Is having a home lab like having a home gym?

One of the things a CCIE candidate will need to come to terms with sooner or later is practising for the lab exam. Unless you are in the situation where your daily work tasks enable you to touch every single section on the blue print (not me) you are probably going to need time to play around with the areas you feel the least confident with.

If you go through the bill of materials that vendors such as IPX (pdf) or INE (pdf) use in their topologies and more importantly what hardware and software types Cisco specifies you will see in the lab exam, you are going to need a fair bit of kit at home and even if you are a good ebayer, it's not going to be very cheap.

To be fair, training vendors are well aware of this, and one thing they have rental facilities where you can use their equipment and it's already wired up to their topology, and most have the capability to load the equipment up with exercises from the workbooks enabling you to get right into it.  I expect that this equipment would be what they use for their bootcamps as well.  This would be a rough equivalent of going to a gym - you are handing over your money for an allotted amount of time, you book your time in advance by not using the session you are costing yourself money.

The other extreme would be to get the equipment that matches the vendor of your choices topology and it's available whenever you feel like using it - this is the home gym.  The typical problem people associate with a home gym is that it sounds good particularly when you start out, you may not be able to get the top line product because you aren't rich, or perhaps you are able to swing it and for the first while it's good.  The problem is that you need a lot of self discipline to go and do it, since you don't have to start at a particular time - you may not get around to starting but going for the CCIE anyway is going to require a good amount of self discipline either way.

I think this analogy is falling pretty flat because at an actual gym, you might have a personal trainer or at the very least you can see the other people at the gym working out, so perhaps going to a bootcamp may be closer to going to the gym but really that is probably a very small portion of your overall studies (and you may not even go to a bootcamp)

Home lab or rack rental - I think both have their place and the best choice will be on an individual basis.  In my case I made the call for a home lab, I like the idea of being able to use my gear whenever I want, should it be for 30 minutes or a full day and the configs are exactly as I left it.  I like the idea of a rack rental, I think it may even be more cost effective in the end, I just don't like the idea of having to book resources on a lab, and if I need to cut things short because of work or family, then its like throwing money away.  Rick Mur makes a compelling argument for using rack rentals. That said, when I finally get on the homeward stretch and believe I am near ready for the lab, I think I will be booking time on some mocklabs.  When it's all said and done, if you have a home lab, you have the ability to sell off your equipment when you have finished (or decided that you have had enough) depending on the time frame from when you buy your equipment until you sell it, you may be able to recoup a reasonable portion of your spendings.

For my home lab  I will be virtualising the routers and using physical switches, if I find this set up not very successful, I may sell of the switches and end up going for rack rentals.  It's early days on this blog and perhaps there aren't many readers at the moment but I would be certainly interested in other CCIE candidates thoughts on the matter.

Remote Access using OpenVPN with DD-WRT

This is going to be a long post today...

DD-WRT is an awesome wireless router distribution.  I have had it installed on my Linksys WRT54Gv2 for quite some time (I have an ADSL modem that is bridged to the WAN port on the Linksys, so it provides the border function into my home LAN) but only in the last few days have I thought about using the VPN capability to remotely access my home lab when I have some free time at work or at a friends place and would like to access some of my files at home.

OpenVPN is an open source VPN SSL server and client that is available for Linux, Mac and Windows systems and can connect to Cisco routers too.  There is a firmware for DD-WRT that contains OpenVPN and has a pretty good interface to use assuming you don't want to do anything too hardcore.

What I wanted to do was something I thought relatively simple and the OpenVPN page has links and describes what to do, it just took a little bit of reading and checking to get things right in my situation, so I am documenting what I did - maybe it will be helpful to others in the future.

Firmware
Ensuring that you have the right firmware for your device is important, there are all sorts of warnings about doing firmware upgrades since you can "brick" your router if you do things wrongly.  All I will say here is that obviously you need  V2.4 SP1 or better with VPN capability, I'm pretty sure the standard image does not support OpenVPN - in my particular case I used dd-wrt.v24_vpn_generic.bin but please ensure you get the right firmware for your device.  The procedure to install the firmware is quite specific and nearly voodoo ritualistic but should be followed word for word to ensure that you don't break your device.

