GlobalConfig.net» CCSP Study

IKEv1 Aggressive Mode vs. IKEv1 Main Mode

Brandon Carroll, CCIE #23837 — Wed, 20 Apr 2011 12:00:25 +0000

The question often comes up regarding the differences between IKE aggressive mode and IKE main mode. The answer is pretty simple. In this post we break down IKEv1 aggressive mode and main mode differences and provide a recommendation based on using the more scalable and more secure solution.

The Breakdown

Aggressive mode requires two exchanges totaling three messages whereas Main mode requires three exchanges totaling six messages. If you’re wondering what the difference is, or why you would even care, it all boils down to the level of security you desire. While the two offer the same services its Main mode that protects the identity of the communicating parties. Aggressive mode does not provide protection for the communicating parties. This means that the peers have to exchange information prior to establishing a secure SA.
In the end, Main mode is slower because of the more lengthy exchange. But alas, it is more secure.

What Should I Do?

You may wish to disable IKEv1 aggressive mode. If you do there is something else to consider. If using a Cisco IPsec VPN Client you will no longer be able to authenticate using pre-shared keys. So, if you don’t mind using digital certificates then go for it.

To disable IKEv1 aggressive mode you will need to type the following:

crypto ikev1 am-disable

Cisco Learning Labs Quick Look

Brandon Carroll, CCIE #23837 — Tue, 19 Apr 2011 14:00:52 +0000

This video is a quick look at the Cisco Learning Labs released by Cisco Recently.

Destination NAT on Cisco ASA 8.2

Brandon Carroll, CCIE #23837 — Fri, 21 Jan 2011 13:00:01 +0000

This week I had a few students in a neighboring class that are trying to accomplish a destination nat using Cisco ASA 8.x. They were apparently told by Cisco TAC that this was not possible on anything prior to ASA 8.3 code. This isn’t the case. In fact, it’s been possible for some time on the ASA. Now as it sits they have an ASA sitting behind a Juniper Firewall which is currently providing the destination NAT services, but that’s the only reason they have the Juniper there. So, by being able to do the NAT on the ASA the Juniper Firewall can be removed.

So the scenario goes a little something like this. Originally we had two servers with IP addresses 172.18.0.99 and 172.18.0.100 that are hard coded into a few thousand clients. The servers were consolidated into one server and the IP address is now in a different address space. Rather than changing the static assignment on so many clients, can we just configure the ASA so that when they go to the old hard coded addresses they will be destination NAT’d to the new server IP address? The answer is yes and here is how you do it.

First, We can take a look at the old Topology. Here we note the addresses that are hard coded to the clients on the left.

Amazon Kindle App for iPhone

Brandon Carroll, CCIE #23837 — Thu, 05 Mar 2009 15:35:29 +0000

Some time back I purchased a 1st generation Amazon Kindle. I really liked it. While I owned it I bought 5 Cisco Press books, including Network Security Principles and Practices. There was some talk about Internetwork Expert releasing their workbooks for the kindle, and I actually had some email correspondence where I was told I could be a beta tester. Well that never happened, and although IE announced that the kindle version was coming soon I think they kinda just dropped the thought and changed directions. It probably had something to do with how difficult Amazon makes it to add items to their store.

At any rate, I sold my kindle in leu of an iphone. I love what the iphone can do, and have the “safari bookbag” from ciscopress on there so I can read my safari books. Well, yesterday I received the icing for my cake, that is, the Kindle App for the iphone. The App is free and once installed it allowed me to sync up all the books I purchased when I owned the kindle. It is really easy to read, and remembered what page I was on in all my books. Amazon also has what they call “whispersync” that will sync the iphone app to the kindle if you have both.

Now if IPexpert were to put their workbooks on a kindle, or better yet on an iphone, I would have it all! I’d rather carry the phone or a kindle with me when I travel versus a ton of workbooks! I say IPexpert because I have decided that I like their style and they are pretty much my vendor of choice now. Sorry IE, but I still think highly of you.

Well I MUST get back to my labs. Time is closing in on me….

No Related Posts

Follow UP- IPexpert Training Announced

Brandon Carroll, CCIE #23837 — Mon, 09 Feb 2009 21:15:43 +0000

Last week I posted a brief announcement that IPexpert, the CCIE training company, was to launch a “Sister Company” called IPexpert Training. I didn’t have a lot of time last week to sum up any real thoughts on the subject. Today, I still don’t, but I will anyhow. Where to begin?

