Just found this notice in my email as I am heading over to Building C for my second attempt:

Lab Exam Refresh: Effective April 2009, important content changes will be implemented in the CCIE Security Lab Exams. Candidates for lab exams scheduled mid-April 2009 or later should prepare using the v3.0 Lab Equipment and Software Versions. Candidates prior to mid- April 2009 should continue using the v2.0 Lab Equipment and Software Versions. View the Lab Exam Overview for more information.

Here is what is new:

I have to sit back in amazement as I hear the buzz about the new Cisco 360 program that is designed for CCIE level training.  I had a conversation with Greg Ferro at EtherealMind.com yesterday about it.

My take is the money end of it.  I dont think that Cisco really believes that the vendors out there are not up top par, even though that comment was made in a podcast on Network World.

This morning, Wayne Lawson @ Ipexpert had the following to say on the popular Groupstudy mailing list:

Most of the CCIE training vendors (NLI, IE, IPexpert, GK, NIL, NMC,
etc.) were involved in this bidding process – and have a great level of
knowledge as to how the program has been structured, what the offerings are
(positive and negative) and to be quite honest – I think we have a better
feeling for the level of success the program might have (or won’t have) -
because we’ve been focused on this industry for many years.

-Wayne A. Lawson II

Wayne goes on to say that he will be discussing this topic in a new blog, I assume CCIEBlog.com, which will be live soon.  I personally am looking forward to the new Blog at Ipexpert.

Arden Packeer just posted a very nice and very detailed summation on the tie in with Cisco Learning Solution Providers (CLSPs).  Welcome Back Arden.  We missed you!

Finally, you can read more about the program at Network World, over at CCIE Pursuits Blog (I’m pretty sure he broke the story in the Blogosphere), and of course on the Cisco Learning Portal.

On another note it may be of interest to check out the new CCIE TV, which will discuss the changes to the CCIE program, including Cisco 360.  This will take place on October 23rd.

Until I hear more from Cisco I’m not really going to comment on the material, the coverage, or the structure of the program.  I will say that I am looking forward to change.  I will also say that I agree with Arden, I prefer to get my material and training from top notch instructors like the guys at IE, and IPExpert.  I suppose we can only wait and see what happens.

Today I am working on some specific areas that I feel I lack in. Right now I’m working on DMVPN using IEs Volume 1 Workbook. I’ve done this lab before and had no issues. Right now R1 is the Hub (NHS) and r2 and r3 are both coming into R1 over a frame relay network. Here is the issue. R1 to R2- no problems. R1 to R3- the vpn us up but no EIGRP neighbor. Here are the configs. Anyone see what I am doing wrong?

r1#sh run
Building configuration...

Current configuration : 1857 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r1
!
logging queue-limit 100
!
ip subnet-zero
!
!
!
ip audit notify log
ip audit po max-events 100
mpls ldp logging neighbor-changes
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key CISCO address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set 3DES_MD5_TRANS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile VPN
!
crypto ipsec profile DMVPN
set transform-set 3DES_MD5_TRANS
!
!
!
!
!
!
!
!
!
!
!
no voice hpi capture buffer
no voice hpi capture destination
!
!
mta receive maximum-recipients 0
!
!
!
!
interface Loopback0
ip address 150.6.1.1 255.255.255.0
!
interface Loopback1
ip address 192.168.1.1 255.255.255.0
!
interface Tunnel0
bandwidth 1024
ip address 123.123.123.1 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map multicast dynamic
ip nhrp network-id 123
ip nhrp holdtime 60
no ip split-horizon eigrp 100
no ip split-horizon
delay 100
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 123
tunnel protection ipsec profile DMVPN
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0
ip address 136.6.0.1 255.255.255.0
encapsulation frame-relay
frame-relay map ip 136.6.0.2 102 broadcast
frame-relay map ip 136.6.0.3 103 broadcast
no frame-relay inverse-arp
!
interface Serial0/1
no ip address
shutdown
!
router eigrp 100
network 123.0.0.0
network 192.168.1.0
no auto-summary
!
router rip
version 2
network 136.6.0.0
network 150.6.0.0
no auto-summary
!
ip http server
no ip http secure-server
ip classless
!
!
!
!
!
call rsvp-sync
!
!
mgcp profile default
!
!
!
dial-peer cor custom
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
login
!
!
end

r1#

R2:

r2#sh run
Building configuration...