Dynamic DNS
I don't have a static IP address, and even if I did remembering it was not going to be something I really wanted to waste my memory on.  There are quite a number of Free DDNS providers and built in capability for DD-WRT to use them. The DDNS page on the DD-WRT site easily explains what to do there.

Creating Certificates
I used my ubuntu server to create the certificates used here, the process is most likely the same for other systems.  The ubuntu box isn't actually doing anything specific for the vpn, it's just handy for me to create certificates here.

I needed to install openvpn as it wasnt included in the standard server install

adam@labserver1:~$ sudo apt-get install openvpn

I am going to stick with the default 1024 bit keys as I am not sure how much space is available in the nvram on my WRT54G even though 2048 bit keys would be more secure.

Creating the Certificate Authority
The values for variables are specific to my case, feel free to modify the values to your own situation.

adam@labserver1:~$ sudo su
root@labserver1:~# cd /usr/share/doc/openvpn/examples/easy-rsa/2.0/
root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys
root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./clean-all
root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./build-ca
Generating a 1024 bit RSA private key
........................++++++
...++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:AU
State or Province Name (full name) [CA]:QLD
Locality Name (eg, city) [SanFrancisco]:Brisbane
Organization Name (eg, company) [Fort-Funston]:Family
Organizational Unit Name (eg, section) []:Home
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:server
Email Address [me@myhost.mydomain]:example@example.com

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./build-key-server server
Generating a 1024 bit RSA private key
........................................................................++++++
.++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:AU
State or Province Name (full name) [CA]:QLD
Locality Name (eg, city) [SanFrancisco]:Brisbane
Organization Name (eg, company) [Fort-Funston]:Family
Organizational Unit Name (eg, section) []:Home
Common Name (eg, your name or your server's hostname) [server]:server
Email Address [me@myhost.mydomain]:example@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:secretpassword
An optional company name []:Family
Using configuration from /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'AU'
stateOrProvinceName   :PRINTABLE:'QLD'
localityName          :PRINTABLE:'Brisbane'
organizationName      :PRINTABLE:'Family'
organizationalUnitName:PRINTABLE:'Home'
commonName            :PRINTABLE:'server'
emailAddress          :IA5STRING:'example@example.com'
Certificate is to be certified until Feb 20 07:43:23 2020 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Creating the DH file

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
............................+.......................+.......+.+.....................+.....................................+.......................+............................................................................................................................+..........+..............+.+..............................+.....+...........................................................................................................+..........................................+.........................+................................+.......++*++*++*

Creating the User certificate
This is what will be used to identify the remote user

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./build-key client1
Generating a 1024 bit RSA private key
..........++++++
...........................++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:AU
State or Province Name (full name) [CA]:QLD
Locality Name (eg, city) [SanFrancisco]:Brisbane
Organization Name (eg, company) [Fort-Funston]:Family
Organizational Unit Name (eg, section) []:Home
Common Name (eg, your name or your server's hostname) [client1]:client1
Email Address [me@myhost.mydomain]:example@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:adifferentsecretpassword
An optional company name []:Home
Using configuration from /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'AU'
stateOrProvinceName   :PRINTABLE:'QLD'
localityName          :PRINTABLE:'Brisbane'
organizationName      :PRINTABLE:'Family'
organizationalUnitName:PRINTABLE:'Home'
commonName            :PRINTABLE:'client1'
emailAddress          :IA5STRING:'example@example.com'
Certificate is to be certified until Feb 20 07:45:17 2020 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Configuring OpenVPN on DD-WRT
The interface to set this up is pretty handy and can all be done through the web interface.  Navigate to the "Services Tab" and in the "OpenVPN Daemon" Box tick enable for Start OpenVPN.

I have the Start Type as "WAN Up"

In the text box titled "Public Server Certificate" I pasted in the entire output from the command below that I ran on the ubuntu box (make sure to include the BEGIN CERTIFICATE and END CERTIFICATE Lines)

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' keys/server.crt
-----BEGIN CERTIFICATE-----
Blah Blah Certificate
quite a few lines of what looks like random junk
-----END CERTIFICATE-----

In the text box titled "Public Client Cert" I pasted in the output from the command below.