Lets begin with the announcement (all quotes from http://ipexpert.ccieblog.com):

Over the next few months you’ll begin seeing the following:A separate brand named “IPexpert Training” (at www.IPexpertTraining.com) that will be focused on CompTia, VMWare, CCENT, CCNA, CCDA, CCNP, CCSP, CCVP and MCSE training products.

My first thought was….wow! If anyone can do it right it would certainly be IPexpert. They did however mention the following”

These classes will *NOT* be Cisco authorized and neither business unit will endorse or offer the Cisco 360 CCIE Lab offering. After understanding the 360 program, products and Cisco’s initiative – I have made the decision that the current CCIE Lab offerings we have (already shipping) are much more mature, proven, more up-to-date and more cost-effective for our clients.

This will make things interesting. What about Cisco Learning Credits (CLC)? Many people that take Cisco training have budgetary constraints and the CLC program helps alot. Will IPexpert find a workaround? Well, regardless I still think they can do it right. Lets examine some more of the announcement:

These classes / products will include self-study materials (Blended Learning), lab workbooks, Audio, Video on Demand, eBooks, quizzers, iPhone applications, ILT (traditional classroom-based training), online mentoring and online training classes – and will be priced very competitively. Students taking these classes will be eligible for a *significant* discount on all IPexpert, Inc. CCIE lab products as that will be their next progression (eventually). These classes will be delivered during the week – as our CCIE Lab classes are (from IPexpert) – however, we will also have weekend and even classes available online and at various locations.

As a user of the IPexpert BLS I have to say that this will be sweet! The CCIE BLS is a fantastic product. I can only imagine that the lower level certs would be as well.

An online community for these students.

I don’t know how this will compare to the Cisco Learning Network, but I can tell you that the Cisco Learning Network doesnt let you blog there. They do however cover ALL categories of Cisco Certification including the CCNA, NP, SP, VP, and IE.

While this sounds pretty cool I have to point out my favorite part of the announcement, and what I believe to be the best feature for a student:

Proctor Labs vRack rental for these certifications (Cisco and Microsoft – VMWare down the road in Q2).

I can’t stress enough how big of a gap this is for students. Think about it, you take a class, work on the gear for a week, go back home and book study until you take the test. Usually you lose the practical knowledge and end up with lopsided book knowledge. If you can use the PL equipment to make a topology that supports ANY certification class you may have a corner on a market that is lacking.

Anyhow, it looks like it could be a great option for students, however I dont know how Cisco will handle it. I’m sure that Learning @ Cisco folks are not happy about another “non-certified” solution but I do know that IPexpert takes care of their customers and will certainly produce a quality product.

You can read the entire announcement on the IPexpert blog.

And now back to my studies! Cheers.

Year End- time to snag some training!

Brandon Carroll, CCIE #23837 — Tue, 16 Dec 2008 08:47:27 +0000

For those of you not familiar with learning credits you may be missing out on training. Check out this page over at Cisco.com that details the program, then go see if you have any that are about to expire. Contact Ascolta, Cisco Learning Partner of the Year- 2007, and register for the class you want using the learning credits you already have. Don’t miss out- they expire after a year!

You may be interested in these courses in Bellevue, Wa. Odds are I’ll be teaching them if they are a Security, Wireless, or Routing and Switching class.

No Related Posts

Changes to this Blog…

Brandon Carroll, CCIE #23837 — Sat, 19 Jul 2008 05:32:48 +0000

First off I want to thank all of you that follow this blog, either by being subscribed via email, subscribed via RSS, or just as regular vistors to www.globalconfig.net. In the few months that I have been running this site I have seen it go from 0 to nearly 100 subscribers and about 2,000 views a week. I wanted to take a few minutes to share some information with you about the changed I plan on making to this blog, as well as the addition of my personal blog found at http://cciestudy.brandonjcarroll.com.

When i first started this blog I was really planning on using it just for the conveyance of information to my students, seeing as I am a Cisco Certified Instructor. I eventually started writing about my studies in pursuit of the CCIE Security. In an effort to add a little differentiation I have decided to move my personal CCIE study blogging to http://cciestudy.brandonjcarroll.com and keep this site for tips, tutorials, and more for the benefit of my students.