Current configuration : 1844 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r2
!
logging queue-limit 100
!
ip subnet-zero
!
!
!
ip audit notify log
ip audit po max-events 100
mpls ldp logging neighbor-changes
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key CISCO address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set 3DES_MD5_TRANS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set 3DES_MD5_TRANS
!
!
!
!
!
!
!
!
!
!
!
no voice hpi capture buffer
no voice hpi capture destination
!
!
mta receive maximum-recipients 0
!
!
!
!
interface Loopback0
ip address 150.6.2.2 255.255.255.0
!
interface Loopback1
ip address 192.168.2.2 255.255.255.0
!
interface Tunnel0
bandwidth 1024
ip address 123.123.123.2 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map multicast 150.6.1.1
ip nhrp map 123.123.123.1 150.6.1.1
ip nhrp network-id 123
ip nhrp holdtime 60
ip nhrp nhs 123.123.123.1
delay 100
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 123
tunnel protection ipsec profile DMVPN
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0
ip address 136.6.0.2 255.255.255.0
encapsulation frame-relay
frame-relay map ip 136.6.0.1 201 broadcast
frame-relay map ip 136.6.0.3 201 broadcast
no frame-relay inverse-arp
!
interface Serial0/1
no ip address
shutdown
!
router eigrp 100
network 123.0.0.0
network 192.168.2.0
no auto-summary
!
router rip
version 2
network 136.6.0.0
network 150.6.0.0
no auto-summary
!
ip http server
no ip http secure-server
ip classless
!
!
!
!
!
call rsvp-sync
!
!
mgcp profile default
!
!
!
dial-peer cor custom
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
login
!
!
end

R3:

r3#sh run
Building configuration...

Current configuration : 2012 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r3
!
logging queue-limit 100
!
ip subnet-zero
!
!
!
ip audit notify log
ip audit po max-events 100
mpls ldp logging neighbor-changes
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key CISCO address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set 3DES_MD5_TRANS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set 3DES_MD5_TRANS
!
!
!
!
!
!
!
!
!
!
!
no voice hpi capture buffer
no voice hpi capture destination
!
!
mta receive maximum-recipients 0
!
!
!
!
interface Loopback0
ip address 150.6.3.3 255.255.255.0
!
interface Loopback1
ip address 192.168.3.3 255.255.255.0
!
interface Tunnel0
bandwidth 1024
ip address 123.123.123.3 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map multicast 150.6.1.1
ip nhrp map 123.123.123.1 150.6.1.1
ip nhrp network-id 123
ip nhrp holdtime 60
ip nhrp nhs 150.6.1.1
delay 100
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 123
tunnel protection ipsec profile DMVPN
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial1/0
ip address 136.6.0.3 255.255.255.0
encapsulation frame-relay
frame-relay map ip 136.6.0.1 301 broadcast
frame-relay map ip 136.6.0.2 301 broadcast
no frame-relay inverse-arp
!
interface Serial1/1
no ip address
shutdown
!
interface Serial1/2
no ip address
shutdown
!
interface Serial1/3
no ip address
shutdown
!
router eigrp 100
network 123.0.0.0
network 192.168.3.0
no auto-summary
!
router rip
version 2
network 136.6.0.0
network 150.6.0.0
no auto-summary
!
ip http server
no ip http secure-server
ip classless
!
!
!
!
!
call rsvp-sync
!
!
mgcp profile default
!
!
!
dial-peer cor custom
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
login
!
!
end

r3#

Error on R1:

r1#
*Mar 1 01:36:44.458: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 123.123.123.3 (Tunnel0) is down: retry limit exceeded
*Mar 1 01:36:44.458: destroy peer: 123.123.123.3
*Mar 1 01:36:48.068: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 123.123.123.3 (Tunnel0) is up: new adjacency
*Mar 1 01:38:07.587: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 123.123.123.3 (Tunnel0) is down: retry limit exceeded
*Mar 1 01:38:07.587: destroy peer: 123.123.123.3
*Mar 1 01:38:12.226: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 123.123.123.3 (Tunnel0) is up: new adjacency
*Mar 1 01:39:31.749: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 123.123.123.3 (Tunnel0) is down: retry limit exceeded

The answer was simple but my eyes didn’t see it even though I looked at the interface a number of times. The nhrp nhs should be the tunnel interface, not the loopback.

Here is the change being made ans as you can tell, EIGRP established as soon as it was fixed.

r3#sh run int t0
Building configuration...

Current configuration : 385 bytes
!
interface Tunnel0
 bandwidth 1024
 ip address 123.123.123.3 255.255.255.0
 no ip redirects
 ip nhrp authentication CISCO
 ip nhrp map multicast 150.6.1.1
 ip nhrp map 123.123.123.1 150.6.1.1
 ip nhrp network-id 123
 ip nhrp holdtime 60
 ip nhrp nhs 150.6.1.1
 delay 100
 tunnel source Loopback0
 tunnel mode gre multipoint
 tunnel key 123
 tunnel protection ipsec profile DMVPN
end

r3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r3(config)#int t0
r3(config-if)#no  ip nhrp nhs 150.6.1.1
r3(config-if)#no  ip nhrp nhs 150.6.1.1
*Mar  1 01:56:50.836: %LINK-3-BADMACREG: Interface Serial1/0, non-existent MACADDR registry for link 74
-Process= "NHRP", ipl= 0, pid= 99
-Traceback= 809A9698 809A94E0 8085EB28 8085EDF4 80862200 8086548C 8  ip nhrp nhs 150.6.1.1
*Mar  1 01:56:52.391: %LINK-3-BADMACREG: Interface Serial1/0, non-existent MACADDR registry for link 74
-Process= "NHRP", ipl= 0, pid= 99
-Traceback= 809A9698 809A94E0 8085EB28 8085EDF4 80862200 8086548C 808657B4 80865950 803CE314
r3(config-if)#
r3(config-if)#
r3(config-if)#
r3(config-if)#
*Mar  1 01:56:56.201: %LINK-3-BADMACREG: Interface Serial1/0, non-existent MACADDR registry for link 74
-Process= "NHRP", ipl= 0, pid= 99
-Traceback= 809A9698 809A94E0 8085EB28 8085EDF4 80862200 8086548C 808657B4 80865950 803CE314
*Mar  1 01:57:02.704: %LINK-3-BADMACREG: Interface Serial1/0, non-existent MACADDR registry for link 74
-Process= "NHRP", ipl= 0, pid= 99
-Traceback= 809A9698 809A94E0 8085EB28 8085EDF4 80862200 8086548C 808657B4 80865950 803CE314
r3(config-if)#
*Mar  1 01:57:16.322: %LINK-3-BADMACREG: Interface Serial1/0, non-existent MACADDR registry for link 74
-Process= "NHRP", ipl= 0, pid= 99
-Traceback= 809A9698 809A94E0 8085EB28 8085EDF4 80862200 8086548C 808657B4 80865950 803CE314
r3(config-if)#
r3(config-if)#
r3(config-if)#
r3(config-if)#  ip nhrp nhs 123.123.123.1
r3(config-if)#''
*Mar  1 01:57:35.469: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 123.123.123.1 (Tunnel0) is up: new adjacen
*Mar  1 01:57:35.477: IP-EIGRP(Default-IP-Routing-Table:100): 123.123.123.0/24 - do advertise out Tunnel0
*Mar  1 01:57:35.477: IP-EIGRP(Default-IP-Routing-Table:100): 192.168.3.0/24 - do advertise out Tunnel0
*Mar  1 01:57:35.477: IP-EIGRP(Default-IP-Routing-Table:100): Int 192.168.3.0/24 metric 128256 - 256 128000
r3(config-if)#
r3(config-if)#
r3(config-if)#
r3(config-if)# 

Thanks PacketU!

I’m working on IPExpert section 16.  I’ve been working on it for days.  Im making good progress today but have run into an OSPF deal that has me a little stumped.  First off here is a little clip of the topology:

Uploaded with plasq‘s Skitch!

Now here is the config from the routers:

R2:

interface Serial0/1/0
no ip address
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay lmi-type cisco
!
interface Serial0/1/0.4 point-to-point
ip address 192.1.24.2 255.255.255.0
ip access-group IDS_s0/1/0.4_in_0 in
frame-relay interface-dlci 104
!
interface Serial0/1/0.5 point-to-point
ip address 192.1.25.2 255.255.255.0
ip access-group IDS_s0/1/0.5_in_0 in
frame-relay interface-dlci 105
!
interface Serial0/1/0.6 point-to-point
ip address 192.1.26.2 255.255.255.0
frame-relay interface-dlci 106
!
interface Serial0/2/0
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet1/0
no switchport
ip address 192.1.12.2 255.255.255.0
!
!
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
area 10 virtual-link 4.4.4.4
network 2.2.2.2 0.0.0.0 area 0
network 192.1.12.0 0.0.0.255 area 0
network 192.1.24.0 0.0.0.255 area 10
network 192.1.25.0 0.0.0.255 area 0
network 192.1.26.0 0.0.0.255 area 10
!
ip classless
!

R5:

interface Serial0/1/0
ip address 192.1.25.5 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
frame-relay map ip 192.1.25.2 501 broadcast
no frame-relay inverse-arp
frame-relay lmi-type cisco
!
interface Serial0/2/0
no ip address
shutdown
!
router eigrp 100
redistribute ospf 1 metric 1 1 1 1 1
network 10.5.5.0 0.0.0.255
no auto-summary
!
router ospf 1
router-id 5.5.5.5
log-adjacency-changes
redistribute eigrp 100 metric 120 subnets
network 5.5.5.5 0.0.0.0 area 0
network 192.1.25.0 0.0.0.255 area 0
network 200.1.1.6 0.0.0.0 area 0
!
ip classless
!
!
ip http server

R4:

interface Serial0/0/0
ip address 192.1.24.4 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
frame-relay map ip 192.1.24.2 401 broadcast
no frame-relay inverse-arp
frame-relay lmi-type cisco
!
router ospf 1
router-id 4.4.4.4
no log-adjacency-changes
area 10 virtual-link 2.2.2.2
network 4.4.4.4 0.0.0.0 area 10
network 192.1.24.0 0.0.0.255 area 10
network 192.1.49.0 0.0.0.255 area 10
!
ip classless
!
!
ip http server
no ip http secure-server

R6:

!
interface Serial0/1/0
ip address 192.1.26.6 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
--More--
frame-relay map ip 192.1.26.2 601 broadcast
no frame-relay inverse-arp
frame-relay lmi-type cisco
!
interface Serial0/2/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/2/1
no ip address
shutdown
clock rate 2000000
!
router ospf 1
router-id 6.6.6.6
log-adjacency-changes
redistribute rip metric 120 subnets
network 6.6.6.6 0.0.0.0 area 10
network 192.1.6.0 0.0.0.255 area 10
network 192.1.26.0 0.0.0.255 area 10
!
router rip
version 2
redistribute ospf 1 metric 5
network 172.16.0.0
no auto-summary
!
ip classless
!
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
warm-reboot
scheduler allocate 20000 1000
!
end

What I’m having an issue with is that R4 and R6 keep getting the virtual-link error but they shouldn’t be seeing R5 in the first place. Only R2 should have R5 as a neighbor.

*Oct 10 18:18:53.238: %OSPF-4-ERRRCV: Received invalid packet: 

mismatch area ID, from backbone area must be virtual-link but not 

found from 192.1.25.5, S 

What am I missing here?

It is always weird to see yourself on video.  Oh well.  Here is my interview with Jeff Doyle on the CCNA wireless certification.

http://www.informit.com/podcasts/episode.aspx?e=fcaea244-81a0-42db-8e06-b1be4ab5c09f

I spent the day working on Ipexperts Section 16: Multiprotocol Challenge Lab.  I’m having a tough time making it through the entire lab because of distractions.  Work, Kids, Travel.  Today I decided to grab up another session after my original session ended and work on a different lab.  I still have time left but its 11pm, ive been up since 5, and I can’t focus anymore.  I ended up working on NAC.

Here are my notes so far:

• Basic Configuration of the VPN concentrator from the CLI and Graphical Interface:  Nothing too tough here.  I was able to complete this task with no problems. (after all this study I better be able to…)
• Configure Groups, IP Pools, Split Tunneling, and Authentication on the Concentrator:  Not really any issues here except that they created the address pools and authentication servers just for the group and I did it at a global level for the base group.  There were no specific instructions so I dont think this would have caused me any issues.
• Configuring Certificate Authority on the Win2k3 Server:  Installing the Cert on the server was no problem.  SCEP didn’t work but it could be that SCEP isn’t installed on the server.  I messed with manual certs for a bit, which I can do, but gave up because I was tired.
• Configuring Network Admission Control:  Never got this far.  Will try again tomorrow.

http://tools.cisco.com/gdrp/coiga/showsurvey.do?surveyCode=380&keyCode=123668_4

This week at Ascolta in Bellevue, Wa I will be teaching an IPS course.  This is one of my favorite courses to teach and it is extremely relevant to my studies in pursuit of the CCIE Security.  This week I will be posting about IPS as much as possible.  I have a few Top-10 lists that will go up sometime this week as well as some extra resources.  In the mean time I wanted to throw in this video about the IPS Manager Express.  It’s not covered in the course but if you have 5 IPS sensors or less its pretty cool.  I especially like the option to save reports as a PDF.