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' keys/client1.crt
-----BEGIN CERTIFICATE-----
Blah Blah Certificate
quite a few lines of what looks like random junk similar but different to the server cert
-----END CERTIFICATE-----

In the text box titled "Private Client Key" the output below was pasted in.

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# cat keys/server.key
-----BEGIN RSA PRIVATE KEY-----
Blah Blah Key
quite a few lines of what looks like random junk similar but different to the server cert
-----END RSA PRIVATE KEY-----

In the text box titled "DH PEM" The output below was pasted in.

root@labserver1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# cat keys/dh1024.pem
-----BEGIN DH PARAMETERS-----
Blah blah DH
-----END DH PARAMETERS-----

The OpenVPN  Config box is very much installation specific, there are different methods available - this one is a routed (tunnel mode rather than bridging) case, to explain the details of my particular configuration:

192.168.1.0/24 is my internal LAN segment that I want to access via OpenVPN
192.168.99.0/24 is going to be the segment that remote users terminate on (basically a loopback - tun0 on the DD-WRT box - remote users will be allocated an IP on this segment)
Routing will occur on the DD-WRT box (devices on the 192.168.1.0/24 segment have the DD-WRT box as their default gateway) and remote users will have a route to 192.168.1.0/24 pushed out to them with the DD-WRT box as the next-hop (and 192.168.1.254 will be pushed as a DNS server for resolving LAN hostnames for the remote)
I'm using the default UDP Port 1154 configuration for the VPN termination and enabling compression.
The filenames and paths in the configuration match where DD-WRT stores the information we entered above

server 192.168.99.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.254"

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

# Only use crl-verify if you are using the revoke list - otherwise leave it commented out
# crl-verify /tmp/openvpn/ca.crl

# management parameter allows DD-WRT's OpenVPN Status web page to access the server's management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001
#verb is used for debug output - level 6 is quite detailed for troubleshooting problems
#telnet to the router and tail -f /var/log/messages to see a realtime trace
#verb 6
comp-lzo

Ok... Quite a lot of work on this tab - time to click Save and Click on "Administration" and select "Commands"

Now we have to allow the VPN traffic into the router for processing.  In the Command shell tab we enter these iptables rules (Remember to change these to match your particular situation)

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.99.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Now Click on the "Save Firewall" button and go and reboot the router.

Things to check once rebooted - the firewall is correct (telnet into the box and do "iptables --list" to see that the above settings are present and that the openvpn daemon is operational.

root@DD-WRT:~# ps | grep openvpn
  790 root      2276 S    openvpn --config /tmp/openvpn/openvpn.conf --route-up
 1340 root      1164 S    grep openvpn

Now it is time to set up the Remote Access box - in my case I have an XP laptop with a 3G Network connection that wants to connect.

The first thing to do is to install the OpenVPN Windows GUI version once this is done, we shall create a configuration in C:\Program Files\OpenVPN\Config - it is just a text file with a .ovpn extension.

# Simple OpenVPN client configuration
client
dev tun
proto udp
remote ddnsnameofdd-wrt.router 1194
resolv-retry infinite
nobind
mute-replay-warnings
ca c:\\certs\\ca.cert
cert c:\\certs\\client1.crt
key c:\\certs\\client1.key
comp-lzo
# Set the verbosity level when troubleshooting connections
#verb 6

Create a certs directory on C drive and copy across those files (ca.cert, client1.crt and client1.key) from the ubuntu box (using WinSCP on the local LAN or using a USB stick)

Now on the laptop I ensure that the LAN connection (wired and wireless is inactive) and connect to the internet

We can verify this by looking at the interface state and routing table

C:\>ipconfig /all
Windows IP Configuration
Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected

Ethernet adapter Wireless Network Connection:
        Media State . . . . . . . . . . . : Media disconnected

Ethernet adapter {0AD0400A-2C26-4AA0-B897-E97750F48671}:
        Media State . . . . . . . . . . . : Media disconnected

PPP adapter 3G:
        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 220.a.b.c
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 220.a.b.c