Once I have passed the CCIE Security I will begin posting tips on this blog for those that are studying for the CCIE Security. For now I will dedicate this blog to my students benefit and mostly write about the CCNA, CCNP, CCSP, and CCNA Specializations, all certifications that I hold, have held, or am considered “Certified” in.

As I get better at video tutorials I plan on perhaps including them on a more regular basis. For now, I will post a CCNA tip each week, and will discuss the other certifications as they come up either in my classes or as you, the readers, post comments and ask questions.

If you are following me for my CCIE studies or for anything related to the CCIE please visit my site at http://cciestudy.brandonjcarroll.com and subscribe to my feed there. Continue to follow this site as well as It will also contain valuable information for your studies.

Your comments are always welcome and I look forward to hearing from you.

Brandon Carroll

No Related Posts

Cisco Live: Monday Recap

Brandon Carroll, CCIE #23837 — Tue, 24 Jun 2008 04:06:29 +0000

Well Day 2 of my trip is over and the official Day 1 of Cisco Live is underway. Here are some recaps:

The kickoff session was at 4pm. They had a table of glow sticks at the entrance. My intial question was..What are the glow sticks for?

Turns out they have do do with the Cisco Live theme. Notice the light streams in the opening pic of this post.

Once things got kicked off they opened the World of Solutions. The group of folks waiting to get in was insane.

Yep, 11,000 people at once is a really good idea! Actually it wasn’t bad. Once in It was a little push and shove to get the free t-shirt:

I opted to wait until tomorrow. Instead I swung by the Ascolta Booth and ran into Fred Cutaran, VP of Sales and my good friend Eric Kelch hard at work.

After that the free beer was flowing, food was out and there was a buzz about the room. I had an opportunity to meet up with Wendell Odom, Scott Morris, and Leah Lynch. Many more were there but I only had two hours and spent a bit in the Certification Lounge. I can’t wait for the Tech Sessions tomorrow and another full day.

Gotta love Spaghetti (Contest: See details below)

Brandon Carroll, CCIE #23837 — Mon, 23 Jun 2008 16:00:00 +0000

I remember growing up with my cousin Ryan. He was a very picky eater, whose menu consisted of hot-dogs, mac-&-cheese, and of course, spaghetti. It's become obvious to me that spaghetti is one of those foods that everybody likes. We'll you are in for a real treat. Here is a five course meal prepared just fo you that starts with Spaghetti, then moves on to Spaghetti, then more spaghetti, and well….you get the picture.

Here is the setup:

I have been hooked on failblog as of late and in the spirit of failblog I came across a data center that was, well, failing at being a data center. Here are just a few of the PICS I took. I'm curious to see if any if you can top it.

We begin with what appears to be a normal rack. These are some older Cisco 3000 Series VPN concentrators along with a few ASA 5520s loaded with the AIP-SSM modules.

Next we have a rack of 2600's and some PIX 515s. Still doing pretty good right.

Then the cable contractor took the day, neigh- the week off.

Here it starts getting good:

How about this?

and of course there is this:

And finally this:

And this is all in one room! Think you can top this mess? Lets see you try.

GlobalConfig.net will be giving away a $50.00 Amazon Gift Card for a better plate of spaghetti. Simply email you submission to contactme@globalconfig.net. All submissions must be received prior to August 1st, 2008. The winner will be featured via blog post and direct email notification.

Now get to cooking!

Cisco/VUE Second Chance Promotion.

Brandon Carroll, CCIE #23837 — Tue, 03 Jun 2008 21:45:19 +0000

Here is the link to the second chance promotion.

Keep in mind that this is a limited time offer.

If you find this information useful please leave a comment.

Enjoy!

No Related Posts

GlobalConfig.net» CCSP Study

IKEv1 Aggressive Mode vs. IKEv1 Main Mode

The Breakdown

What Should I Do?

Related Posts:

Cisco Learning Labs Quick Look

Related Posts:

Destination NAT on Cisco ASA 8.2

Related Posts:

Amazon Kindle App for iPhone

Related Posts:

Follow UP- IPexpert Training Announced

Related Posts:

Year End- time to snag some training!

Related Posts:

Changes to this Blog…

Related Posts:

Cisco Live: Monday Recap

Related Posts:

Gotta love Spaghetti (Contest: See details below)

Related Posts:

Cisco/VUE Second Chance Promotion.

Related Posts: