out the sections you know very well, followed by sections you think you know, then sections you need to refer to documentation for. This will help you get the more points up front, instead of missing out on them by running out of time.
- Save configurations often throughout the exam bugs and power glitches can spoil an exam (BTW - it's a myth that the proctors start their grading by power cycling the rack, but why take the chance ' SAVE OFTEN!)




Virtual Switching System (VSS) Conversion

IOS: 12.2(33)SXH1

The conversion process involves 4 steps:

1. Configure Virtual Switch Domain and desingate each switch as either Switch 1 or Switch 2
2. Configure priority
3. Configure Virtual Switching Links (VSL)
4. Execute the Conversion command after which the switches will reload

Configure the Virtual Switch Domain
The virtual switch domain is a grouping of 2 members of VSS with an ID from 1-255, which both members must match this number in the virtual switch domain.

On switch 1:
sw1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
sw1(config)#switch virtual domain 1
Domain ID 1 config will take effect only
after the exec command 'switch convert mode virtual' is issued
sw1(config-vs-domain)#switch 1
sw1(config-vs-domain)#

On switch 2:
sw2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
sw2(config)#switch virtual domain 1
Domain ID 1 config will take effect only
after the exec command 'switch convert mode virtual' is issued
sw2(config-vs-domain)#switch 2
sw2(config-vs-domain)#


Configure Priority
Higher priority node will assume active virtual switch, similar to HSRP.

On Switch 1:
sw1(config-vs-domain)#switch 1 priority 110
sw1(config-vs-domain)#switch 2 priority 100

On Switch 2:
sw2(config-vs-domain)#switch 1 priority 110
sw2(config-vs-domain)#switch 2 priority 100


Configuring VSL

On Switch 1:
sw1(config)#interface port-channel 1
sw1(config)#no shut
sw1(config-if)#switch virtual link 1
sw1(config-if)#exit
sw1(config)#interface range tenGigabitEthernet 1/4 - 5
sw1(config-if-range)#no shut
sw1(config-if-range)#channel-group 1 mode on
sw1(config-if-range)#^Z

On Switch 2:
sw2(config)#int port-channel 2
sw2(config-if)#no shut
sw2(config-if)#switch virtual link 2
sw2(config-if)#exit
sw2(config)#interface range tenGigabitEthernet 1/4 – 5
sw2(config-if-range)#no shut
sw2(config-if-range)#channel-group 2 mode on
sw2(config-if-range)#^Z

Executing Conversion

On Switch 1:
sw1#switch convert mode virtual
This command will convert all interface names
to naming convention "interface-type switch-number/slot/port",
save the running config to startup-config and
reload the switch.
Do you want to proceed? [yes/no]: yes
Converting interface names
Building configuration...

On Switch 2:
sw2#switch convert mode virtual
This command will convert all interface names
to naming convention "interface-type switch-number/slot/port",
save the running config to startup-config and
reload the switch.
Do you want to proceed? [yes/no]: yes
Converting interface names
Building configuration...

You will see these output on the switch processor during reload:
Switch 1:
Initializing as Virtual Switch active

Switch 2:
Initializing as Virtual Switch standby

After reload, switch 2's console is no longer available:
sw1-sdby>
Standby console disabled
sw1-sdby>
Standby console disabled

One last step to complete the conversion:

sw1#switch accept mode virtual
This command will bring in all VSL configurations from the standby switch and populate
it into the running configuration. In addition the startup configurations will be updated with
the new merged configurations.
Do you want proceed? [yes/no]: yes
Merging the standby VSL configuration. . .
Building configuration...
[OK]






Sunday, March 30, 2008

Cisco Telepresence Discussion on Climate Change

Nobel Laureate Al Gore and Cisco CEO John Chambers host a virtual discussion on Climate Change and Technology Innovation via Cisco TelePresence








Saturday, March 29, 2008

While.....do.....done

This is one of my most frequently use iteration statement when I want to poll something and view something.

Let me give you a stupid example:

[root@panda ~]# while true; do date; sleep 5; done
Sat Mar 29 18:36:06 PDT 2008
Sat Mar 29 18:36:11 PDT 2008


Thursday, March 27, 2008

QR Code


Playing with QR code, pretty interesting and I can see lots of opportunities with this 2D bar code technology.