C:\>netstat -rn
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        220.a.b.c  220.a.b.c      1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1      1
        220.a.b.c  255.255.255.255        127.0.0.1       127.0.0.1      50
        220.a.b.d  255.255.255.255        220.a.b.c  220.a.b.c      50
        224.0.0.0        240.0.0.0        220.a.b.c  220.a.b.c      1
  255.255.255.255  255.255.255.255        220.a.b.c               3      1
  255.255.255.255  255.255.255.255        220.a.b.c               2      1
  255.255.255.255  255.255.255.255        220.a.b.c  220.a.b.c      1
  255.255.255.255  255.255.255.255        220.a.b.c               4      1
Default Gateway:         220.a.b.c

Now double click on the OpenVPN GUI icon and a connection should initiate and in a few seconds you should see an indication of a connection.

We can verify this by looking at the interface state and routing table since we should see an ip address on the 192.168.99.0/24 segment and a route to 192.168.1.0/24

C:\>ipconfig /all
Windows IP Configuration
Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected

Ethernet adapter Wireless Network Connection:
        Media State . . . . . . . . . . . : Media disconnected

Ethernet adapter {0AD0400A-2C26-4AA0-B897-E97750F48671}:
        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : TAP-Win32 Adapter V8 - Packet Scheduler Miniport
        Physical Address. . . . . . . . . : 00-FF-0A-D0-40-0A
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.99.6
        Subnet Mask . . . . . . . . . . . : 255.255.255.252
        Default Gateway . . . . . . . . . :
        DHCP Server . . . . . . . . . . . : 192.168.99.5
        DNS Servers . . . . . . . . . . . : 192.168.1.254
        Lease Obtained. . . . . . . . . . : Saturday, 20 February 2010 2:42:47 PM
        Lease Expires . . . . . . . . . . : Sunday, 20 February 2011 2:42:47 PM

PPP adapter 3G:
        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 220.a.b.c
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 220.a.b.c

C:\>netstat -rn
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        220.a.b.c  220.a.b.c      1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1      1
      192.168.1.0    255.255.255.0     192.168.99.5    192.168.99.6      1
     192.168.99.1  255.255.255.255     192.168.99.5    192.168.99.6      1
     192.168.99.4  255.255.255.252     192.168.99.6    192.168.99.6      30
     192.168.99.6  255.255.255.255        127.0.0.1       127.0.0.1      30
   192.168.99.255  255.255.255.255     192.168.99.6    192.168.99.6      30
        220.a.b.c  255.255.255.255        127.0.0.1       127.0.0.1      50
        220.a.b.d  255.255.255.255        220.a.b.c  220.a.b.c      50
        224.0.0.0        240.0.0.0        220.a.b.c  220.a.b.c      1
  255.255.255.255  255.255.255.255        220.a.b.c               3      1
  255.255.255.255  255.255.255.255        220.a.b.c               2      1
  255.255.255.255  255.255.255.255        220.a.b.c  220.a.b.c      1
  255.255.255.255  255.255.255.255        220.a.b.c               4      1
Default Gateway:         220.a.b.c

Now to confirm that we can connect to a device on the LAN from the VPN Client

C:\>ping 192.168.1.250
Pinging 192.168.1.250 with 32 bytes of data:
Reply from 192.168.1.250: bytes=32 time=1722ms TTL=63
Reply from 192.168.1.250: bytes=32 time=856ms TTL=63
Reply from 192.168.1.250: bytes=32 time=983ms TTL=63
Reply from 192.168.1.250: bytes=32 time=669ms TTL=63

Ping statistics for 192.168.1.250:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 669ms, Maximum = 1722ms, Average = 1057ms
C:\>telnet 192.168.1.250
2610>exit

Connection to host lost.

Success! Please note that the high latency is mainly due to where I am doing the testing has poor mobile coverage and is using GPRS rather than a decent 3G connection.

If things do not appear to work:

• Check OpenVPN is running (ps | grep openvpn)
• Check that the firewall configuration is correct
• Turning on the verbosity and checking the logs is very helpful
• Verify that the DDNS config is working - if you do a nslookup on the DDNS hostname from the remote, does it actually match the WAN IP address of the server? The DD-WRT control panel displays the WAN IP.

2610 with NM-4A/S acting as a terminal server

As mentioned previously, my 2509 was on its way out and that I needed a replacement terminal server.

I had a 2610 with NM-4A/S that used to be my frame switch using back-to-back DCE-DTE serial cables against a number of 2500s from my CCNP studies. With the appropriate RS-232 cables this ended up being  a fairly cheap replacement as 2509s and 2511s still go for a pretty penny on ebay.

The NM-4A/S is a 4 port network module that can operate in synchronous or asynchronous mode.  The first thing to do is to set the ports to asynch.

interface Serial1/0
 physical-layer async
 no ip address
 no ip directed-broadcast
 no shutdown
!
interface Serial1/1
 physical-layer async
 no ip address
 no ip directed-broadcast
 no shutdown
!
interface Serial1/2
 physical-layer async
 no ip address
 no ip directed-broadcast
 no shutdown
!
interface Serial1/3
 physical-layer async
 no ip address
 no ip directed-broadcast
 no shutdown
!

Then we need to set the line configuration up - firstly we need to associate the line (vty) against the physical interface

2610#sh line
 Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
   0 CTY              -    -      -    -    -      0       1     0/0       -
  33 TTY   9600/9600  -    -      -    -    -      4       0     0/0     Se1/0
  34 TTY   9600/9600  -    -      -    -    -      7       0     0/0     Se1/1
  35 TTY   9600/9600  -    -      -    -    -      1       0     0/0     Se1/2
  36 TTY   9600/9600  -    -      -    -    -      1       0     0/0     Se1/3
  65 AUX   9600/9600  - inout     -    -    -      0       0     0/0       -
* 66 VTY              -    -      -    -    -      2       0     0/0       -
  67 VTY              -    -      -    -    -      1       0     0/0       -
  68 VTY              -    -      -    -    -      0       0     0/0       -
  69 VTY              -    -      -    -    -      0       0     0/0       -
  70 VTY              -    -      -    -    -      0       0     0/0       -

We can see vty 33 is associated with Se1/0 through to vty 36 with Se1/3, so we add the terminal server config to those lines

line 33 36
 modem InOut
 transport preferred telnet
 transport input all

To test it out, we just need to telnet to the router and add 2000 to the line number (In this case for Se1/1 we would telnet to port 2034)

adam@labserver1:~$ telnet 192.168.1.250 2034
Trying 192.168.1.250...
Connected to 192.168.1.250.
Escape character is '^]'.

3750-2>en
3750-2#sh run | inc hostname
hostname 3750-2

One of the interesting things that I noticed is that the serial ports don't appear to be considered operational - I don't know if this is because the carrier detect pins aren't working, it certainly does work, just doesn't give the impression from a show int or show controller