Some resources to share:

Online QR-Code Generator (Encoder)
http://qrcode.kaywa.com/

Online QR-Code Decoder
http://zxing.org/w/decode.jspx

ZXing (Zebra Crossing) - Java QR Code API
http://code.google.com/p/zxing/

I'm using QuickMark on my Dopod D810 for QR code photo decoding:
http://www.quickmark.com.tw




Tuesday, March 25, 2008

Conferencing Resources


A very usual question from people is, how many conference can I have, and how many parties can join a conference. Let me summarize below:

For Single-mode conference (G.711)
- PVDM - maximum 6 parties per conference
- ISR/PVDM2 - maximum 8 parties per conference
- WS-X6608 - maximum 16 parties per conference
- IPVMS - maximum 48 parties per conference
- CMM/ACT - maximum 64 parties per conference

For PVDM2, max 8 parties are allowed per conference, and 8 conferences are allowed per DSP. For using IPVMS in CUCM, maximum 48 parties are allowed per conference.

These are all G.711 values.

For example, if I have a PVDM2-16 = 2 DSPs = 2 x 8 conferences = max 16 conferences x 8 participants = 128 conference parties.

Max no. of conference per domain is 50 with 400 participants because of HW / IO limitation.

For mixed-mode conference (G.711 + G.729a)
- 2 conferences per DSP and 8 participants per conference.

SMTP server troubleshooting with mail commands

The very first step for SMTP server troubleshooting is to telnet to the smtp server 25/tcp, and issue mail commands see if it is functioning properly.

Here is an example:


NetBIOS name lookup with nmblookup

nmblookup is a handy tool to lookup the NetBIOS name information on your network. If you want to check the NetBIOS name of 1.2.3.4:

# nmblookup -A 1.2.3.4
Looking up status of 1.2.3.4
PANDAEATSBAMBOO <00> - B
PANDAEATSBAMBOO <20> - B
WORKGROUP <00> - B
WORKGROUP
<1e> - B

And you can do a reverse lookup as well.

# nmblookup pandaeatsbamboo
querying desktop on 1.2.3.255
1.2.3.4 pandaeatsbamboo <00>

Build your own RPM package

I'm sure you don't want to build the software from source for 200 servers in your server farm. You want to do it in a smarter way. Build your own rpm and distribute to your servers is certainly smarter and faster.

I'm using my home directory /home/panda to build the rpm. Firstly, please create the folders in the following structure:

/home/panda/rpm
BUILD RPMS SOURCES SPECS SRPMS

/home/panda/rpm/RPMS
athlon i386 i486 i586 i686 noarch

Put your source code tar ball in the SOURCES directory.

Create .rpmmacros in user home directory /home/panda, with the following text in your macro file:

%_topdir /home/panda/rpm

Then put your spec file in the SPECS folder, run rpmbuild and get a cup of coffee.

rpmbuild -ba rpm/SPECS/bamboo.spec

OpenSSL Cheatsheet

A. Generate your own CA

openssl req –x509 –days 1460 –newkey rsa:2048 –keyout ca-key.pem –out ca-crt.pem


Show Certificate Properties

openssl –x509 –in crt.pem –noout –text


Change Certificate to binary DER format

openssl –x509 –in ca-crt.pem –outform DER –out ca-crt.der


B. Generate a host certificate


Make the private key and CSR

openssl req –newkey rsa:1024 –keyout host-key.pem –out host-csr.pem


Sign the CSR by CA

If you have want to sign by the root CA specified in openssl.cnf,

openssl ca –in host-csr.pem –days 365 –out host-crt.pem –notext



Otherwise,

openssl x509 -req -days 365 -in host-csr.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out host-crt.pem


Export the certificate and the private key to PKCS#12 format

openssl pkcs12 –export –inkey host-key.pem \

-in host-crt.pem –name “panda” \

-certfile ca-crt.pem –caname “Panda CA” \

-out host-crt.p12


C. Another way to make the host certificate

1. openssl genrsa –des3 –out new-key.pem 1024
2. openssl req –new –days 3650 –key new-key.pem –out new-csr.pem
3. openssl ca –in new-csr.pem –keyfile ./demoCA/private/ca-key.pem –cert ./demoCA/ca-crt.pem –out new-crt.pem


D. Extract keys and cert from PKCS#12

openssl pkcs12 –in my-crt.p12 –clcerts –nokeys –out usr-crt.pem

openssl pkcs12 –in my-crt.p12 –nocerts –out usr-key.pem


E. Print out certificate hash value

openssl x509 -hash -noout –in ca-crt.pem