2610#sh int s1/1
Serial1/1 is down, line protocol is down
  Hardware is CD2430 in async mode
  MTU 1500 bytes, BW 9 Kbit, DLY 100000 usec, rely 255/255, load 1/255
  Encapsulation SLIP, loopback not set
  DTR is pulsed for 5 seconds on reset
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: weighted fair
  Output queue: 0/1000/64/0 (size/max total/threshold/drops)
     Conversations  0/0/256 (active/max active/max total)
     Reserved Conversations 0/0 (allocated/max allocated)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions
2610#sh controllers s1/1
CD2430 Slot 1, Port 1, Controller 0, Channel 1, Revision 15
Serial Interface Control 5:1 Register (0x40800806) is 0x0
Serial Modem Control Register (0x40800808) is 0x4
  RS-232 DTE cable
Channel mode is asynchronous serial
idb 0x80A4ECD8, buffer size 1500,
Global registers
  rpilr 0x2, rir 0x1, risr 0x0, rfoc 0x0, rdr 0xD
  tpilr 0x1, tir 0x1, tisr 0x2, tftc 0x10, tdr 0x0
  mpilr 0x3, mir 0x3, misr 0x20
  bercnt 0xFF, stk 0x0
Per-channel registers for channel 1
  Option registers
  0x17 0x00 0x04 0xA7 0xA0 0x00 0x00
  Command and status registers
  cmr 0xC2, ccr 0x00, csr 0x88, msvr-rts 0x23, msvr-dtr 0x23
  Clock option registers
  rcor 0x81, rbpr 0x68, tcor 0x20, tbpr 0x68
  Interrupt registers
  ier 0xA9, livr 0x04, licr 0x04
  DMA buffer status 0x09
  DMA receive registers
  arbaddr 0x1579D98, arbcnt 1524, arbsts 0x1
  brbaddr 0x15796D8, brbcnt 1524, brbsts 0x1
  rcbaddr 0x15796D8
  DMA transmit registers
  atbaddr 0x1552660, atbcnt 1, atbsts 0x62
  btbaddr 0x1552660, btbcnt 1, btbsts 0x62
  tcbaddr 0x1552661
  Special character registers
  schr1 0x11, schr2 0x13, schr3 0x00, schr4 0x00
  scrl 0x0, scrh 0x0, lnxt 0x0
Buffer information
  Rx ttycnt 0, sysbuf 0 0
  Tx ttycnt 0
  Rx Buffs: inpk 80A424D0/80A422B4 inheadpk 0 dataq 0 0 0
            pakq 80A426EC 80A426EC 1
  Tx Buffs: outpk 0  txpkq 80A42098 80A41E7C 2
  Priv Flags: 0

Krzysztof Załęski is a legend

Check out Krzytof's CCIE (R&S) Quick Review Kit and be amazed as how he compresses an incredible amount of configuration data across the technologies into relevant chunks

Reading

As I am currently working towards the CCIE Written I am currently skimming through CCIE Routing and Switching Exam Certification Guide, 4th Edition by Wendell Odom, Rus Healy and Denise Donohue.  One of the reviewers is Narbik Kocharians who is a relatively well known instructor in CCIE circles, the book is pretty good but certainly not something you could use as a sole resource - it has other recommended books and areas on CCO to check out on topics though.

After that I plan to zap through Doyle's Routing TCP/IP Volumes 1 and 2 and then go through them all more slowly and take notes, this technique has worked for me in the past.  Amongst other things, I hope that the notes I take that prepare me for the written will be helpful towards the open ended questions when it comes to lab exam.

My 2509 is dying

The trusty 2509 that saw me progress through my CCNP is on its last legs.  It likes to get into a boot loop most of the time usually it breaks out of it just when I get frustrated enough to take it out of the rack and look at it.

I have played with re-seating the flash and DRAM to no available - I also tried swapping both of those that I had in my 2414 as well to no avail.

I am half thinking of getting another one on ebay but they still go for more money than I feel like spending.  As an alternative I am thinking of using my 2610 which has a NM-4A/S and just getting some RS-232 cables and going that way.  My plans are to emulate routers and use real switches, so 4 ports (ok 5 if you include the Aux port) for serial management is plenty.

It's kind of sad to see a faithful bit of kit fade away but its just got to go.

Welcome, I guess?

Just starting the blog.  There are plenty of them, hopefully this will be a repository of interesting things that I see along the way while working towards the Cisco Certified Internetworking Expert (CCIE) in Routing and Switching.

To be fair, this is probably going to really just end up being links towards other peoples blogs or sites that have good information that I want to centralise, hopefully it will also obtain my observations or ideas as well.

If you have come across this blog hoping to get good ideas for your own studies, I wish you the best.  I guess the good thing about this is that it isn't a race against any one.

I have been working in telecommunications and in datanetworking in particular for a good period of time now.  The majority of that has been Cisco focused but I have also played with Juniper and Alcatel-Lucent equipment.  These days I work in a pre-sales role where I don't get my hands dirty as such doing implementations and support - which I do miss a bit.  I see working on my CCIE as part of my ongoing professional development and as a way to ensure that I more than think I know how things work, and actually do.

Most of this is going to be self-funded so I am going to have to be judicious in my selections of lab equipment and training material, fortunately over the years I have been building my library so I have quite a few Cisco Press books already on my shelf and I have been collecting bits of kit to build towards my lab rack at home.